Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
Существующий POS.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Существующий POS.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target Существующий POS.bat
- Size 2KB
- Sample261003-kyly4avdnb
- SHA256 6ff5539a56087a3a84c2974ea59b6939b7af62fe0242937793259cb8df6a6ba2
- MD5 682fa4d1047de533ed5cab66be7be023
- SHA1 7067c8f870a1e8cbc4cd25de3c60f55dc170cb2d
- SHA512 244d340acdcb85cf6963840eb85a23dd0354b47b7da3d258d81cc5ffe49fb1d04947be9dbf15dfb8aa441ffdb939effd19be9449aece3f46bc2acf80ce2afea4
- TLSH T1E9517465761389B6DA69B6753D0B4820A73A704FE6806E567C4B232900E34CE917FDCF
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe - Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
pid Process 1580 bcdedit.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3368 netsh.exe 2968 netsh.exe - Disables service(s) 3 TTPs
- Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
- Power Settings 1 TTPs 3 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4804 powercfg.exe 5848 powercfg.exe 4760 powercfg.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\devmgmt.msc mmc.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_nvmedisk.PNF mmc.exe File created C:\Windows\INF\c_ramdisk.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\c_primitive.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\eyegazeioctl.PNF mmc.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_generic.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File created C:\Windows\INF\c_i3c.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1748 sc.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2988 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 5740 reg.exe 2624 reg.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5988 WMIC.exe 5988 WMIC.exe 5988 WMIC.exe 5988 WMIC.exe 2456 WMIC.exe 2456 WMIC.exe 2456 WMIC.exe 2456 WMIC.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2464 mmc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4804 powercfg.exe Token: SeCreatePagefilePrivilege 4804 powercfg.exe Token: SeShutdownPrivilege 5848 powercfg.exe Token: SeCreatePagefilePrivilege 5848 powercfg.exe Token: SeShutdownPrivilege 4760 powercfg.exe Token: SeCreatePagefilePrivilege 4760 powercfg.exe Token: SeIncreaseQuotaPrivilege 5988 WMIC.exe Token: SeSecurityPrivilege 5988 WMIC.exe Token: SeTakeOwnershipPrivilege 5988 WMIC.exe Token: SeLoadDriverPrivilege 5988 WMIC.exe Token: SeSystemProfilePrivilege 5988 WMIC.exe Token: SeSystemtimePrivilege 5988 WMIC.exe Token: SeProfSingleProcessPrivilege 5988 WMIC.exe Token: SeIncBasePriorityPrivilege 5988 WMIC.exe Token: SeCreatePagefilePrivilege 5988 WMIC.exe Token: SeBackupPrivilege 5988 WMIC.exe Token: SeRestorePrivilege 5988 WMIC.exe Token: SeShutdownPrivilege 5988 WMIC.exe Token: SeDebugPrivilege 5988 WMIC.exe Token: SeSystemEnvironmentPrivilege 5988 WMIC.exe Token: SeRemoteShutdownPrivilege 5988 WMIC.exe Token: SeUndockPrivilege 5988 WMIC.exe Token: SeManageVolumePrivilege 5988 WMIC.exe Token: 33 5988 WMIC.exe Token: 34 5988 WMIC.exe Token: 35 5988 WMIC.exe Token: 36 5988 WMIC.exe Token: SeIncreaseQuotaPrivilege 5988 WMIC.exe Token: SeSecurityPrivilege 5988 WMIC.exe Token: SeTakeOwnershipPrivilege 5988 WMIC.exe Token: SeLoadDriverPrivilege 5988 WMIC.exe Token: SeSystemProfilePrivilege 5988 WMIC.exe Token: SeSystemtimePrivilege 5988 WMIC.exe Token: SeProfSingleProcessPrivilege 5988 WMIC.exe Token: SeIncBasePriorityPrivilege 5988 WMIC.exe Token: SeCreatePagefilePrivilege 5988 WMIC.exe Token: SeBackupPrivilege 5988 WMIC.exe Token: SeRestorePrivilege 5988 WMIC.exe Token: SeShutdownPrivilege 5988 WMIC.exe Token: SeDebugPrivilege 5988 WMIC.exe Token: SeSystemEnvironmentPrivilege 5988 WMIC.exe Token: SeRemoteShutdownPrivilege 5988 WMIC.exe Token: SeUndockPrivilege 5988 WMIC.exe Token: SeManageVolumePrivilege 5988 WMIC.exe Token: 33 5988 WMIC.exe Token: 34 5988 WMIC.exe Token: 35 5988 WMIC.exe Token: 36 5988 WMIC.exe Token: SeIncreaseQuotaPrivilege 2456 WMIC.exe Token: SeSecurityPrivilege 2456 WMIC.exe Token: SeTakeOwnershipPrivilege 2456 WMIC.exe Token: SeLoadDriverPrivilege 2456 WMIC.exe Token: SeSystemProfilePrivilege 2456 WMIC.exe Token: SeSystemtimePrivilege 2456 WMIC.exe Token: SeProfSingleProcessPrivilege 2456 WMIC.exe Token: SeIncBasePriorityPrivilege 2456 WMIC.exe Token: SeCreatePagefilePrivilege 2456 WMIC.exe Token: SeBackupPrivilege 2456 WMIC.exe Token: SeRestorePrivilege 2456 WMIC.exe Token: SeShutdownPrivilege 2456 WMIC.exe Token: SeDebugPrivilege 2456 WMIC.exe Token: SeSystemEnvironmentPrivilege 2456 WMIC.exe Token: SeRemoteShutdownPrivilege 2456 WMIC.exe Token: SeUndockPrivilege 2456 WMIC.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 mmc.exe 2464 mmc.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2076 2988 cmd.exe 90 PID 2988 wrote to memory of 5792 2988 cmd.exe 91 PID 5792 wrote to memory of 2028 5792 net.exe 92 PID 2988 wrote to memory of 5740 2988 cmd.exe 93 PID 2988 wrote to memory of 3368 2988 cmd.exe 94 PID 2988 wrote to memory of 1748 2988 cmd.exe 95 PID 2988 wrote to memory of 4804 2988 cmd.exe 96 PID 2988 wrote to memory of 5848 2988 cmd.exe 97 PID 2988 wrote to memory of 4760 2988 cmd.exe 98 PID 2988 wrote to memory of 1580 2988 cmd.exe 99 PID 2988 wrote to memory of 2624 2988 cmd.exe 100 PID 2988 wrote to memory of 5988 2988 cmd.exe 101 PID 2988 wrote to memory of 2456 2988 cmd.exe 103 PID 2988 wrote to memory of 4176 2988 cmd.exe 104 PID 2988 wrote to memory of 4172 2988 cmd.exe 105 PID 2988 wrote to memory of 2968 2988 cmd.exe 106 PID 2988 wrote to memory of 3952 2988 cmd.exe 107 PID 2988 wrote to memory of 4232 2988 cmd.exe 108 PID 2988 wrote to memory of 5788 2988 cmd.exe 109 PID 2988 wrote to memory of 2464 2988 cmd.exe 110
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Существующий POS.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\chcp.comchcp 8662⤵PID:2076
-
-
C:\Windows\system32\net.exenet accounts /maxpwage:unlimited2⤵
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /maxpwage:unlimited3⤵PID:2028
-
-
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- UAC bypass
- Modifies registry key
PID:5740
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3368
-
-
C:\Windows\system32\sc.exesc config wuauserv start= disabled2⤵
- Launches sc.exe
PID:1748
-
-
C:\Windows\system32\powercfg.exepowercfg /d 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\system32\powercfg.exepowercfg -import C:\Users\Admin\AppData\Local\Temp\\plan.pow 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5848
-
-
C:\Windows\system32\powercfg.exepowercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} nx AlwaysOff2⤵
- Modifies boot configuration data using bcdedit
PID:1580
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects /v VisualFXSetting /t "REG_DWORD" /d "2" /f2⤵
- Modifies registry key
PID:2624
-
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem where name="OIKPOMQY" set AutomaticManagedPagefile=False2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5988
-
-
C:\Windows\System32\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=2048,MaximumSize=20482⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f2⤵PID:4176
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f2⤵PID:4172
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="allow RemoteDesktop" dir=in protocol=TCP localport=3389 action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2968
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0 /f2⤵PID:3952
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\Windows Error Reporting" /v disable /t REG_DWORD /d 1 /f2⤵PID:4232
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f2⤵PID:5788
-
-
C:\Windows\system32\mmc.exemmc devmgmt.msc2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2