Using initial access, the attacker compromised a Microsoft Exchange service account with domain administrator privileges, gaining elevated access.

The attacker then installed Horoung Antivirus, which caused a conflict that disabled security and weakened detection, allowing him to install Impacket, a collection of open-source networking scripts.

Specifically, the attacker used a batch script (“hrsword install.bat”) to install Huorong Antivirus on the system, set up a custom service (“sysdiag”), run the driver (“sysdiag_win10.sys”), and run “HRSword.exe” using a VBS script.