883a6b6a10c761f24c6815bc8b1e46baf5d97e9d29a31bc9e7dece4cd38804cd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DefenderRemover.exe
Size 45KB
Sample261029-p3dkqszw2j
SHA256 883a6b6a10c761f24c6815bc8b1e46baf5d97e9d29a31bc9e7dece4cd38804cd
MD5 c092a53b67d9f5943e40ea0c7fac903f
SHA1 827a421987322f2925abec6848572c10af26df74
SHA512 8bf05a39e6f04164cde3e2b25bebac6ad17b6ab4cbd7a8c107ce1b93d118e32368b78a5efc44db29d45521f98c94bee9d7828587945331649fc98a26fdeec21d
SSDEEP 768:7mGZMXd+HD0+cC1d6N8oie2bv/fFZD/OJJXbYC1VkCUS01P:7u+Hrv6N8Re+jWJ1bkCU7
TLSH
T16C23E47966888329CABE0A7918B1D94C37711AD249F3D645BDCC70EB8FB33048A517DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
4400	takeown.exe
5916	takeown.exe
5052	icacls.exe
4440	icacls.exe
468	takeown.exe
1776	takeown.exe
3040	icacls.exe
2236	takeown.exe
1760	takeown.exe
568	takeown.exe
4312	takeown.exe
4700	takeown.exe
3316	icacls.exe
5648	takeown.exe
4408	icacls.exe
4660	takeown.exe
5880	icacls.exe
1732	icacls.exe
1556	icacls.exe
5784	icacls.exe
5220	takeown.exe
3148	icacls.exe
1128	takeown.exe
1148	icacls.exe
3664	takeown.exe
2120	icacls.exe
4952	takeown.exe
3596	takeown.exe
4556	takeown.exe
5432	takeown.exe
5476	takeown.exe
4444	icacls.exe
768	takeown.exe
4656	icacls.exe
2980	icacls.exe
4232	takeown.exe
6084	takeown.exe
4440	takeown.exe
4340	takeown.exe
4944	takeown.exe
3156	icacls.exe
4480	icacls.exe
2396	takeown.exe
4724	takeown.exe
4648	icacls.exe
4528	icacls.exe
4488	icacls.exe
3944	takeown.exe
4772	icacls.exe
4384	icacls.exe
3452	takeown.exe
5908	icacls.exe
4276	takeown.exe
4132	icacls.exe
5792	icacls.exe
3204	icacls.exe
3952	takeown.exe
4864	takeown.exe
4544	icacls.exe
2540	takeown.exe
4516	icacls.exe
5992	takeown.exe
5100	takeown.exe
5808	icacls.exe

Executes dropped EXE 41 IoCs

pid	Process
908	PsExec64.exe
5988	PSEXESVC.exe
3932	PSEXESVC.exe
6092	PsExec64.exe
2116	PSEXESVC.exe
2192	PsExec64.exe
3384	PSEXESVC.exe
2904	PsExec64.exe
1900	PSEXESVC.exe
4280	PsExec64.exe
4300	PSEXESVC.exe
1504	PsExec64.exe
2416	PSEXESVC.exe
2128	PsExec64.exe
6088	PSEXESVC.exe
5608	PsExec64.exe
4972	PSEXESVC.exe
752	PsExec64.exe
3688	PSEXESVC.exe
3884	PsExec64.exe
5296	PSEXESVC.exe
2956	PsExec64.exe
4236	PSEXESVC.exe
4104	PsExec64.exe
3444	PSEXESVC.exe
5080	PsExec64.exe
4472	PSEXESVC.exe
1192	PsExec64.exe
3940	PSEXESVC.exe
4812	PsExec64.exe
3692	PSEXESVC.exe
1404	PsExec64.exe
2656	PSEXESVC.exe
5236	PsExec64.exe
2028	PSEXESVC.exe
2740	PsExec64.exe
3816	PSEXESVC.exe
5716	PsExec64.exe
1392	PSEXESVC.exe
2668	PsExec64.exe
1484	PSEXESVC.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5216	icacls.exe
4944	takeown.exe
6008	takeown.exe
4920	icacls.exe
5864	icacls.exe
4724	takeown.exe
4528	icacls.exe
2544	icacls.exe
3204	icacls.exe
1840	icacls.exe
4732	icacls.exe
4408	icacls.exe
4488	icacls.exe
3452	takeown.exe
1556	icacls.exe
4276	takeown.exe
6084	takeown.exe
1084	takeown.exe
2312	takeown.exe
6088	icacls.exe
4384	icacls.exe
4708	icacls.exe
2316	takeown.exe
4312	takeown.exe
4424	icacls.exe
4364	takeown.exe
5100	takeown.exe
4400	takeown.exe
4952	takeown.exe
3316	icacls.exe
5556	takeown.exe
3840	takeown.exe
1148	icacls.exe
3952	takeown.exe
4708	takeown.exe
3596	takeown.exe
4232	takeown.exe
3664	takeown.exe
3156	icacls.exe
5808	icacls.exe
4412	icacls.exe
1448	icacls.exe
4516	icacls.exe
4444	icacls.exe
4760	icacls.exe
4556	takeown.exe
568	takeown.exe
5972	takeown.exe
5308	icacls.exe
5220	takeown.exe
3148	icacls.exe
4124	icacls.exe
5916	takeown.exe
4340	takeown.exe
5432	takeown.exe
2084	takeown.exe
4480	icacls.exe
5604	takeown.exe
2604	icacls.exe
1252	takeown.exe
1576	icacls.exe
4440	takeown.exe
4276	icacls.exe
2508	takeown.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender	cmd.exe
File opened for modification	C:\Program Files\Windows Defender	cmd.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-F5F49CA4.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-7DC77249.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-34D86857.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-083F3FE1.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-25CCC46E.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-5ED2F577.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-4664D877.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-AB1B254E.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-BE5266D1.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-754692BF.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-89E30476.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-7E0C3BDD.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-8755A914.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-F29FAC15.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-D956AB51.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-FFAF52EE.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-FD614A3C.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-322EE139.key	PSEXESVC.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File created	C:\Windows\PSEXESVC.exe	PsExec64.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-4FE57873.key	PSEXESVC.exe
File opened for modification	C:\Windows\PSEXEC-JGATYMDT-DE9493A2.key	PSEXESVC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2784	cmd.exe
432	cmd.exe
2556	cmd.exe
3408	cmd.exe
4564	cmd.exe
4696	cmd.exe
1892	cmd.exe
3652	cmd.exe
1604	cmd.exe
108	cmd.exe
2172	cmd.exe
1960	cmd.exe
3344	cmd.exe
5348	cmd.exe
5996	cmd.exe
6032	cmd.exe
252	cmd.exe
1396	cmd.exe
4828	cmd.exe
5912	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 42 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DefenderRemover.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DefenderRemover.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PsExec64.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2736	DefenderRemover.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	DefenderRemover.exe
Token: SeIncreaseQuotaPrivilege	2736	DefenderRemover.exe
Token: SeSecurityPrivilege	2736	DefenderRemover.exe
Token: SeTakeOwnershipPrivilege	2736	DefenderRemover.exe
Token: SeLoadDriverPrivilege	2736	DefenderRemover.exe
Token: SeSystemProfilePrivilege	2736	DefenderRemover.exe
Token: SeSystemtimePrivilege	2736	DefenderRemover.exe
Token: SeProfSingleProcessPrivilege	2736	DefenderRemover.exe
Token: SeIncBasePriorityPrivilege	2736	DefenderRemover.exe
Token: SeCreatePagefilePrivilege	2736	DefenderRemover.exe
Token: SeBackupPrivilege	2736	DefenderRemover.exe
Token: SeRestorePrivilege	2736	DefenderRemover.exe
Token: SeShutdownPrivilege	2736	DefenderRemover.exe
Token: SeDebugPrivilege	2736	DefenderRemover.exe
Token: SeSystemEnvironmentPrivilege	2736	DefenderRemover.exe
Token: SeRemoteShutdownPrivilege	2736	DefenderRemover.exe
Token: SeUndockPrivilege	2736	DefenderRemover.exe
Token: SeManageVolumePrivilege	2736	DefenderRemover.exe
Token: 33	2736	DefenderRemover.exe
Token: 34	2736	DefenderRemover.exe
Token: 35	2736	DefenderRemover.exe
Token: 36	2736	DefenderRemover.exe
Token: SeTcbPrivilege	5988	PSEXESVC.exe
Token: SeTakeOwnershipPrivilege	788	takeown.exe
Token: SeTakeOwnershipPrivilege	1280	takeown.exe
Token: SeTakeOwnershipPrivilege	5648	takeown.exe
Token: SeTcbPrivilege	2116	PSEXESVC.exe
Token: SeTcbPrivilege	3384	PSEXESVC.exe
Token: SeTcbPrivilege	1900	PSEXESVC.exe
Token: SeTcbPrivilege	4300	PSEXESVC.exe
Token: SeTcbPrivilege	2416	PSEXESVC.exe
Token: SeTcbPrivilege	6088	PSEXESVC.exe
Token: SeTcbPrivilege	4972	PSEXESVC.exe
Token: SeTcbPrivilege	3688	PSEXESVC.exe
Token: SeTcbPrivilege	5296	PSEXESVC.exe
Token: SeTcbPrivilege	4236	PSEXESVC.exe
Token: SeTcbPrivilege	3444	PSEXESVC.exe
Token: SeTcbPrivilege	4472	PSEXESVC.exe
Token: SeTcbPrivilege	3940	PSEXESVC.exe
Token: SeTcbPrivilege	3692	PSEXESVC.exe
Token: SeTcbPrivilege	2656	PSEXESVC.exe
Token: SeTcbPrivilege	2028	PSEXESVC.exe
Token: SeTcbPrivilege	3816	PSEXESVC.exe
Token: SeTcbPrivilege	1392	PSEXESVC.exe
Token: SeTcbPrivilege	1484	PSEXESVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 908	2736	DefenderRemover.exe	89
PID 5988 wrote to memory of 5348	5988	PSEXESVC.exe	92
PID 5348 wrote to memory of 788	5348	cmd.exe	95
PID 5348 wrote to memory of 5696	5348	cmd.exe	97
PID 5348 wrote to memory of 1280	5348	cmd.exe	98
PID 5348 wrote to memory of 3316	5348	cmd.exe	99
PID 5348 wrote to memory of 5648	5348	cmd.exe	100
PID 5348 wrote to memory of 1576	5348	cmd.exe	101
PID 2736 wrote to memory of 6092	2736	DefenderRemover.exe	102
PID 2116 wrote to memory of 4828	2116	PSEXESVC.exe	105
PID 4828 wrote to memory of 1056	4828	cmd.exe	107
PID 4828 wrote to memory of 6088	4828	cmd.exe	108
PID 4828 wrote to memory of 768	4828	cmd.exe	109
PID 4828 wrote to memory of 5216	4828	cmd.exe	110
PID 2736 wrote to memory of 2192	2736	DefenderRemover.exe	112
PID 3384 wrote to memory of 4696	3384	PSEXESVC.exe	115
PID 4696 wrote to memory of 4440	4696	cmd.exe	117
PID 4696 wrote to memory of 4732	4696	cmd.exe	118
PID 4696 wrote to memory of 4556	4696	cmd.exe	119
PID 4696 wrote to memory of 4772	4696	cmd.exe	120
PID 4696 wrote to memory of 2620	4696	cmd.exe	121
PID 4696 wrote to memory of 4528	4696	cmd.exe	122
PID 2736 wrote to memory of 2904	2736	DefenderRemover.exe	123
PID 1900 wrote to memory of 5996	1900	PSEXESVC.exe	126
PID 5996 wrote to memory of 4340	5996	cmd.exe	128
PID 5996 wrote to memory of 2544	5996	cmd.exe	129
PID 5996 wrote to memory of 1128	5996	cmd.exe	130
PID 5996 wrote to memory of 1448	5996	cmd.exe	131
PID 5996 wrote to memory of 5432	5996	cmd.exe	132
PID 5996 wrote to memory of 4648	5996	cmd.exe	133
PID 2736 wrote to memory of 4280	2736	DefenderRemover.exe	134
PID 4300 wrote to memory of 2784	4300	PSEXESVC.exe	137
PID 2784 wrote to memory of 1084	2784	cmd.exe	139
PID 2784 wrote to memory of 1356	2784	cmd.exe	140
PID 2784 wrote to memory of 5556	2784	cmd.exe	141
PID 2784 wrote to memory of 5864	2784	cmd.exe	142
PID 2784 wrote to memory of 3596	2784	cmd.exe	143
PID 2784 wrote to memory of 4488	2784	cmd.exe	144
PID 2736 wrote to memory of 1504	2736	DefenderRemover.exe	145
PID 2416 wrote to memory of 1892	2416	PSEXESVC.exe	148
PID 1892 wrote to memory of 5476	1892	cmd.exe	150
PID 1892 wrote to memory of 4276	1892	cmd.exe	151
PID 1892 wrote to memory of 3840	1892	cmd.exe	152
PID 1892 wrote to memory of 1732	1892	cmd.exe	153
PID 1892 wrote to memory of 5972	1892	cmd.exe	154
PID 1892 wrote to memory of 4384	1892	cmd.exe	155
PID 2736 wrote to memory of 2128	2736	DefenderRemover.exe	156
PID 6088 wrote to memory of 3652	6088	PSEXESVC.exe	159
PID 3652 wrote to memory of 5992	3652	cmd.exe	161
PID 3652 wrote to memory of 4132	3652	cmd.exe	162
PID 3652 wrote to memory of 3452	3652	cmd.exe	163
PID 3652 wrote to memory of 2980	3652	cmd.exe	164
PID 3652 wrote to memory of 2312	3652	cmd.exe	165
PID 3652 wrote to memory of 5308	3652	cmd.exe	166
PID 2736 wrote to memory of 5608	2736	DefenderRemover.exe	167
PID 4972 wrote to memory of 1604	4972	PSEXESVC.exe	170
PID 1604 wrote to memory of 1380	1604	cmd.exe	172
PID 1604 wrote to memory of 4876	1604	cmd.exe	173
PID 1604 wrote to memory of 2396	1604	cmd.exe	174
PID 1604 wrote to memory of 4440	1604	cmd.exe	175
PID 1604 wrote to memory of 468	1604	cmd.exe	176
PID 1604 wrote to memory of 4516	1604	cmd.exe	177
PID 2736 wrote to memory of 752	2736	DefenderRemover.exe	178
PID 3688 wrote to memory of 432	3688	PSEXESVC.exe	181

C:\Users\Admin\AppData\Local\Temp\DefenderRemover.exe
"C:\Users\Admin\AppData\Local\Temp\DefenderRemover.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:908
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:6092
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2128
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:5608
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:752
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:1192
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:1404
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:5716
- C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe
  "C:\Users\Admin\AppData\Local\Temp\PSTools\PsExec64.exe" -accepteula -i -s cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2668

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Drops file in Program Files directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:5696
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3316
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:1576

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    PID:1056
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:6088
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:768
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:5216

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4440
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4732
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4556
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4772
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    PID:2620
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4528

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4340
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:2544
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:1128
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:1448
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5432
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4648

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:1084
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:1356
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:5556
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:5864
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3596
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4488

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:5476
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4276
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:3840
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:1732
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Modifies file permissions
    PID:5972
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4384

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:5992
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4132
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3452
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:2980
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Modifies file permissions
    PID:2312
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:5308

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    PID:1380
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:4876
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:2396
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4440
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:468
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4516

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:432
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4944
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1556
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:4700
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4708
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4724
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    PID:3444

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5296
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:6032
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:2236
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5792
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:4364
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5784
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Modifies file permissions
    PID:2508
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4408

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4236
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2556
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:5604
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4444
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4232
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3204
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5100
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:1840

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3444
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:252
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:2084
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:2604
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5220
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:3040
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Modifies file permissions
    PID:2316
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5908

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4472
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:108
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    PID:1404
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1148
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3664
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:4412
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    PID:3528
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4760

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3940
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2172
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:568
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4124
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    PID:5236
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3156
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    PID:4600
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    PID:5772

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3692
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1396
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:4660
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:3332
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3952
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:896
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Modifies file permissions
    PID:4708
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:2120

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2656
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:6008
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4480
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:3944
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4408
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4312
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3148

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2028
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:3408
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4400
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5808
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:1776
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    PID:1204
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6084
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    PID:4544

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3816
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4564
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4276
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4920
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:1760
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4656
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4952
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    PID:4712

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1392
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1960
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    PID:780
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5880
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Modifies file permissions
    PID:1252
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4424
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:4864
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    - Modifies file permissions
    PID:4412

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1484
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\defender_remove.bat"
  2⤵
  - Executes a command shell one-liner
  PID:3344
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files (x86)\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5916
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files (x86)\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:4544
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    PID:5356
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender" /grant SYSTEM:F /t
    3⤵
    - Possible privilege escalation attempt
    PID:5052
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y
    3⤵
    - Possible privilege escalation attempt
    PID:2540
- - C:\Windows\System32\icacls.exe
    icacls "C:\Program Files\Windows Defender Advanced Threat Protection" /grant SYSTEM:F /t
    3⤵
    PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact