f75c62ca244fa9ca65f0dc2958db662b3f2c8467b3d1ef2f6f8df8fe2aaeca5c

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe"	WindowsHostManager(14).exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WindowsHostManager(14).exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WindowsHostManager(14).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WindowsHostManager(14).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WindowsHostManager(14).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	WindowsHostManager(14).exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	WindowsHostManager(14).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	WindowsHostManager(14).exe

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	WindowsHostManager(14).exe

Executes dropped EXE 1 IoCs

pid	Process
5676	WindowsHostManager.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	WindowsHostManager(14).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	WindowsHostManager(14).exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHostManager = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe\""	WindowsHostManager(14).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHostManager = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe\""	WindowsHostManager.exe

Enumerates connected drives 3 TTPs 60 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe
File opened (read-only)	\??\z:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4252	cmd.exe
236	cmd.exe
1748	cmd.exe
800	cmd.exe
3228	cmd.exe
3760	cmd.exe
4172	cmd.exe
3728	cmd.exe
5832	cmd.exe
4644	cmd.exe
1300	cmd.exe
4872	cmd.exe
5956	cmd.exe
4720	cmd.exe
1432	cmd.exe
4456	cmd.exe
2332	cmd.exe
2800	cmd.exe
2624	cmd.exe
4580	cmd.exe
1444	cmd.exe
4996	cmd.exe
816	cmd.exe
3516	cmd.exe
5820	cmd.exe
4556	cmd.exe
2556	cmd.exe
4284	cmd.exe
1044	cmd.exe
628	cmd.exe
4764	cmd.exe
5856	cmd.exe
4324	cmd.exe
5100	cmd.exe
1920	cmd.exe
5060	cmd.exe
5064	cmd.exe
2516	cmd.exe
3324	cmd.exe
4336	cmd.exe
5476	cmd.exe
4112	cmd.exe
6020	cmd.exe
5896	cmd.exe
720	cmd.exe
6016	cmd.exe
5952	cmd.exe
2836	cmd.exe
5768	cmd.exe
4544	cmd.exe
3964	cmd.exe
4592	cmd.exe
4420	cmd.exe
6044	cmd.exe
3564	cmd.exe
4116	cmd.exe
5572	cmd.exe
2648	cmd.exe
5540	cmd.exe
2544	cmd.exe
692	cmd.exe
3068	cmd.exe
5340	cmd.exe
3636	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4800	schtasks.exe
4792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2580	WindowsHostManager(14).exe
2580	WindowsHostManager(14).exe
2580	WindowsHostManager(14).exe
5676	WindowsHostManager.exe
5676	WindowsHostManager.exe
5676	WindowsHostManager.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	WindowsHostManager(14).exe
Token: SeDebugPrivilege	5676	WindowsHostManager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 3544	2580	WindowsHostManager(14).exe	51
PID 2580 wrote to memory of 4800	2580	WindowsHostManager(14).exe	88
PID 2580 wrote to memory of 5676	2580	WindowsHostManager(14).exe	91
PID 5676 wrote to memory of 3544	5676	WindowsHostManager.exe	51
PID 5676 wrote to memory of 4792	5676	WindowsHostManager.exe	92
PID 5676 wrote to memory of 6020	5676	WindowsHostManager.exe	94
PID 6020 wrote to memory of 4672	6020	cmd.exe	96
PID 5676 wrote to memory of 5952	5676	WindowsHostManager.exe	97
PID 5952 wrote to memory of 5428	5952	cmd.exe	99
PID 5676 wrote to memory of 5060	5676	WindowsHostManager.exe	100
PID 5060 wrote to memory of 6092	5060	cmd.exe	102
PID 5676 wrote to memory of 2412	5676	WindowsHostManager.exe	103
PID 2412 wrote to memory of 264	2412	cmd.exe	105
PID 5676 wrote to memory of 2836	5676	WindowsHostManager.exe	106
PID 5676 wrote to memory of 3956	5676	WindowsHostManager.exe	107
PID 2836 wrote to memory of 2444	2836	cmd.exe	110
PID 3956 wrote to memory of 3316	3956	cmd.exe	111
PID 5676 wrote to memory of 5404	5676	WindowsHostManager.exe	112
PID 5676 wrote to memory of 2008	5676	WindowsHostManager.exe	113
PID 5404 wrote to memory of 4396	5404	cmd.exe	116
PID 2008 wrote to memory of 3488	2008	cmd.exe	117
PID 5676 wrote to memory of 6044	5676	WindowsHostManager.exe	119
PID 5676 wrote to memory of 4444	5676	WindowsHostManager.exe	120
PID 6044 wrote to memory of 3012	6044	cmd.exe	123
PID 4444 wrote to memory of 1764	4444	cmd.exe	124
PID 5676 wrote to memory of 5028	5676	WindowsHostManager.exe	125
PID 5676 wrote to memory of 3564	5676	WindowsHostManager.exe	126
PID 5028 wrote to memory of 5956	5028	cmd.exe	129
PID 3564 wrote to memory of 5912	3564	cmd.exe	130
PID 5676 wrote to memory of 5232	5676	WindowsHostManager.exe	131
PID 5232 wrote to memory of 3632	5232	cmd.exe	133
PID 5676 wrote to memory of 5528	5676	WindowsHostManager.exe	134
PID 5528 wrote to memory of 2396	5528	cmd.exe	136
PID 5676 wrote to memory of 2892	5676	WindowsHostManager.exe	137
PID 2892 wrote to memory of 4620	2892	cmd.exe	139
PID 5676 wrote to memory of 5896	5676	WindowsHostManager.exe	140
PID 5896 wrote to memory of 4756	5896	cmd.exe	142
PID 5676 wrote to memory of 1852	5676	WindowsHostManager.exe	143
PID 1852 wrote to memory of 1284	1852	cmd.exe	145
PID 5676 wrote to memory of 3668	5676	WindowsHostManager.exe	146
PID 3668 wrote to memory of 1360	3668	cmd.exe	148
PID 5676 wrote to memory of 1752	5676	WindowsHostManager.exe	149
PID 1752 wrote to memory of 3760	1752	cmd.exe	151
PID 5676 wrote to memory of 2196	5676	WindowsHostManager.exe	152
PID 2196 wrote to memory of 5452	2196	cmd.exe	154
PID 5676 wrote to memory of 5820	5676	WindowsHostManager.exe	155
PID 5820 wrote to memory of 2952	5820	cmd.exe	157
PID 5676 wrote to memory of 4116	5676	WindowsHostManager.exe	158
PID 4116 wrote to memory of 3048	4116	cmd.exe	160
PID 5676 wrote to memory of 5328	5676	WindowsHostManager.exe	161
PID 5328 wrote to memory of 1304	5328	cmd.exe	163
PID 5676 wrote to memory of 5572	5676	WindowsHostManager.exe	164
PID 5572 wrote to memory of 3900	5572	cmd.exe	166
PID 5676 wrote to memory of 3228	5676	WindowsHostManager.exe	167
PID 3228 wrote to memory of 5928	3228	cmd.exe	169
PID 5676 wrote to memory of 3496	5676	WindowsHostManager.exe	170
PID 3496 wrote to memory of 1372	3496	cmd.exe	172
PID 5676 wrote to memory of 2668	5676	WindowsHostManager.exe	173
PID 2668 wrote to memory of 3412	2668	cmd.exe	175
PID 5676 wrote to memory of 892	5676	WindowsHostManager.exe	176
PID 892 wrote to memory of 3744	892	cmd.exe	178
PID 5676 wrote to memory of 4892	5676	WindowsHostManager.exe	179
PID 4892 wrote to memory of 4672	4892	cmd.exe	181
PID 5676 wrote to memory of 4900	5676	WindowsHostManager.exe	182

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\WindowsHostManager(14).exe
"C:\Users\Admin\AppData\Local\Temp\WindowsHostManager(14).exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /Create /TN "Microsoft\Windows\HostManager\Service" /TR "\"C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe\"" /RL HIGHEST /SC ONLOGON /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4800
- C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /Create /TN "Microsoft\Windows\HostManager\Service" /TR "\"C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe\"" /RL HIGHEST /SC ONLOGON /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4672
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:6092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:264
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3316
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3012
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5956
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5232
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1284
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1360
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5452
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3900
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:5928
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1372
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3412
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4672
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:4900
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:5524
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4420
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:2648
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:5300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:616
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:692
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:1104
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5316
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:4612
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:1636
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:5956
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:5540
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:2120
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:2624
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:2256
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:1208
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:1868
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4572
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:3760
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:5768
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4580
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4932
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:1044
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:3572
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:3900
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:568
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:5220
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4468
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4252
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3052
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:628
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:3412
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2368
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:236
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:248
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:5784
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4556
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4544
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:1004
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:5612
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4592
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:3856
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:5064
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4172
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:5008
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:3728
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:5832
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:1712
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:2516
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:3324
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:6132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4456
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:1444
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1284
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4764
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:2852
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4644
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4336
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:1304
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:5960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:2556
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5900
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:1748
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4284
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:5856
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:2544
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4720
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:5476
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2604
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:3068
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:1836
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2992
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:4924
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:5340
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:3636
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2424
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4996
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2112
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:816
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:5092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:3964
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:720
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:3516
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:2332
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:1448
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:3560
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4112
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:1348
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:2800
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1336
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:800
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:2704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:2660
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:4884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:6016
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2336
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:3576
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:1432
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:2776
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:5152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:2604
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:2136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:4800
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:5868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:1300
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3456
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:4872
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:4324
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:4432
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:1144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    - Executes a command shell one-liner
    PID:5100
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:1468
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:3876
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    - Executes a command shell one-liner
    PID:1920
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:4200
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:4984
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:3028
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /S
    3⤵
    PID:3368
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /S
      4⤵
      PID:3632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c mountvol z: /D
    3⤵
    PID:3684
  - - C:\Windows\system32\mountvol.exe
      mountvol z: /D
      4⤵
      Enumerates connected drives
      PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry