2f4fb83141f8a5109fa74c6fda2f79e2ee4e3997e9cffd66c2be8bd9869288bd

Analysis

max time kernel
898s
max time network
492s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/06/2026, 19:56

Target
kill.exe
Size 183KB
Sample260624-ynmpjaft5n
SHA256 2f4fb83141f8a5109fa74c6fda2f79e2ee4e3997e9cffd66c2be8bd9869288bd
MD5 a472ab48f0fda59d57ab3470f8045a7f
SHA1 d0b1d2d5b703df98dc28753a28f66d7d387e59d4
SHA512 f1d4770fedbebfe5ab6d94908e6bb4cd396015961ed44ab71e3bde694b6bbf3dfa0ad7465dc2a3efec2311d17afac900d8c4c41929b4c817511b31073ad3745c
SSDEEP 3072:scI38GreyAlR1lw/CSbpayCy51Qms3QQmrtcvxIK8Mk0oIQILjWqIoCARFe9yA:scIop1lwbbpxCyYDgBWvxVtL1syA
TLSH
T11B045C21B8D2C032D667087098F5CBB59E3EFC510FB5A9DB63840FBA4E206D19B3575A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	kill.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4236	4232	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
3848	reg.exe
4136	reg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1760	4232	kill.exe	85
PID 1760 wrote to memory of 3848	1760	cmd.exe	86
PID 4232 wrote to memory of 1584	4232	kill.exe	87
PID 1584 wrote to memory of 4136	1584	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\kill.exe
"C:\Users\Admin\AppData\Local\Temp\kill.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 292
  2⤵
  - Program crash
  PID:4236