98282df62818533708f02894eb7be2ec890abfbfe9095c4f590c505ad3434508

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dControl.exe

Modifies firewall policy service 3 TTPs 4 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	MsMpEng.exe

UPX dump on OEP (original entry point) 19 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5b8-10.dat	UPX
behavioral2/memory/3616-16-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3616-36-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1016-55-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4600-114-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4272-115-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4272-118-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/2548-691-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1532-1309-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/5280-1839-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/2984-2368-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1260-3009-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3784-3011-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4588-3515-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/2564-4108-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3124-4622-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3964-5181-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/5504-5757-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1952-6275-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	3884	MpCmdRun.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
3616	dControl.exe
1016	dControl.exe
4272	dControl.exe
4600	dControl.exe
2548	dControl.exe

Windows security modification 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6028	powershell.exe
5388	powershell.exe
4160	powershell.exe
5368	powershell.exe
3460	powershell.exe
248	powershell.exe
2884	powershell.exe
5156	powershell.exe
3420	powershell.exe
704	powershell.exe
4896	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe

Modifies Security services 2 TTPs 6 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3"	dControl.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3616-36-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1016-55-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4600-114-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4272-115-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4272-118-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2548-691-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1532-1309-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5280-1839-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2984-2368-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1260-3009-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3784-3011-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4588-3515-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2564-4108-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3124-4622-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3964-5181-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5504-5757-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1952-6275-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsMpEng.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsMpEng.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5b8-10.dat	upx
behavioral2/memory/3616-16-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3616-36-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1016-55-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4600-114-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4272-115-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4272-118-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2548-691-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1532-1309-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5280-1839-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2984-2368-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1260-3009-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3784-3011-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4588-3515-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2564-4108-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3124-4622-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3964-5181-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5504-5757-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1952-6275-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_udgk1xde.odj.ps1	powershell.exe
File created	C:\Windows\SystemTemp\D8723945-EC78-4436-83BD-198285403C67MpCommU\B689BEF9-B97F-4ACE-B5A1-2B3F6CD7480A	MpCmdRun.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wlmlmypo.j3j.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_044o4u2h.ppc.psm1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\tmp85EF.tmp	mofcomp.exe
File created	C:\Windows\SystemTemp\8CBB05CA-19C5-0FE0-8B4A-855FD1234C8C.man	MsMpEng.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0aihovzl.txj.psm1	powershell.exe
File created	C:\Windows\SystemTemp\MpCmdRun-b-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SystemTemp\D8723945-EC78-4436-83BD-198285403C67MpCommU\mpam-c3593a3.exe	MpCmdRun.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ixdsonqu.420.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zpwqaqci.4js.ps1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\MpCmdRun.log	mpcmdrun.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_behzke50.zwd.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lwt0bmme.rdm.ps1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dControl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dControl.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Kills process with taskkill 1 IoCs

pid	Process
3520	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Defender\CachedProxyBypass	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\DefenderCSP.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\ProtectionManagement.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	dControl.exe
3616	dControl.exe
3616	dControl.exe
3616	dControl.exe
3616	dControl.exe
3616	dControl.exe
1016	dControl.exe
1016	dControl.exe
1016	dControl.exe
1016	dControl.exe
1016	dControl.exe
1016	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4600	dControl.exe
4600	dControl.exe
4600	dControl.exe
4600	dControl.exe
4600	dControl.exe
4600	dControl.exe
4272	dControl.exe
4272	dControl.exe
3420	powershell.exe
3420	powershell.exe
4272	dControl.exe
4272	dControl.exe
3420	powershell.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4272	dControl.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
3164	MsMpEng.exe
812	Process not Found
4332	MsMpEng.exe
4332	MsMpEng.exe
4332	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3616	dControl.exe
Token: SeIncreaseQuotaPrivilege	3616	dControl.exe
Token: 0	3616	dControl.exe
Token: SeDebugPrivilege	1016	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	1016	dControl.exe
Token: SeIncreaseQuotaPrivilege	1016	dControl.exe
Token: SeDebugPrivilege	4272	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4272	dControl.exe
Token: SeIncreaseQuotaPrivilege	4272	dControl.exe
Token: 0	4272	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3164	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	3164	MsMpEng.exe
Token: SeTcbPrivilege	3164	MsMpEng.exe
Token: SeSecurityPrivilege	3164	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	3164	MsMpEng.exe
Token: SeLoadDriverPrivilege	3164	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	3164	MsMpEng.exe
Token: SeBackupPrivilege	3164	MsMpEng.exe
Token: SeRestorePrivilege	3164	MsMpEng.exe
Token: SeShutdownPrivilege	3164	MsMpEng.exe
Token: SeDebugPrivilege	3164	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	3164	MsMpEng.exe
Token: SeChangeNotifyPrivilege	3164	MsMpEng.exe
Token: SeImpersonatePrivilege	3164	MsMpEng.exe
Token: SeSecurityPrivilege	1400	mofcomp.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeSecurityPrivilege	1076	wevtutil.exe
Token: SeBackupPrivilege	1076	wevtutil.exe
Token: SeSecurityPrivilege	4276	wevtutil.exe
Token: SeBackupPrivilege	4276	wevtutil.exe
Token: SeDebugPrivilege	3164	MsMpEng.exe
Token: SeBackupPrivilege	3164	MsMpEng.exe
Token: SeRestorePrivilege	3164	MsMpEng.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3420	powershell.exe
Token: SeIncreaseQuotaPrivilege	3420	powershell.exe
Token: SeSecurityPrivilege	3420	powershell.exe
Token: SeTakeOwnershipPrivilege	3420	powershell.exe
Token: SeLoadDriverPrivilege	3420	powershell.exe
Token: SeSystemtimePrivilege	3420	powershell.exe
Token: SeBackupPrivilege	3420	powershell.exe
Token: SeRestorePrivilege	3420	powershell.exe
Token: SeShutdownPrivilege	3420	powershell.exe
Token: SeSystemEnvironmentPrivilege	3420	powershell.exe
Token: SeUndockPrivilege	3420	powershell.exe
Token: SeManageVolumePrivilege	3420	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4332	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	4332	MsMpEng.exe
Token: SeTcbPrivilege	4332	MsMpEng.exe
Token: SeSecurityPrivilege	4332	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	4332	MsMpEng.exe
Token: SeLoadDriverPrivilege	4332	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	4332	MsMpEng.exe
Token: SeBackupPrivilege	4332	MsMpEng.exe
Token: SeRestorePrivilege	4332	MsMpEng.exe
Token: SeShutdownPrivilege	4332	MsMpEng.exe
Token: SeDebugPrivilege	4332	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	4332	MsMpEng.exe
Token: SeChangeNotifyPrivilege	4332	MsMpEng.exe
Token: SeImpersonatePrivilege	4332	MsMpEng.exe
Token: SeDebugPrivilege	4272	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4272	dControl.exe
Token: SeIncreaseQuotaPrivilege	4272	dControl.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
1736	SecurityHealthSystray.exe
1736	SecurityHealthSystray.exe
1736	SecurityHealthSystray.exe
1736	SecurityHealthSystray.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
1736	SecurityHealthSystray.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
5060	SecurityHealthSystray.exe
5060	SecurityHealthSystray.exe
5060	SecurityHealthSystray.exe
5060	SecurityHealthSystray.exe
4272	dControl.exe
5060	SecurityHealthSystray.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
1736	SecurityHealthSystray.exe
1736	SecurityHealthSystray.exe
1736	SecurityHealthSystray.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
1736	SecurityHealthSystray.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
5060	SecurityHealthSystray.exe
5060	SecurityHealthSystray.exe
5060	SecurityHealthSystray.exe
4272	dControl.exe
5060	SecurityHealthSystray.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe
4272	dControl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
856	explorer.exe
1592	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3616	4396	2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe	90
PID 4272 wrote to memory of 4600	4272	dControl.exe	100
PID 4272 wrote to memory of 2072	4272	dControl.exe	101
PID 3164 wrote to memory of 1400	3164	MsMpEng.exe	103
PID 856 wrote to memory of 1736	856	explorer.exe	106
PID 3164 wrote to memory of 3520	3164	MsMpEng.exe	129
PID 3164 wrote to memory of 1076	3164	MsMpEng.exe	111
PID 3164 wrote to memory of 4276	3164	MsMpEng.exe	113
PID 4272 wrote to memory of 3420	4272	dControl.exe	115
PID 4272 wrote to memory of 2548	4272	dControl.exe	169
PID 4272 wrote to memory of 4268	4272	dControl.exe	124
PID 1592 wrote to memory of 5060	1592	explorer.exe	127
PID 4332 wrote to memory of 5176	4332	MsMpEng.exe	128
PID 4332 wrote to memory of 3884	4332	MsMpEng.exe	130
PID 4272 wrote to memory of 6028	4272	dControl.exe	132
PID 4332 wrote to memory of 3024	4332	MsMpEng.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_74088e5a03a6f54809a202b803181e21_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /TI
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender TamperProtection settings
      Modifies security service
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Windows security modification
      Indicator Removal: Clear Persistence
      Modifies Security services
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4600
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:2072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2548
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        Drops file in Windows directory
        
        PID:4268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:6028
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:1532
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5388
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:5280
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:5616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4160
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:2984
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5368
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:1260
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3916
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|5740|2052|
        5⤵
        
        PID:3784
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:1368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3460
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:4588
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:4684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:248
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:2564
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2884
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:3124
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:704
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:3964
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5156
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:5504
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:4952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4896
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:792
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dControl.exe" /EXP |1500|
        5⤵
        
        PID:1952
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:4852

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\8CBB05CA-19C5-0FE0-8B4A-855FD1234C8C.man
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\8CBB05CA-19C5-0FE0-8B4A-855FD1234C8C.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:1356

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1736

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4500

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1756

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3344

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3324

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Drops file in Windows directory
  PID:5176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3520
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  - Downloads MZ/PE file
  - Drops file in Windows directory
  PID:3884
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 0E552BE9-5D19-7F07-2D81-A1131427B2E9
  2⤵
  - Drops file in Windows directory
  PID:3024
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:3444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5060

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5884

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2492

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5036
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5788
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:2440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2424
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3392

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4372

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3728

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2232
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5984
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:1284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2548
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4572
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:3112

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5740

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4964

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2800

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:4204
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1880
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3760
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:2352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2956
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4556

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5840

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3848

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:4716
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:4364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2052
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:668
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1288

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4244

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5664

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3396

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5052
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5076
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:2984
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:1588
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:5516

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4240
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:3752

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:704

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3496

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2844
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5968
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:1224
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:4336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2408
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1688

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2148

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4800

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2984
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4592
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:2812
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3848
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5216

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4244

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5504

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:1728
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2884
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:4932
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1924
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4432

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2592

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4684

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:1204
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5812
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:4360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4664
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6076

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3492

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:3396
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5524
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3120

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2740
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:820

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1872

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry