Family: CrypVault

Ransomware family which makes encrypted files look like they have been quarantined by AV.

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

UAC bypass

Clears Windows event logs

Grants admin privileges

Uses net.exe to modify the user's privileges.

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Command and Scripting Interpreter: PowerShell

Run Powershell to get system information as a root user.

Modifies Windows Firewall