sheetrat | cba434f3f18f7bc3d6ccfda9bb396794c1d7be6e9bd5a38afced5e22b5b0f114

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	Holy Checks.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BootExecutor.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4136	netsh.exe
5756	netsh.exe
6040	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\dllhost.exe	BootExecutor.exe

Executes dropped EXE 11 IoCs

pid	Process
1552	M1004NUS.exe
5520	M1004NUS.exe
2832	BootExecutor.exe
4652	ShellExperienceHost.exe
2616	TextInputHost.exe
2820	BackgroundTaskHost.exe
5276	OneDriveSetup.exe
1740	SgrmBroker.exe
5944	ShellExperienceHost.exe
5376	MicrosoftEdgeUpdate.exe
4760	MicrosoftEdgeCP.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	Holy Checks.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Holy Checks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	Holy Checks.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	Holy Checks.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	Holy Checks.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	Holy Checks.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4696	sc.exe
4924	sc.exe
4432	sc.exe
2188	sc.exe
1184	sc.exe
1292	sc.exe
5688	sc.exe
2920	sc.exe
4588	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 3 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

persistence privilege_escalation

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	M1004NUS.exe
File opened (read-only)	\??\PHYSICALDRIVE0	BootExecutor.exe
File opened (read-only)	\??\PHYSICALDRIVE0	Holy Checks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2244	cmd.exe
5416	cmd.exe
4356	cmd.exe
2568	cmd.exe
6080	cmd.exe
3192	cmd.exe
4264	cmd.exe
3588	CMD.exe
2400	cmd.exe
1336	cmd.exe
1156	cmd.exe
4364	cmd.exe
6068	cmd.exe
4488	cmd.exe
1452	cmd.exe
2884	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Holy Checks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Holy Checks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SgrmBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ShellExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ShellExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ShellExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Holy Checks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Holy Checks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ShellExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SgrmBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveSetup.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	Holy Checks.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Holy Checks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1692	schtasks.exe
4596	schtasks.exe
1124	schtasks.exe
2004	schtasks.exe
4760	schtasks.exe
4912	schtasks.exe
6020	schtasks.exe
2196	schtasks.exe
3028	schtasks.exe
2804	schtasks.exe
3332	schtasks.exe
1576	schtasks.exe
4712	schtasks.exe
5844	schtasks.exe
5416	schtasks.exe
5688	schtasks.exe
2608	schtasks.exe
2868	schtasks.exe
5480	schtasks.exe
5028	schtasks.exe
944	schtasks.exe
4100	schtasks.exe
5296	schtasks.exe
6024	schtasks.exe
1844	schtasks.exe
3592	schtasks.exe
2068	schtasks.exe
5304	schtasks.exe
5188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	BootExecutor.exe
2832	BootExecutor.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	Holy Checks.exe
Token: SeDebugPrivilege	6008	Holy Checks.exe
Token: SeDebugPrivilege	1552	M1004NUS.exe
Token: SeDebugPrivilege	5520	M1004NUS.exe
Token: SeDebugPrivilege	2832	BootExecutor.exe
Token: SeDebugPrivilege	2616	TextInputHost.exe
Token: SeDebugPrivilege	4652	ShellExperienceHost.exe
Token: SeDebugPrivilege	2820	BackgroundTaskHost.exe
Token: SeDebugPrivilege	5276	OneDriveSetup.exe
Token: SeDebugPrivilege	5376	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5944	ShellExperienceHost.exe
Token: SeDebugPrivilege	4760	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 6068	4160	Holy Checks.exe	90
PID 6068 wrote to memory of 4136	6068	cmd.exe	92
PID 4160 wrote to memory of 4300	4160	Holy Checks.exe	93
PID 4160 wrote to memory of 2920	4160	Holy Checks.exe	95
PID 4160 wrote to memory of 4924	4160	Holy Checks.exe	97
PID 4160 wrote to memory of 4432	4160	Holy Checks.exe	99
PID 4160 wrote to memory of 4152	4160	Holy Checks.exe	102
PID 4160 wrote to memory of 4852	4160	Holy Checks.exe	104
PID 4160 wrote to memory of 5116	4160	Holy Checks.exe	107
PID 4160 wrote to memory of 624	4160	Holy Checks.exe	109
PID 4160 wrote to memory of 3592	4160	Holy Checks.exe	110
PID 4160 wrote to memory of 1488	4160	Holy Checks.exe	113
PID 4160 wrote to memory of 4488	4160	Holy Checks.exe	117
PID 4488 wrote to memory of 1692	4488	cmd.exe	119
PID 4160 wrote to memory of 3848	4160	Holy Checks.exe	120
PID 4160 wrote to memory of 5028	4160	Holy Checks.exe	122
PID 4160 wrote to memory of 5824	4160	Holy Checks.exe	125
PID 4160 wrote to memory of 4376	4160	Holy Checks.exe	127
PID 4160 wrote to memory of 6044	4160	Holy Checks.exe	128
PID 4160 wrote to memory of 3588	4160	Holy Checks.exe	129
PID 4160 wrote to memory of 4264	4160	Holy Checks.exe	130
PID 4160 wrote to memory of 1452	4160	Holy Checks.exe	131
PID 4160 wrote to memory of 2568	4160	Holy Checks.exe	135
PID 4160 wrote to memory of 2244	4160	Holy Checks.exe	137
PID 4160 wrote to memory of 4356	4160	Holy Checks.exe	138
PID 4160 wrote to memory of 5844	4160	Holy Checks.exe	139
PID 4160 wrote to memory of 4596	4160	Holy Checks.exe	145
PID 4264 wrote to memory of 4760	4264	cmd.exe	147
PID 3588 wrote to memory of 4060	3588	CMD.exe	148
PID 2568 wrote to memory of 3332	2568	cmd.exe	149
PID 2244 wrote to memory of 5416	2244	cmd.exe	150
PID 1452 wrote to memory of 5296	1452	cmd.exe	151
PID 4356 wrote to memory of 944	4356	cmd.exe	152
PID 4160 wrote to memory of 4636	4160	Holy Checks.exe	154
PID 4160 wrote to memory of 1256	4160	Holy Checks.exe	156
PID 4160 wrote to memory of 6024	4160	Holy Checks.exe	158
PID 4160 wrote to memory of 2676	4160	Holy Checks.exe	160
PID 4160 wrote to memory of 1788	4160	Holy Checks.exe	162
PID 4160 wrote to memory of 2804	4160	Holy Checks.exe	164
PID 4160 wrote to memory of 5708	4160	Holy Checks.exe	166
PID 4160 wrote to memory of 5688	4160	Holy Checks.exe	168
PID 4160 wrote to memory of 5260	4160	Holy Checks.exe	170
PID 4160 wrote to memory of 5656	4160	Holy Checks.exe	171
PID 4160 wrote to memory of 1124	4160	Holy Checks.exe	174
PID 4160 wrote to memory of 2464	4160	Holy Checks.exe	176
PID 4160 wrote to memory of 4260	4160	Holy Checks.exe	178
PID 4160 wrote to memory of 5520	4160	Holy Checks.exe	181
PID 1552 wrote to memory of 6080	1552	M1004NUS.exe	183
PID 6080 wrote to memory of 5756	6080	cmd.exe	185
PID 1552 wrote to memory of 2948	1552	M1004NUS.exe	186
PID 1552 wrote to memory of 2188	1552	M1004NUS.exe	188
PID 1552 wrote to memory of 1184	1552	M1004NUS.exe	190
PID 1552 wrote to memory of 4588	1552	M1004NUS.exe	192
PID 1552 wrote to memory of 2600	1552	M1004NUS.exe	194
PID 1552 wrote to memory of 2644	1552	M1004NUS.exe	196
PID 1552 wrote to memory of 1664	1552	M1004NUS.exe	198
PID 1552 wrote to memory of 2608	1552	M1004NUS.exe	200
PID 1552 wrote to memory of 2884	1552	M1004NUS.exe	203
PID 1552 wrote to memory of 3192	1552	M1004NUS.exe	204
PID 1552 wrote to memory of 5416	1552	M1004NUS.exe	205
PID 1552 wrote to memory of 1336	1552	M1004NUS.exe	206
PID 1552 wrote to memory of 2400	1552	M1004NUS.exe	207
PID 2884 wrote to memory of 4440	2884	CMD.exe	213
PID 5416 wrote to memory of 4100	5416	cmd.exe	214

System policy modification 1 TTPs 18 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Holy Checks.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe
"C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4136
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2920
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4924
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  PID:4152
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:4852
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "User_Feed_Synchronization-05085680-40ec-4c7c-ba5a-c4058fe335da" /F
  2⤵
  PID:5116
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:624
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "User_Feed_Synchronization-05085680-40ec-4c7c-ba5a-c4058fe335da" /XML "C:\Users\Admin\AppData\Local\Temp\0bfe87c6-9c1c-447f-b614-4a333003407b.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3592
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_0f18bf42" /F
  2⤵
  PID:3848
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_0f18bf42" /XML "C:\Users\Admin\AppData\Local\Temp\9f4e8064-0653-47a1-8c91-8fc540218752.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5028
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:5824
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:4376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:6044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Checks" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Checks"
    3⤵
    PID:4060
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Checks" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Checks" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5416
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:944
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_12162738" /F
  2⤵
  PID:5844
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_12162738" /XML "C:\Users\Admin\AppData\Local\Temp\1102e5b9-393f-4ccc-93f1-cda61d473d89.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4596
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_b1137284" /F
  2⤵
  PID:4636
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:1256
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_b1137284" /XML "C:\Users\Admin\AppData\Local\Temp\7ae44e6d-8011-456d-af8e-10fe976aa6a8.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6024
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:2676
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_11b12041" /F
  2⤵
  PID:1788
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:2804
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_11b12041" /XML "C:\Users\Admin\AppData\Local\Temp\9df2891b-1425-4c5d-823b-2cba62f23b12.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:5260
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_8e58b523" /F
  2⤵
  PID:5656
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_8e58b523" /XML "C:\Users\Admin\AppData\Local\Temp\c78f3c5c-38b4-447a-93ff-f63c3838c2bd.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1124
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:2464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:4260
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5520

C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe
"C:\Users\Admin\AppData\Local\Temp\Holy Checks.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5756
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:2948
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2188
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1184
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4588
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:2600
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:2644
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_91565053" /F
  2⤵
  PID:1664
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_91565053" /XML "C:\Users\Admin\AppData\Local\Temp\d56eea68-cfd3-4876-93ff-fc5f0e132bc5.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Checks" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Checks"
    3⤵
    PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Checks_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Checks_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:3568
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:1540
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:2820
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_35baf948" /F
  2⤵
  PID:4368
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:5664
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_35baf948" /XML "C:\Users\Admin\AppData\Local\Temp\20b596ff-bea9-4343-b859-230ffc786f60.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4912
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:2672
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:2164
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:3004
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_8ca0d09a" /F
  2⤵
  PID:5204
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_8ca0d09a" /XML "C:\Users\Admin\AppData\Local\Temp\185900b1-6a3e-4003-bcfb-0c8001cb3a85.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4712
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:260
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:1232
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  PID:4732
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:1540
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_185bfeb9" /F
  2⤵
  PID:4092
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_185bfeb9" /XML "C:\Users\Admin\AppData\Local\Temp\b8d2a229-9d73-4bc9-9fc1-2f5162b56266.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6020
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:4136
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:1228
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_10b487b0" /F
  2⤵
  PID:2124
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_10b487b0" /XML "C:\Users\Admin\AppData\Local\Temp\da3abb75-2d18-4131-ac8e-c957857e4a15.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1844
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:1996
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:960
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:5948
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:5844
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_48d2d7a3" /F
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:4228
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_48d2d7a3" /XML "C:\Users\Admin\AppData\Local\Temp\89c237b1-21aa-462d-ba08-a9366f7ee675.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2804
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:2520
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:4716
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:5276
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:5312
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:5856
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:3096
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:2648
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:752
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:3312
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:468
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  - Enumerates connected drives
  PID:3452
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:3568
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:2704
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:3836
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:1512
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:4336
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:5544
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  - Enumerates connected drives
  PID:4716
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:756
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:1844
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:252
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:4704
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:1260
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:1688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:828
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:5480
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:3172
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:2272
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:3068
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:2576
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:4048
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:1836
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:4056
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  PID:2868
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:996
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:3360
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:3532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:1600
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:2064
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:4848
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:4520
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:3536
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:2960

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2832
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  PID:1156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6040
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:2520
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1292
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4696
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:6108
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:1980
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_ebf99d2b" /F
  2⤵
  PID:3096
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_ebf99d2b" /XML "C:\Users\Admin\AppData\Local\Temp\c743a182-b136-4b36-b80c-69c945a24536.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1576
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:5108
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:5804
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_834330d9" /F
  2⤵
  PID:5744
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_834330d9" /XML "C:\Users\Admin\AppData\Local\Temp\aa204e64-bff9-49b0-b923-296bfa6b125e.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5188
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:1380
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:4320
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:5868
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:2528
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_0ada2a91" /F
  2⤵
  PID:3540
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_0ada2a91" /XML "C:\Users\Admin\AppData\Local\Temp\feb732f3-5831-42f7-8c62-dd307400f373.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2196
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:3592
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:4116
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b83911ec" /F
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b83911ec" /XML "C:\Users\Admin\AppData\Local\Temp\f6292c9c-23ac-41ee-bb5b-cce02d55f691.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3028
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:4800
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:3136
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:3396
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:4760
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  PID:1352
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Checks" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Checks" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2004
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:1488
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:4280
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "UsbCeip_09746527" /F
  2⤵
  PID:2808
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "UsbCeip_09746527" /XML "C:\Users\Admin\AppData\Local\Temp\755ee694-db84-4b8f-b97c-551a4a889e41.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5480
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:1576
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:3504
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:2652
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:704
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:3528
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:6064
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:596
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_541c615b" /F
  2⤵
  PID:5284
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:5040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_541c615b" /XML "C:\Users\Admin\AppData\Local\Temp\3e229956-9ed6-4628-a329-59b6d524ac4a.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5844
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:5140
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:5892
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:4152
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  - Enumerates connected drives
  PID:5520
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:4568
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:2172
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:1380
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:5692
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:1912
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  PID:5832
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:1556
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:6020
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:4880
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:4920
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:1528
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:1068
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:2696
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:3160
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:1476
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:5856
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:4348
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:2640
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:756
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:2252
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  PID:4876
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:4320
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  PID:572
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:4976
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:4708
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:1124
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:5744

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ShellExperienceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ShellExperienceHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\TextInputHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\BackgroundTaskHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\BackgroundTaskHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\OneDriveSetup.exe
"C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\OneDriveSetup.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\SgrmBroker.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Templates\SgrmBroker.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1740

C:\Users\Admin\AppData\Local\Microsoft\Windows\SettingSync\ShellExperienceHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\SettingSync\ShellExperienceHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\MicrosoftEdgeUpdate.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Users\Admin\AppData\Local\Microsoft\Windows\SettingSync\metastore\MicrosoftEdgeCP.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\SettingSync\metastore\MicrosoftEdgeCP.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry