Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 16:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
lc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
lc.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
36 signatures
150 seconds
Behavioral task
behavioral3
Sample
lc.exe
Resource
win11-20260911-en
windows11-21h2-x64
33 signatures
150 seconds
Behavioral task
behavioral4
Sample
lc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
150 seconds
General
- Target lc.exe
- Size 12.7MB
- Sample261023-tf6efscv9v
- SHA256 8af1a173db1d008e34a4c92afba33dd0def7b58880ee63626dec64355ce72f68
- MD5 87c5ec05ae6b4aef59883c4ef42c0e66
- SHA1 5498f11db4de1bb86e56079fd78902284a85dbfa
- SHA512 b5abf63d2a4d634078393e6720c8163adee61b875dd97ab0336e61c4d9df9ad02fb2208962f3a6d055ba5c23ac918ec4201e8447573b940a89c446eadba30ee5
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR06:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1D8D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral4/memory/4060-1-0x0000000000090000-0x0000000000D4A000-memory.dmp disable_win_def - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" lc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealTimeScanDirection = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\IOAVMaxSize = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" lc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe - Modifies Windows Defender notification settings 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe - Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile def_none.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" def_none.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lc.exe - Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
pid Process 3732 bcdedit.exe 5800 bcdedit.exe 3192 bcdedit.exe 4932 bcdedit.exe 4356 bcdedit.exe 4736 bcdedit.exe 5240 bcdedit.exe 4076 bcdedit.exe 2368 bcdedit.exe 4912 bcdedit.exe 2796 bcdedit.exe 1996 bcdedit.exe 3228 bcdedit.exe - Renames multiple (95) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lc.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts lc.exe File created C:\Windows\System32\drivers\etc\hosts.n4an_backup lc.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comexp.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCopyAccelerator.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCopyAccelerator.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comexp.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" lc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc lc.exe - Executes dropped EXE 3 IoCs
pid Process 4472 023xwr2.exe 2676 def_none.exe 2608 def_none.exe - Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\WINDEFEND def_none.exe - Windows security modification 2 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration\DisablePrivacyMode = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = "0" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpBafsExtendedTimeout = "50" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = "0" def_none.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Windows\\system32\\winlogon_fix.exe\" -startup" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --init" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Windows\\system32\\winlogon_fix.exe\" /setup" lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --wininit" lc.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 1 api.ipify.org - Modifies Security services 2 TTPs 1 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4" def_none.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\system32\winlogon_fix.exe lc.exe File opened for modification C:\Windows\system32\winlogon_fix.exe lc.exe File opened for modification C:\Windows\system32\config\reagent_backup.dat lc.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml ReAgentc.exe File opened for modification C:\Windows\system32\Recovery ReAgentc.exe File created C:\Windows\system32\def_none.exe lc.exe File opened for modification C:\Windows\system32\def_none.exe lc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain def_none.exe - Kills process with taskkill 1 IoCs
pid Process 4016 taskkill.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "SgrmLpac.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "SecurityHealthService.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\PreventOverride = "0" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "smartscreen.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "MpCopyAccelerator.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "SgrmBroker.exe" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "MpDlpCmd.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "SecurityHealthHost.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\AmsiEnable = "0" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "MpCmdRun.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MsMpEng.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "NisSrv.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "MpDefenderCoreService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "MpDlpService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "ConfigSecurityPolicy.exe" def_none.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ def_none.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe 4060 lc.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeDebugPrivilege 4060 lc.exe Token: SeDebugPrivilege 4472 023xwr2.exe Token: SeImpersonatePrivilege 4472 023xwr2.exe Token: SeDebugPrivilege 4016 taskkill.exe Token: SeSystemEnvironmentPrivilege 5064 svchost.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: SeTakeOwnershipPrivilege 2608 def_none.exe Token: SeRestorePrivilege 2608 def_none.exe Token: SeBackupPrivilege 2608 def_none.exe Token: 33 1604 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1604 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4060 lc.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4060 wrote to memory of 4472 4060 lc.exe 88 PID 4060 wrote to memory of 4016 4060 lc.exe 90 PID 4060 wrote to memory of 1732 4060 lc.exe 92 PID 4060 wrote to memory of 3732 4060 lc.exe 93 PID 4060 wrote to memory of 5800 4060 lc.exe 96 PID 4060 wrote to memory of 3192 4060 lc.exe 97 PID 4060 wrote to memory of 3228 4060 lc.exe 99 PID 4060 wrote to memory of 1996 4060 lc.exe 101 PID 4060 wrote to memory of 2796 4060 lc.exe 102 PID 4060 wrote to memory of 4932 4060 lc.exe 104 PID 4060 wrote to memory of 4912 4060 lc.exe 105 PID 4060 wrote to memory of 2368 4060 lc.exe 107 PID 4060 wrote to memory of 4076 4060 lc.exe 109 PID 4060 wrote to memory of 5240 4060 lc.exe 110 PID 4060 wrote to memory of 4356 4060 lc.exe 112 PID 4060 wrote to memory of 4736 4060 lc.exe 114 PID 4060 wrote to memory of 2676 4060 lc.exe 122 PID 2608 wrote to memory of 4128 2608 def_none.exe 127 PID 2608 wrote to memory of 2720 2608 def_none.exe 129 PID 2608 wrote to memory of 3352 2608 def_none.exe 131 PID 2608 wrote to memory of 3256 2608 def_none.exe 133 PID 2608 wrote to memory of 2132 2608 def_none.exe 135 - System policy modification 1 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRestart = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoMsConfig = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShutDown = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoChangePassword = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" lc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoClose = "1" lc.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\lc.exe"C:\Users\Admin\AppData\Local\Temp\lc.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\023xwr2.exe"C:\Users\Admin\AppData\Local\Temp\023xwr2.exe" -kill -paralyze "SecurityHealthService.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /im Explorer.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1732
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:3732
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:5800
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false2⤵
- Modifies boot configuration data using bcdedit
PID:3192
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false2⤵
- Modifies boot configuration data using bcdedit
PID:3228
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
PID:1996
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy2⤵
- Modifies boot configuration data using bcdedit
PID:2796
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}2⤵
- Modifies boot configuration data using bcdedit
PID:4932
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 02⤵
- Modifies boot configuration data using bcdedit
PID:4912
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no2⤵
- Modifies boot configuration data using bcdedit
PID:2368
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:4076
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:5240
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} safeboot No2⤵
- Modifies boot configuration data using bcdedit
PID:4356
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions2⤵
- Modifies boot configuration data using bcdedit
PID:4736
-
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe"2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe" -s -worker -tilog1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Windows security modification
- Modifies Security services
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE2⤵PID:4128
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE2⤵PID:2720
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE2⤵PID:3352
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE2⤵PID:3256
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE2⤵PID:2132
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
9Disable or Modify System Firewall
1Disable or Modify Tools
6Safe Mode Boot
1Modify Registry
12Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\defender-control\last-run.log
- Size 1KB
- SHA256 d39fd2cd795c727d58b440aefe556905839ee694bd42eb40d4184bbc48f02b4a
- MD5 f9582891750c0f65d732cb300d760392
- SHA1 caf7a491356c8d728dfc7074df992582df13126d
- SHA512 87f5f5c5c162bfe0058d7f0469f19de3f9c1a4a72126a602ab93d94a0716005015726c2ceddd8641877d71e0f450816aefa606c0f98a97a1233227ce6201e8bf
- TLSH T160412C2059BAD2D161B36482B39E2A921F17D1576F3B2026B3D1122EFCE311E117DFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\023xwr2.exe
- Size 352KB
- SHA256 e23cfbd6b2c598758a2b5b20359c8d5b5cf2212f57ee0a95f5aac55bd7cf9f2e
- MD5 28951cb8572003e3b55c81e3c083684e
- SHA1 13767769dd14a3d0e0e676ed6afc670b4e20c1da
- SHA512 db16ca609a39ff27be2bed0f60ca60203fd7c67e2ed2ba8954a0d30e26c0b43ecf9fff18bcc2c644938ba9ba087158a53f5d27736f23d7c68210516c7e08b9ec
- SSDEEP 6144:9FjaS5rOS0ZAAeyB6JaZcmJg2R027gqqjA:3j/7AewGaJJg2RY
- TLSH T1FE749E18E3A611F9E5B7C57CCD934506EB727C524B71DAEF03A0899A2F236908E3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
- Size 285KB
- SHA256 3b6bf14a07555e31366473efe5f5b55a706deaf16db7aa8bbad487193965d129
- MD5 024f8028630f48beeabcdf8d1e4f97ce
- SHA1 91ef1dcf52305d4d0ff5553e1b804730a6557e04
- SHA512 48e7da7e965655b0ee0a2bf11a9ddb8a474b1b224ad450ad78e6887ada0e12f2c9a022b2ba57b41da0b1d1f2c9af906740df82702846f81e08da1b2d49000189
- SSDEEP 6144:eXghfyl2LEYYfOC2yQaru8nTypbKPnqU3v56hIk1+VfsDKi3GmnVEBR:Sghql2wNh2C68uY7/50Ik4e9SR
- TLSH T1345413634D2A00B2B83E0760FEEB7E887AE4AE9E555D23EF01D43DDD7B414974A46234
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\BlockRevoke.wma
- Size 398KB
- SHA256 4bdb3f715201da1330806570656ce436389785e7db581ea49ec08ceb905a86d3
- MD5 0ce5cc6d0c81c2193296acc3dec67270
- SHA1 e73e9d0f36a9b476a6c67b2333cf78536d1b68e4
- SHA512 f287334e805eeaa18a8b76c4baaf2c4311737ec8df8716895db351aef3176ccc0ee93113bd8dfb70845a3595bece756991e4c301c112273a6f6fc95e11f04fb6
- SSDEEP 12288:xkWktWlbf4ffmIkrF1mI3v2VmswPYHvXwuVkzjD:xkWktk74ffZMmg2AAz+
- TLSH T1AA9423D0405ADB62BE279FBB290C0ABC0C97901F9C681A8027B477C55CE96D98E5D9BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\CompareWait.potm
- Size 489KB
- SHA256 8207c67987b36ca388c5b43f3a9d2e6b58ce9ab1bbcf316a4fd8bee8ef20ade4
- MD5 031d28b6a975a5bd4140a0db6144b567
- SHA1 30c31ba2cec4c9c96535cab58448d34019e75b73
- SHA512 ebe700838633fd7b44d7077ab403c319700d3124ddb43cf1a4ea085a73986182157132537728ed97c06f17347d361d4b8e350dd2a2af10dd005be2e59241b95e
- SSDEEP 12288:4BSFfDsJr/h4rGWzKBmcI11iztfIl9CkGs+mU:75Du/OiEKw114twDXU
- TLSH T1A3B423671304DD8A2EF46A5FCBFACE9D573C10DF050DAE6A71B659002B58B90386EC4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\readme.txt
- Size 1KB
- SHA256 dc0f4e841f83fac37765278665a4a18caa9c414cd486a3562fbceeb532658965
- MD5 a28940fd6206f5b8990a7b774ff9695c
- SHA1 7a3d8493f71529f99a59df5d4ed1441de7016afa
- SHA512 ef96a6d9a05f2d74f8642224e0fc62e8b82ef72b2a563d7afce157449d1e4ea2c7f621bd2accad5ebd3d3a8c5a7ad7c2bf8b1e0a2da9412761c75e13ad12b647
- TLSH T13511787E119271D67408E84FDC64F50924E771BFABAB13C314D968193EE027CA738219
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\def_none.exe
- Size 280KB
- SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
- MD5 0497ba3a1c59ea1962f614e9acc8d57f
- SHA1 1e418cedaddfb827e4d04423aa64aefa0967f0e8
- SHA512 b09364147122589435e0c2e780f49aa16ab1991682ecb6270ca5b052fb4ebbff45cc1761b8a509080c1136c0d2b0eb014cb7ecf5df8de268b56665f9fd62a275
- SSDEEP 6144:lWRbN0Tc76mRE84jtv5Ewsg8jKM74mLvezQjjOQ7:lWRbNkcHQBEPg0KMFGQjN7
- TLSH T165544B25A7E805F9F67BC67CCDA25901EE72BC064B60E9DF039049561E33AD09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\etc\hosts
- Size 24KB
- SHA256 5b687dc00f566d0df604fcff406170c5ba1fb94b6c799ac8a1b70662088f958b
- MD5 6110ceea6dbc7c06d526f029c27d0293
- SHA1 2de422184fb7ac6717fd04387c4021d13d8085da
- SHA512 16d46a94e0cc36514b299749f1d66fc96025a669b1197cc8b6bb255d4da5310924cf24b513731bcf75ec31d9272851941b7846c8bae864ad0733028f708b6b5a
- SSDEEP 192:RrK9zBFfK0+TF1H/Q+sMt3mijYFCdSQiw3Lz/0kfd5b9rorz0n0eVtTCTJE/TJq/:RrK9y0SfNPhj33//f320n0eVtTCTJEV6
- TLSH T160B234664689C1FD56BAD055926EA36FE00FF2F308C3E9D90498C75E72701AD39C70AE
- MD5 SHA1 SHA512 SSDEEP TLSH