sheetrat | 43ac530c20f3d297d4a0d4b6607f3ce1318c8a0029f843be39a6db55e6e3c9c6

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	ExclusionLauncherInstaller.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

UAC bypass 3 TTPs 8 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExclusionLauncherInstaller.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2696	bcdedit.exe
4944	bcdedit.exe

Drops file in Drivers directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	M1004NUS.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4648	netsh.exe
4708	netsh.exe

Possible privilege escalation attempt 22 IoCs

exploit

pid	Process
1432	icacls.exe
2152	takeown.exe
4296	icacls.exe
1632	icacls.exe
1984	icacls.exe
5100	icacls.exe
4960	icacls.exe
720	icacls.exe
5660	takeown.exe
4112	icacls.exe
1484	takeown.exe
3300	icacls.exe
4812	icacls.exe
3240	takeown.exe
1284	icacls.exe
4708	icacls.exe
5116	takeown.exe
2828	takeown.exe
5484	icacls.exe
596	icacls.exe
808	icacls.exe
1264	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
2140	Process not Found
5924	M1004NUS.exe
3520	M1004NUS.exe
1588	CompPkgSrv.exe

Loads dropped DLL 1 IoCs

pid	Process
2140	Process not Found

Modifies file permissions 1 TTPs 22 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
720	icacls.exe
2152	takeown.exe
5484	icacls.exe
1632	icacls.exe
5660	takeown.exe
4112	icacls.exe
1484	takeown.exe
1984	icacls.exe
4960	icacls.exe
596	icacls.exe
4708	icacls.exe
5116	takeown.exe
4812	icacls.exe
1432	icacls.exe
4296	icacls.exe
3300	icacls.exe
1264	icacls.exe
3240	takeown.exe
2828	takeown.exe
1284	icacls.exe
808	icacls.exe
5100	icacls.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	ExclusionLauncherInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExclusionLauncherInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ExclusionLauncherInstaller.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	ExclusionLauncherInstaller.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	ExclusionLauncherInstaller.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	ExclusionLauncherInstaller.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	ExclusionLauncherInstaller.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
704	sc.exe
1476	sc.exe
2804	sc.exe
4520	sc.exe
4584	sc.exe
4044	sc.exe
4416	sc.exe
52	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

persistence privilege_escalation

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	M1004NUS.exe
File opened (read-only)	\??\PHYSICALDRIVE0	ExclusionLauncherInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2788	CMD.exe
3328	cmd.exe
996	CMD.exe
3136	CMD.exe
3720	CMD.exe
2744	cmd.exe
6080	cmd.exe
1524	cmd.exe
6116	cmd.exe
824	cmd.exe
5112	cmd.exe
4548	CMD.exe
928	CMD.exe
3728	cmd.exe
2568	cmd.exe
3176	CMD.exe
948	cmd.exe
2372	cmd.exe
3164	cmd.exe
4716	cmd.exe
2264	CMD.exe
2972	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ExclusionLauncherInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ExclusionLauncherInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ExclusionLauncherInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CompPkgSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CompPkgSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ExclusionLauncherInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe

Kills process with taskkill 1 IoCs

pid	Process
4972	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	ExclusionLauncherInstaller.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ExclusionLauncherInstaller.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	Process not Found

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5636	schtasks.exe
3276	schtasks.exe
2512	schtasks.exe
2152	schtasks.exe
808	schtasks.exe
3880	schtasks.exe
5744	schtasks.exe
5864	schtasks.exe
1632	schtasks.exe
1864	schtasks.exe
2028	schtasks.exe
6112	schtasks.exe
4344	schtasks.exe
2740	schtasks.exe
5632	schtasks.exe
3312	schtasks.exe
2584	schtasks.exe
4136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
5868	ExclusionLauncherInstaller.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe
3520	M1004NUS.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5868	ExclusionLauncherInstaller.exe
Token: SeDebugPrivilege	2328	ExclusionLauncherInstaller.exe
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeDebugPrivilege	5868	ExclusionLauncherInstaller.exe
Token: SeTakeOwnershipPrivilege	5868	ExclusionLauncherInstaller.exe
Token: SeRestorePrivilege	5868	ExclusionLauncherInstaller.exe
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeDebugPrivilege	5924	M1004NUS.exe
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeDebugPrivilege	3520	M1004NUS.exe
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeDebugPrivilege	3520	M1004NUS.exe
Token: SeTakeOwnershipPrivilege	3520	M1004NUS.exe
Token: SeRestorePrivilege	3520	M1004NUS.exe
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeDebugPrivilege	1588	CompPkgSrv.exe
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found
Token: SeCreatePagefilePrivilege	2140	Process not Found
Token: SeShutdownPrivilege	2140	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2140	Process not Found
2140	Process not Found

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found
2140	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 6080	5868	ExclusionLauncherInstaller.exe	90
PID 6080 wrote to memory of 4708	6080	cmd.exe	92
PID 5868 wrote to memory of 5040	5868	ExclusionLauncherInstaller.exe	93
PID 5868 wrote to memory of 52	5868	ExclusionLauncherInstaller.exe	95
PID 5868 wrote to memory of 704	5868	ExclusionLauncherInstaller.exe	97
PID 5868 wrote to memory of 1476	5868	ExclusionLauncherInstaller.exe	99
PID 5868 wrote to memory of 1940	5868	ExclusionLauncherInstaller.exe	102
PID 5868 wrote to memory of 2068	5868	ExclusionLauncherInstaller.exe	104
PID 5868 wrote to memory of 4296	5868	ExclusionLauncherInstaller.exe	107
PID 5868 wrote to memory of 2136	5868	ExclusionLauncherInstaller.exe	109
PID 5868 wrote to memory of 808	5868	ExclusionLauncherInstaller.exe	112
PID 5868 wrote to memory of 2148	5868	ExclusionLauncherInstaller.exe	114
PID 5868 wrote to memory of 3728	5868	ExclusionLauncherInstaller.exe	117
PID 3728 wrote to memory of 2740	3728	cmd.exe	119
PID 5868 wrote to memory of 2804	5868	ExclusionLauncherInstaller.exe	120
PID 2140 wrote to memory of 2028	2140	Process not Found	182
PID 2140 wrote to memory of 2028	2140	Process not Found	182
PID 5868 wrote to memory of 1764	5868	ExclusionLauncherInstaller.exe	123
PID 5868 wrote to memory of 2044	5868	ExclusionLauncherInstaller.exe	124
PID 5868 wrote to memory of 2788	5868	ExclusionLauncherInstaller.exe	125
PID 5868 wrote to memory of 3164	5868	ExclusionLauncherInstaller.exe	126
PID 5868 wrote to memory of 2568	5868	ExclusionLauncherInstaller.exe	127
PID 5868 wrote to memory of 4716	5868	ExclusionLauncherInstaller.exe	131
PID 5868 wrote to memory of 1524	5868	ExclusionLauncherInstaller.exe	134
PID 5868 wrote to memory of 6116	5868	ExclusionLauncherInstaller.exe	136
PID 2788 wrote to memory of 1548	2788	CMD.exe	139
PID 3164 wrote to memory of 4136	3164	cmd.exe	140
PID 2568 wrote to memory of 5632	2568	cmd.exe	141
PID 5868 wrote to memory of 5864	5868	ExclusionLauncherInstaller.exe	142
PID 4716 wrote to memory of 3312	4716	cmd.exe	143
PID 6116 wrote to memory of 5636	6116	cmd.exe	145
PID 1524 wrote to memory of 3276	1524	cmd.exe	242
PID 2140 wrote to memory of 2612	2140	Process not Found
PID 2140 wrote to memory of 2612	2140	Process not Found
PID 5868 wrote to memory of 5924	5868	ExclusionLauncherInstaller.exe	148
PID 5868 wrote to memory of 4632	5868	ExclusionLauncherInstaller.exe	209
PID 3520 wrote to memory of 824	3520	M1004NUS.exe	152
PID 824 wrote to memory of 4648	824	cmd.exe	154
PID 3520 wrote to memory of 4972	3520	M1004NUS.exe	220
PID 3520 wrote to memory of 4520	3520	M1004NUS.exe	157
PID 3520 wrote to memory of 4584	3520	M1004NUS.exe	219
PID 3520 wrote to memory of 4044	3520	M1004NUS.exe	161
PID 3520 wrote to memory of 3716	3520	M1004NUS.exe	163
PID 3520 wrote to memory of 4416	3520	M1004NUS.exe	165
PID 3520 wrote to memory of 2264	3520	M1004NUS.exe	166
PID 3520 wrote to memory of 3880	3520	M1004NUS.exe	167
PID 3520 wrote to memory of 5112	3520	M1004NUS.exe	168
PID 3520 wrote to memory of 2372	3520	M1004NUS.exe	169
PID 3520 wrote to memory of 2744	3520	M1004NUS.exe	170
PID 3520 wrote to memory of 3328	3520	M1004NUS.exe	171
PID 2264 wrote to memory of 1128	2264	CMD.exe	179
PID 5112 wrote to memory of 1632	5112	cmd.exe	227
PID 3328 wrote to memory of 2512	3328	cmd.exe	181
PID 2372 wrote to memory of 2028	2372	cmd.exe	182
PID 2744 wrote to memory of 1864	2744	cmd.exe	183
PID 3520 wrote to memory of 4892	3520	M1004NUS.exe	184
PID 3520 wrote to memory of 5284	3520	M1004NUS.exe	186
PID 3520 wrote to memory of 1616	3520	M1004NUS.exe	188
PID 3520 wrote to memory of 5744	3520	M1004NUS.exe	189
PID 3520 wrote to memory of 1260	3520	M1004NUS.exe	192
PID 3520 wrote to memory of 6112	3520	M1004NUS.exe	194
PID 3520 wrote to memory of 4656	3520	M1004NUS.exe	196
PID 4656 wrote to memory of 5572	4656	net.exe	198
PID 3520 wrote to memory of 4620	3520	M1004NUS.exe	199

System policy modification 1 TTPs 12 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	ExclusionLauncherInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5868
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4708
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:5040
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:52
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:704
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1476
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  PID:1940
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:2068
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_da0cf9ae" /F
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:2136
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_da0cf9ae" /XML "C:\Users\Admin\AppData\Local\Temp\12838a58-37bf-4770-a0d8-a67dcbdd4db3.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:808
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:2148
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2740
- C:\Windows\SYSTEM32\sc.exe
  "sc" start TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:2804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:1764
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f1991eea" /F
  2⤵
  PID:2044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller"
    3⤵
    PID:1548
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "ExclusionLauncherInstaller" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "ExclusionLauncherInstaller" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3276
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5636
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f1991eea" /XML "C:\Users\Admin\AppData\Local\Temp\72bda87f-6861-48e7-9079-18dcc36e8fc0.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5864
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5924
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:4632

C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe
C:\Users\Admin\AppData\Local\Temp\ExclusionLauncherInstaller.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3520
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4648
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4972
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4520
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4584
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4044
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_95842baa" /F
  2⤵
  PID:3716
- C:\Windows\SYSTEM32\sc.exe
  "sc" start TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:4416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller"
    3⤵
    PID:1128
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_95842baa" /XML "C:\Users\Admin\AppData\Local\Temp\31bd50eb-4da2-4d65-bd41-9cea480f4fa3.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3880
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ExclusionLauncherInstaller_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ExclusionLauncherInstaller_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "ProgramDataUpdater_6a81f7e0" /F
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:5284
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:1616
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "ProgramDataUpdater_6a81f7e0" /XML "C:\Users\Admin\AppData\Local\Temp\6136590d-888f-4046-b357-3441ae297999.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5744
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_f8d87e8e" /F
  2⤵
  PID:1260
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_f8d87e8e" /XML "C:\Users\Admin\AppData\Local\Temp\eaccc812-f4a5-4dc4-85aa-64c39953e5b6.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6112
- C:\Windows\SYSTEM32\net.exe
  "net" stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:5572
- C:\Windows\SYSTEM32\net.exe
  "net" start WinDefend
  2⤵
  PID:4620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start WinDefend
    3⤵
    PID:1432
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "UsbCeip_0305aa8f" /F
  2⤵
  PID:2024
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:4272
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "UsbCeip_0305aa8f" /XML "C:\Users\Admin\AppData\Local\Temp\ef2f5e94-e163-4ed1-821b-eb847506d20b.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4344
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4632
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_95ebf28b" /F
  2⤵
  PID:6012
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_95ebf28b" /XML "C:\Users\Admin\AppData\Local\Temp\7a7cb40f-53d9-47e5-a1c8-e6cc40dc8751.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2152
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_785327d4" /F
  2⤵
  PID:4268
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2696
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:4584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4972
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set nointegritychecks on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4944
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_785327d4" /XML "C:\Users\Admin\AppData\Local\Temp\552a9c20-be33-46b1-a2fb-2f2dd8f1ef1b.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2584
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1632
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\null.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5660
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4708
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4112
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\beep.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1484
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1984
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3300
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3276
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4812
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1264
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3240
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1432
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5100
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2828
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4960
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:720
- C:\Windows\SYSTEM32\takeown.exe
  "takeown" /f "C:\Windows\system32\drivers\modem.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2152
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:984
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1284
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5484
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4296
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:596
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:6092
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:808
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:3876
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:3400
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:3844
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:4468
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:5764
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:1800
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:4300
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:5396
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:3624
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:4528
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:4680
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:4632
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:5904
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:2532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:1616
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:4868
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:2888
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:2056
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:1912
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:4664
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:5520
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  - Enumerates connected drives
  PID:3576
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:3884
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:5688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:4108
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:5516
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:3460
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:4008
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  - Enumerates connected drives
  PID:3768
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:2760
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:1464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:5676
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:3876
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:720
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:3240
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:4268
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:2496
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:1348
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:4464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:5712
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:5148
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:5568
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:1168
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:5904
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:3008
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:3952
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:3428
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:5956
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:3292
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:4884
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:4116
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:5312
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:4316
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:3584
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:616
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:2080
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:5368
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:3444
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  - Enumerates connected drives
  PID:5488
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:5756
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:1556
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:3460
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:5184
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:5648
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:3504
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:1632
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  - Enumerates connected drives
  PID:5116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller_OnLock" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_OnLock"
    3⤵
    PID:4352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller_OnUnlock" & exit
  2⤵
  - Executes a command shell one-liner
  PID:996
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_OnUnlock"
    3⤵
    PID:1956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller_OnIdle" & exit
  2⤵
  - Executes a command shell one-liner
  PID:928
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_OnIdle"
    3⤵
    PID:5932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller_Evt4624" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3136
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_Evt4624"
    3⤵
    PID:3248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3176
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "MicrosoftEdgeUpdate"
    3⤵
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ExclusionLauncherInstaller" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2972
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller"
    3⤵
    PID:3952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3720
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "MicrosoftEdgeUpdate"
    3⤵
    PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpE262.tmp.bat"
  2⤵
  - Executes a command shell one-liner
  PID:948
- - C:\Windows\system32\schtasks.exe
    schtasks /end /TN "ExclusionLauncherInstaller"
    3⤵
    PID:1396
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller"
    3⤵
    PID:5736
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_OnLock"
    3⤵
    PID:4520
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_OnUnlock"
    3⤵
    PID:3540
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_OnIdle"
    3⤵
    PID:5936
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ExclusionLauncherInstaller_Evt4624"
    3⤵
    PID:4992
- - C:\Windows\system32\schtasks.exe
    schtasks /end /TN "MicrosoftEdgeUpdate"
    3⤵
    PID:2700
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "MicrosoftEdgeUpdate"
    3⤵
    PID:5808
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "M1004NUS.exe"
    3⤵
    - Kills process with taskkill
    PID:4972

C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\CompPkgSrv.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\CompPkgSrv.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry