Behavioral Analysis

lsass.exe lsass.exe install "Windows Updata" winlogon.exe

regedit.exe C:\Windows\regedit /s server.reg

1sass.exe C:\PerfLogs\Admin\1sass.exe install "Windows Management" C:\PerfLogs\Admin\csrss.exe

regedit.exe C:\Windows\regedit /s server2.reg

sc.exe sc start "Windows Updata"

sc.exe sc start "Windows Management"

attrib.exe attrib C:\Windows\debug\m +h +a

attrib.exe attrib C:\Windows\debug\m\*.json +h +a +s +r

attrib.exe attrib C:\Windows\debug\m\*.exe +h +a +s +r

attrib.exe attrib C:\PerfLogs\Admin\*.exe +h +a +s +r

netsh.exe netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow