Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90fbc68be895462811f1e0d0af0f063945dd17a0c179b1a0c54e46e32aa898bc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
90fbc68be895462811f1e0d0af0f063945dd17a0c179b1a0c54e46e32aa898bc.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target 90fbc68be895462811f1e0d0af0f063945dd17a0c179b1a0c54e46e32aa898bc.dll
- Size 892KB
- Sample260527-swkl9abz21
- SHA256 90fbc68be895462811f1e0d0af0f063945dd17a0c179b1a0c54e46e32aa898bc
- MD5 4e7d62e6e373ec184d20fa4d9858496e
- SHA1 db60dcbdcb7b8aaa8c0fbdaae15bc66752d669b6
- SHA512 8b772f6955202c229ed551aa6c5feb79383c9a6aa6a6a9865693e77af9c77f595cc1d338de9f9743199540a48d27915d407787a1e84294b62effb51013e66c92
- SSDEEP 12288:IG16WyYvMj/AvL/pYuFrCNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+SjO1lu0Zaq3:h16WFvMj/MPrdOtc
- TLSH T125151A2469FA0069E037FFB43EDD6899DDEB79111615A05B11400B8F9A23ED0DF2BA3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rundll32.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" rundll32.exe - Modifies firewall policy service 3 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\RESTRICTEDSERVICES\STATIC\SYSTEM rundll32.exe - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 1040 drv_BootRepair.sys - Windows security modification 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\MpPlatformKillbitsFromEngine = 0000000000000000 rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "0" rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\MpCapability = 0000000000000000 rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1" rundll32.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe 2632 rundll32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2632 wrote to memory of 1708 2632 rundll32.exe 90 PID 1708 wrote to memory of 4788 1708 cmd.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90fbc68be895462811f1e0d0af0f063945dd17a0c179b1a0c54e46e32aa898bc.dll,#11⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- Windows security bypass
- Boot or Logon Autostart Execution: LSASS Driver
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\cmd.execmd.exe /c "gpupdate /force"2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\gpupdate.exegpupdate /force3⤵PID:4788
-
-
-
C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sysC:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys1⤵
- Executes dropped EXE
PID:1040
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
4Windows Service
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
- Size 29KB
- SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
- MD5 82699276b0f59a2304120a6baaf64a6b
- SHA1 87903559afa09a0dfe251598c14e58124bddde1d
- SHA512 a06b1bc82fffeb75ad5498ad8edb859ceb4cacd0d9f7cbe2d260b0c881fa9ef33d0389e6aa9f64fe4b8c3003423b1c71413ce5e1183a1e2b68ad5f528c9d7e5c
- SSDEEP 384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2
- TLSH T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A
- MD5 SHA1 SHA512 SSDEEP TLSH