Analysis
- max time kernel
52s - max time network
54s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dramatic/VoidCoD.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dramatic/VoidCoD.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Dramatic/VoidCoD.exe
- Size 2.2MB
- Sample260702-e42zlsbx7v
- SHA256 60873671ceb7ec6fafa8ccd9480a10ac08dc642d9aee690c69464d354ab045e5
- MD5 76f150e8688427807d2e3f8d56c1f1f7
- SHA1 c1b545a1b327a5ed0ab3baf8c3059002282c700b
- SHA512 7b733bbdea3e9c0b0979f8db44bae6bbbfdf21eb73a063ebc192c48018504f72ac8bcd2849f48eb7b71610776de8c2657e0e86ce170749d07e2b3e0f61123676
- SSDEEP 49152:Jtnn4a0v7K+NVZ3NnSRPkjzCxeARZx45nTzrSelt6moYlkEkIuJArH+O93+x:vCVZ3NnSRPkjzCx+Xt6JjEkorHru
- TLSH T1FBB5CF5BA7B410F4C1B7C13CC142561BFAB2746503709BEB66D08A6B1F637E4AA3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" reg.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 5 api.ipify.org - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win11.ini VoidCoD.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 5032 wmic.exe 5032 wmic.exe 5032 wmic.exe 5032 wmic.exe 4992 wmic.exe 4992 wmic.exe 4992 wmic.exe 4992 wmic.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe 4092 VoidCoD.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5032 wmic.exe Token: SeSecurityPrivilege 5032 wmic.exe Token: SeTakeOwnershipPrivilege 5032 wmic.exe Token: SeLoadDriverPrivilege 5032 wmic.exe Token: SeSystemProfilePrivilege 5032 wmic.exe Token: SeSystemtimePrivilege 5032 wmic.exe Token: SeProfSingleProcessPrivilege 5032 wmic.exe Token: SeIncBasePriorityPrivilege 5032 wmic.exe Token: SeCreatePagefilePrivilege 5032 wmic.exe Token: SeBackupPrivilege 5032 wmic.exe Token: SeRestorePrivilege 5032 wmic.exe Token: SeShutdownPrivilege 5032 wmic.exe Token: SeDebugPrivilege 5032 wmic.exe Token: SeSystemEnvironmentPrivilege 5032 wmic.exe Token: SeRemoteShutdownPrivilege 5032 wmic.exe Token: SeUndockPrivilege 5032 wmic.exe Token: SeManageVolumePrivilege 5032 wmic.exe Token: 33 5032 wmic.exe Token: 34 5032 wmic.exe Token: 35 5032 wmic.exe Token: 36 5032 wmic.exe Token: SeIncreaseQuotaPrivilege 5032 wmic.exe Token: SeSecurityPrivilege 5032 wmic.exe Token: SeTakeOwnershipPrivilege 5032 wmic.exe Token: SeLoadDriverPrivilege 5032 wmic.exe Token: SeSystemProfilePrivilege 5032 wmic.exe Token: SeSystemtimePrivilege 5032 wmic.exe Token: SeProfSingleProcessPrivilege 5032 wmic.exe Token: SeIncBasePriorityPrivilege 5032 wmic.exe Token: SeCreatePagefilePrivilege 5032 wmic.exe Token: SeBackupPrivilege 5032 wmic.exe Token: SeRestorePrivilege 5032 wmic.exe Token: SeShutdownPrivilege 5032 wmic.exe Token: SeDebugPrivilege 5032 wmic.exe Token: SeSystemEnvironmentPrivilege 5032 wmic.exe Token: SeRemoteShutdownPrivilege 5032 wmic.exe Token: SeUndockPrivilege 5032 wmic.exe Token: SeManageVolumePrivilege 5032 wmic.exe Token: 33 5032 wmic.exe Token: 34 5032 wmic.exe Token: 35 5032 wmic.exe Token: 36 5032 wmic.exe Token: SeIncreaseQuotaPrivilege 4992 wmic.exe Token: SeSecurityPrivilege 4992 wmic.exe Token: SeTakeOwnershipPrivilege 4992 wmic.exe Token: SeLoadDriverPrivilege 4992 wmic.exe Token: SeSystemProfilePrivilege 4992 wmic.exe Token: SeSystemtimePrivilege 4992 wmic.exe Token: SeProfSingleProcessPrivilege 4992 wmic.exe Token: SeIncBasePriorityPrivilege 4992 wmic.exe Token: SeCreatePagefilePrivilege 4992 wmic.exe Token: SeBackupPrivilege 4992 wmic.exe Token: SeRestorePrivilege 4992 wmic.exe Token: SeShutdownPrivilege 4992 wmic.exe Token: SeDebugPrivilege 4992 wmic.exe Token: SeSystemEnvironmentPrivilege 4992 wmic.exe Token: SeRemoteShutdownPrivilege 4992 wmic.exe Token: SeUndockPrivilege 4992 wmic.exe Token: SeManageVolumePrivilege 4992 wmic.exe Token: 33 4992 wmic.exe Token: 34 4992 wmic.exe Token: 35 4992 wmic.exe Token: 36 4992 wmic.exe Token: SeIncreaseQuotaPrivilege 4992 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1044 LogonUI.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4092 wrote to memory of 5032 4092 VoidCoD.exe 89 PID 4092 wrote to memory of 4992 4092 VoidCoD.exe 93 PID 4092 wrote to memory of 5240 4092 VoidCoD.exe 95 PID 5240 wrote to memory of 2116 5240 cmd.exe 96 PID 4092 wrote to memory of 4964 4092 VoidCoD.exe 97 PID 4964 wrote to memory of 2336 4964 cmd.exe 98 PID 4092 wrote to memory of 2656 4092 VoidCoD.exe 99 PID 2656 wrote to memory of 2124 2656 cmd.exe 100 PID 4092 wrote to memory of 6016 4092 VoidCoD.exe 101 PID 6016 wrote to memory of 1596 6016 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dramatic\VoidCoD.exe"C:\Users\Admin\AppData\Local\Temp\Dramatic\VoidCoD.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\ /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\ /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f3⤵PID:2116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config\ /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config\ /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f3⤵
- Modify Registry: Disable Windows Driver Blocklist
PID:2336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\ /v Enabled /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\ /v Enabled /t REG_DWORD /d 0 /f3⤵PID:2124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 0 -f2⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\system32\shutdown.exeshutdown -r -t 0 -f3⤵PID:1596
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a11855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4112
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:1368