Analysis
- max time kernel
150s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/10/2026, 16:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
lc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
lc.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
36 signatures
150 seconds
Behavioral task
behavioral3
Sample
lc.exe
Resource
win11-20260911-en
windows11-21h2-x64
33 signatures
150 seconds
Behavioral task
behavioral4
Sample
lc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
150 seconds
General
- Target lc.exe
- Size 12.7MB
- Sample261023-tf6efscv9v
- SHA256 8af1a173db1d008e34a4c92afba33dd0def7b58880ee63626dec64355ce72f68
- MD5 87c5ec05ae6b4aef59883c4ef42c0e66
- SHA1 5498f11db4de1bb86e56079fd78902284a85dbfa
- SHA512 b5abf63d2a4d634078393e6720c8163adee61b875dd97ab0336e61c4d9df9ad02fb2208962f3a6d055ba5c23ac918ec4201e8447573b940a89c446eadba30ee5
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR06:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1D8D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral3/memory/5264-0-0x00000000000D0000-0x0000000000D8A000-memory.dmp disable_win_def behavioral3/files/0x001c00000002aeba-255.dat disable_win_def - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" lc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\IOAVMaxSize = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealTimeScanDirection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" lc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe - Modifies Windows Defender notification settings 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications def_none.exe - Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile\EnableFirewall = "0" def_none.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" def_none.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lc.exe - Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
pid Process 4300 bcdedit.exe 3236 bcdedit.exe 580 bcdedit.exe 124 bcdedit.exe 332 bcdedit.exe 132 bcdedit.exe 2748 bcdedit.exe 328 bcdedit.exe 3968 bcdedit.exe 3148 bcdedit.exe 5108 bcdedit.exe 5088 bcdedit.exe 556 bcdedit.exe - Renames multiple (81) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lc.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts lc.exe File created C:\Windows\System32\drivers\etc\hosts.n4an_backup lc.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmBroker.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmBroker.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comexp.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe lc.exe - Executes dropped EXE 2 IoCs
pid Process 6064 def_none.exe 1680 def_none.exe - Windows security modification 2 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration\DisablePrivacyMode = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel = "0" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpBafsExtendedTimeout = "50" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Windows\\system32\\winlogon_fix.exe\" -startup" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --init" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Windows\\system32\\winlogon_fix.exe\" /setup" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --wininit" lc.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org - Modifies Security services 2 TTPs 5 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4" def_none.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\system32\def_none.exe lc.exe File opened for modification C:\Windows\system32\def_none.exe lc.exe File created C:\Windows\system32\winlogon_fix.exe lc.exe File opened for modification C:\Windows\system32\winlogon_fix.exe lc.exe File opened for modification C:\Windows\system32\config\reagent_backup.dat lc.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml ReAgentc.exe File opened for modification C:\Windows\system32\Recovery ReAgentc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain def_none.exe - Kills process with taskkill 1 IoCs
pid Process 5128 taskkill.exe - Modifies data under HKEY_USERS 39 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender\Enabled = "0" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "MpCopyAccelerator.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "ConfigSecurityPolicy.exe" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "NisSrv.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "MpDlpCmd.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "smartscreen.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "SgrmBroker.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter\Enabled = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MsMpEng.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "MpDefenderCoreService.exe" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "SecurityHealthService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "SecurityHealthHost.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\AmsiEnable = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "MpDlpService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "MpCmdRun.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "SgrmLpac.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings def_none.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ def_none.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe 5264 lc.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5264 lc.exe Token: SeDebugPrivilege 5128 taskkill.exe Token: 33 5792 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5792 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5264 lc.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5264 wrote to memory of 5128 5264 lc.exe 84 PID 5264 wrote to memory of 1452 5264 lc.exe 86 PID 5264 wrote to memory of 556 5264 lc.exe 88 PID 5264 wrote to memory of 5088 5264 lc.exe 89 PID 5264 wrote to memory of 4300 5264 lc.exe 90 PID 5264 wrote to memory of 3236 5264 lc.exe 91 PID 5264 wrote to memory of 5108 5264 lc.exe 96 PID 5264 wrote to memory of 3148 5264 lc.exe 97 PID 5264 wrote to memory of 580 5264 lc.exe 98 PID 5264 wrote to memory of 3968 5264 lc.exe 102 PID 5264 wrote to memory of 124 5264 lc.exe 103 PID 5264 wrote to memory of 328 5264 lc.exe 104 PID 5264 wrote to memory of 2748 5264 lc.exe 105 PID 5264 wrote to memory of 332 5264 lc.exe 106 PID 5264 wrote to memory of 132 5264 lc.exe 107 PID 5264 wrote to memory of 6064 5264 lc.exe 115 PID 1680 wrote to memory of 5420 1680 def_none.exe 120 PID 1680 wrote to memory of 5716 1680 def_none.exe 122 PID 1680 wrote to memory of 492 1680 def_none.exe 124 PID 1680 wrote to memory of 5608 1680 def_none.exe 126 PID 1680 wrote to memory of 2524 1680 def_none.exe 128 - System policy modification 1 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoMsConfig = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRestart = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShutDown = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoClose = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoChangePassword = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" lc.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\lc.exe"C:\Users\Admin\AppData\Local\Temp\lc.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5264 -
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /im Explorer.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5128
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1452
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:556
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:5088
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false2⤵
- Modifies boot configuration data using bcdedit
PID:4300
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false2⤵
- Modifies boot configuration data using bcdedit
PID:3236
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
PID:5108
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy2⤵
- Modifies boot configuration data using bcdedit
PID:3148
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}2⤵
- Modifies boot configuration data using bcdedit
PID:580
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 02⤵
- Modifies boot configuration data using bcdedit
PID:3968
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no2⤵
- Modifies boot configuration data using bcdedit
PID:124
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:328
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:2748
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} safeboot No2⤵
- Modifies boot configuration data using bcdedit
PID:332
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions2⤵
- Modifies boot configuration data using bcdedit
PID:132
-
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe"2⤵
- Executes dropped EXE
PID:6064
-
-
C:\Windows\system32\def_none.exeC:\Windows\system32\def_none.exe -s -worker -tilog1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Modifies Security services
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE2⤵PID:5420
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE2⤵PID:5716
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE2⤵PID:492
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE2⤵PID:5608
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE2⤵PID:2524
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
PID:5792
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
8Disable or Modify System Firewall
1Disable or Modify Tools
6Modify Registry
12Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\defender-control\last-run.log
- Size 988B
- SHA256 5f3b6d6205ebcef25dd05a78dee938336229a623913f0210cd4e48a8dd0fb67b
- MD5 8efbe505158006202588ead1f9287fbf
- SHA1 f74226d5e628034fdc27af08e94d8ecb12ea5340
- SHA512 c2131b89246689d170c4b87f3ba25e0c970173116097f1531a2dc97b61e3b74f88855d60dedfbb8f9cac2998573bed5451c70f68fbf261de40e701cf2239c2fd
- TLSH T1A5115661202D96F852E704D3D4791AA32F9E502ACF35341B84A2123C6DF314D82FEA58
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
- Size 174KB
- SHA256 d301eb64ec3b61091a3e6ee997bf8d114f3e6c5eda46afd6a8d23ad78459ea82
- MD5 b3b323be74b228e9a547f37622af266b
- SHA1 35d656234e3de2f65c2a9c9b37f864eaa5e3104f
- SHA512 0a65b61cb4414921a1c2f69e69b3462b219c03c2a0b96a3b4f5e358be72c8f357423ace0f3c8cbe5b1b21e82e0c17cd1e98dfba923487dda8df0024ef454f191
- SSDEEP 3072:P/dxtnCBOYinwq34BHBcd/E63lUM629CeXqmUNkhpnaewa+ut6ZHgRxd49Sp:P1xtnr33Cr63lU329CeXKNkhpnaMFsgd
- TLSH T172045B1398049B82A17992E8FD170FAC1F592F0CE5D23AFF05235E8B3A617365D9E12D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\Outlook Files\readme.txt
- Size 1KB
- SHA256 dc0f4e841f83fac37765278665a4a18caa9c414cd486a3562fbceeb532658965
- MD5 a28940fd6206f5b8990a7b774ff9695c
- SHA1 7a3d8493f71529f99a59df5d4ed1441de7016afa
- SHA512 ef96a6d9a05f2d74f8642224e0fc62e8b82ef72b2a563d7afce157449d1e4ea2c7f621bd2accad5ebd3d3a8c5a7ad7c2bf8b1e0a2da9412761c75e13ad12b647
- TLSH T13511787E119271D67408E84FDC64F50924E771BFABAB13C314D968193EE027CA738219
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\ApproveSend.htm
- Size 223KB
- SHA256 1596e607328f0e9e061d658a2c96e919cd065b284ab876a6909f3b3b7045bf7e
- MD5 9d2f3cdf22a9f074972435b4c319c9aa
- SHA1 2b4d3ad2d7ed4419318a0f1f19c39e731442cb8d
- SHA512 5eed5eca7696a963bf23c3ba330ee706ebbd4c83d924c6b3c88205455db7889456a808353acc03f7b21c2c5af6dfdf33377a816e8c1b6b7ee4db2f66ce3d2310
- SSDEEP 6144:+1LTHF/uFo5Dw2mKYXTn3gbnsRAkUX4TdNi3ilKz:+FxmFO/mK6T3gL4Tfi3ilA
- TLSH T111241365FEFEA7610E254E2C011E8DDB3A1F7EE7C61A4397DAF2E231804D16851EB814
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ClearConvert.mp3
- Size 364KB
- SHA256 d88a41d322ad1192c72486d67985901f37fc8f42d1b7b68b0edf3655784da9fa
- MD5 470a103ecac6171ace9eeb539c38400c
- SHA1 a106d899f2c63ce6c14bf0b3f94698927525fc1f
- SHA512 c031f4dd83c7f8e9fd11549c913da3c8807a344133959afc54018c1791a5b88e0b3c8ea9e919c515a5bd27e5e611268acacbb773ca4c11105eaab6da1baf3d9b
- SSDEEP 6144:7rl3n8qnGwa2pU6Zq9C34lPHwF7pCRacL/SEfjFBloT74IdCLrSIHHPlB+LR:fpzGwawUBVlPHwBobL/SErDUMLrSNR
- TLSH T1388423D1C0326199447C5DAA9F25D6E31C83D9878228F7EA9B59B0FE765F8C3E03D406
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\def_none.exe
- Size 280KB
- SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
- MD5 0497ba3a1c59ea1962f614e9acc8d57f
- SHA1 1e418cedaddfb827e4d04423aa64aefa0967f0e8
- SHA512 b09364147122589435e0c2e780f49aa16ab1991682ecb6270ca5b052fb4ebbff45cc1761b8a509080c1136c0d2b0eb014cb7ecf5df8de268b56665f9fd62a275
- SSDEEP 6144:lWRbN0Tc76mRE84jtv5Ewsg8jKM74mLvezQjjOQ7:lWRbNkcHQBEPg0KMFGQjN7
- TLSH T165544B25A7E805F9F67BC67CCDA25901EE72BC064B60E9DF039049561E33AD09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\etc\hosts
- Size 24KB
- SHA256 e8d4d8e86f72394a76a72b432725498714399cf55328c475370b79afeac016fe
- MD5 8523a984dd8a88441617269367749fd5
- SHA1 add5fefe5ea3c26ca6322837bae909672500606a
- SHA512 3acce801d43c0476e823ae60422ce11399b8ff1fa4258aff502c0bae4a77bcaf78d8887cfe386bb75617a1251579b6424761405e586dfb2a7b18d86a279fea21
- SSDEEP 192:RrK9zBWfK0+TF1H/Q+sMt3mijYFCdSQiw3Lz/0kfd5b9rorz0n0eVtTCTJE/TJq/:RrK990SfNPhj33//f320n0eVtTCTJEV6
- TLSH T18EB234664689C1FD56BAD055926EA36FE00FF2F308C3E9D90498C75E72701AD39C70AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\winlogon_fix.exe
- Size 12.7MB
- SHA256 8af1a173db1d008e34a4c92afba33dd0def7b58880ee63626dec64355ce72f68
- MD5 87c5ec05ae6b4aef59883c4ef42c0e66
- SHA1 5498f11db4de1bb86e56079fd78902284a85dbfa
- SHA512 b5abf63d2a4d634078393e6720c8163adee61b875dd97ab0336e61c4d9df9ad02fb2208962f3a6d055ba5c23ac918ec4201e8447573b940a89c446eadba30ee5
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR06:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1D8D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH