Overview

overview

10

Static

static

5

bazzarnuker.exe

windows10-2004-x64

10

bazzarnuker.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    71s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 00:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bazzarnuker.exe
  • Size 190KB
  • Sample260628-assvcaew6r
  • SHA256 4055c24e3222e34df3d28a0b76a2f11478cc7b51b2d000be8c06c2f81c76079d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe
    "C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:6012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe' -ArgumentList '--elevated' -WindowStyle Hidden"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe
        "C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe" --elevated
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5496
        • C:\Windows\system32\taskkill.exe
          "taskkill" /f /im javaw.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4236
        • C:\Windows\system32\vssadmin.exe
          "vssadmin" delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:5104
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" shadowcopy delete
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1744
        • C:\Windows\system32\wevtutil.exe
          "wevtutil" cl Application
          4⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:5452
        • C:\Windows\system32\wevtutil.exe
          "wevtutil" cl System
          4⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:2740
        • C:\Windows\system32\wevtutil.exe
          "wevtutil" cl Security
          4⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:4176
        • C:\Windows\system32\taskkill.exe
          "taskkill" /f /im MsMpEng.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4448
        • C:\Windows\system32\taskkill.exe
          "taskkill" /f /im NisSrv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2100
        • C:\Windows\system32\taskkill.exe
          "taskkill" /f /im cb.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:616
        • C:\Windows\system32\taskkill.exe
          "taskkill" /f /im csfalconservice.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5892
        • C:\Windows\system32\taskkill.exe
          "taskkill" /f /im csagent.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1788
        • C:\Windows\system32\reg.exe
          "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
          4⤵
          • Modifies Windows Defender DisableAntiSpyware settings
          PID:4932
        • C:\Windows\system32\reg.exe
          "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          PID:2760
        • C:\Windows\system32\reg.exe
          "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          PID:3380
        • C:\Windows\system32\sc.exe
          "sc" stop WinDefend
          4⤵
          • Launches sc.exe
          PID:2988
        • C:\Windows\system32\sc.exe
          "sc" config WinDefend start= disabled
          4⤵
          • Launches sc.exe
          PID:2472
        • C:\Windows\system32\sc.exe
          "sc" stop Sense
          4⤵
          • Launches sc.exe
          PID:5860
        • C:\Windows\system32\sc.exe
          "sc" config Sense start= disabled
          4⤵
          • Launches sc.exe
          PID:1724
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5876

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        System Services

        2
        T1569

        Service Execution

        2
        T1569.002

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Privilege Escalation

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Impair Defenses

        3
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Indicator Removal

        3
        T1070

        Clear Windows Event Logs

        1
        T1070.001

        File Deletion

        2
        T1070.004

        Modify Registry

        2
        T1112

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Credential Access

        Credentials from Password Stores

        2
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Windows Credential Manager

        1
        T1555.004

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        2
        T1490

        Service Stop

        2
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d88dd9fa42a06b3318f7d1edbe206b8e71a885579ef2dc68128447912841a5b8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Desktop\logs.txt
        • Size 266B
        • SHA256 3810522c6d9e738dc4450e4bc66b8d8fa12db8b89300e1756e9d802321f98922
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Desktop\logs.txt
        • Size 1KB
        • SHA256 a3ecd56654162d62c1de012b342fc9849dc0c54aa3981b86cf970c57f8212e7a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Desktop\logs.txt
        • Size 872B
        • SHA256 43458c3667ad266416ff542a7b82e0ada1b3d9dbf63acd191632847c8e4f61f2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logs.txt
        • Path C:\Users\Admin\Desktop\logs.txt
        • Size 1023B
        • SHA256 ec2188ca23604a95f3520c1077daad36da96d301481b58a6a6507e10a853d99c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        M1033Eva.cute
        • Path C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Eva.cute
        • Size 211KB
        • SHA256 fc01f448e3deef415c4d2be875ee04593f1148094cef18fb2e7b4e1f497d24fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2796-8-0x00007FF6ECDA0000-0x00007FF6ECE25000-memory.dmp
        Download

        memory/2796-0-0x00007FF6ECDA0000-0x00007FF6ECE25000-memory.dmp
        Download

        memory/3772-15-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-13-0x000002A2A7800000-0x000002A2A7822000-memory.dmp
        Download

        memory/3772-19-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-20-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-21-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-22-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-23-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-25-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-17-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-9-0x00007FFBD77FF000-0x00007FFBD7800000-memory.dmp
        Download

        memory/3772-16-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-10-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-54-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-18-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/3772-14-0x00007FFBD7670000-0x00007FFBD8014000-memory.dmp
        Download

        memory/5496-53-0x00007FF6ECDA0000-0x00007FF6ECE25000-memory.dmp
        Download

        memory/5496-28-0x00007FF6ECDA0000-0x00007FF6ECE25000-memory.dmp
        Download