0262fbda1aae755a56543960e27bc549604713ccc00ce5054514d9ff10cbcd91

Analysis

max time kernel
10s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Launcher.exe
Size 298KB
Sample260706-b7fzrscy2m
SHA256 0262fbda1aae755a56543960e27bc549604713ccc00ce5054514d9ff10cbcd91
MD5 5cbe2861c0fe178d00a22a3ed2484b66
SHA1 5228089a9fe94f00a2012e54db95c3e957853c0e
SHA512 b297df98c0d18d9fb04af5c9890c7b3d85b42064e718948f51147dc7c0da8578fc73ae87ac6e2de9a2586aa339592ef88624285a6ed66caabd29d760b8bb6432
SSDEEP 6144:17I4BO7sHaT3UYyQGxneNT2hc81qqLZaRX4j/zAGEDLm/mvYa:ZRWgqqaRoj/zADLm/ha
TLSH
T1D9548E16E79511FEE577C67CCD824902EB727C4547A0EACF13A049A62F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery exploit trojan

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	netcfg_497ed8bc.exe

Possible privilege escalation attempt 18 IoCs

exploit

pid	Process
6140	icacls.exe
1744	icacls.exe
6732	takeown.exe
628	icacls.exe
4556	takeown.exe
1708	icacls.exe
4220	takeown.exe
2812	takeown.exe
6548	icacls.exe
3356	takeown.exe
6632	takeown.exe
6364	icacls.exe
4988	icacls.exe
1960	takeown.exe
2440	takeown.exe
4984	icacls.exe
6744	icacls.exe
5256	takeown.exe

Executes dropped EXE 1 IoCs

pid	Process
5760	netcfg_497ed8bc.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6548	icacls.exe
6732	takeown.exe
4988	icacls.exe
4984	icacls.exe
2812	takeown.exe
6632	takeown.exe
1708	icacls.exe
628	icacls.exe
6364	icacls.exe
3356	takeown.exe
1744	icacls.exe
1960	takeown.exe
6744	icacls.exe
5256	takeown.exe
4556	takeown.exe
2440	takeown.exe
4220	takeown.exe
6140	icacls.exe

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	netcfg_497ed8bc.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4220	takeown.exe
Token: SeShutdownPrivilege	5760	netcfg_497ed8bc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5532	LogonUI.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 6200 wrote to memory of 5760	6200	Launcher.exe	89
PID 5760 wrote to memory of 4220	5760	netcfg_497ed8bc.exe	91
PID 5760 wrote to memory of 6140	5760	netcfg_497ed8bc.exe	93
PID 5760 wrote to memory of 2812	5760	netcfg_497ed8bc.exe	95
PID 5760 wrote to memory of 6548	5760	netcfg_497ed8bc.exe	97
PID 5760 wrote to memory of 3356	5760	netcfg_497ed8bc.exe	99
PID 5760 wrote to memory of 1744	5760	netcfg_497ed8bc.exe	101
PID 5760 wrote to memory of 6732	5760	netcfg_497ed8bc.exe	103
PID 5760 wrote to memory of 4988	5760	netcfg_497ed8bc.exe	105
PID 5760 wrote to memory of 1960	5760	netcfg_497ed8bc.exe	107
PID 5760 wrote to memory of 628	5760	netcfg_497ed8bc.exe	109
PID 5760 wrote to memory of 5256	5760	netcfg_497ed8bc.exe	111
PID 5760 wrote to memory of 6744	5760	netcfg_497ed8bc.exe	113
PID 5760 wrote to memory of 6632	5760	netcfg_497ed8bc.exe	115
PID 5760 wrote to memory of 6364	5760	netcfg_497ed8bc.exe	117
PID 5760 wrote to memory of 4556	5760	netcfg_497ed8bc.exe	119
PID 5760 wrote to memory of 1708	5760	netcfg_497ed8bc.exe	121
PID 5760 wrote to memory of 2440	5760	netcfg_497ed8bc.exe	123
PID 5760 wrote to memory of 4984	5760	netcfg_497ed8bc.exe	125

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6200
- C:\Users\Admin\AppData\Local\Temp\netcfg_497ed8bc.exe
  "C:\Users\Admin\AppData\Local\Temp\netcfg_497ed8bc.exe"
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" /grant Administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6140
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2812
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6548
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3356
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1744
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6732
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4988
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1678656C-05EF-481F-BC5B-EBD8C991502D}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1960
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1678656C-05EF-481F-BC5B-EBD8C991502D}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:628
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5256
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6744
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{2678656C-05EF-481F-BC5B-EBD8C991502D}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6632
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{2678656C-05EF-481F-BC5B-EBD8C991502D}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6364
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4556
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1708
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{A072029F-588B-4B5E-B7F9-05AAD67DF687}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2440
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{A072029F-588B-4B5E-B7F9-05AAD67DF687}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4984

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a34055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netcfg_497ed8bc.exe

Path C:\Users\Admin\AppData\Local\Temp\netcfg_497ed8bc.exe
Size 298KB
SHA256 0262fbda1aae755a56543960e27bc549604713ccc00ce5054514d9ff10cbcd91
MD5 5cbe2861c0fe178d00a22a3ed2484b66
SHA1 5228089a9fe94f00a2012e54db95c3e957853c0e
SHA512 b297df98c0d18d9fb04af5c9890c7b3d85b42064e718948f51147dc7c0da8578fc73ae87ac6e2de9a2586aa339592ef88624285a6ed66caabd29d760b8bb6432
SSDEEP 6144:17I4BO7sHaT3UYyQGxneNT2hc81qqLZaRX4j/zAGEDLm/mvYa:ZRWgqqaRoj/zADLm/ha
TLSH
T1D9548E16E79511FEE577C67CCD824902EB727C4547A0EACF13A049A62F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads