bc59df7c616b5f91a81a239e6da6b237376a3a7b9e0d3bab72dcf75ea470b2cd

Analysis

max time kernel
118s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACK/HELPERS/FIX DRIVER ERROR.bat
Size 2KB
Sample260706-ts5npadt3k
SHA256 bc59df7c616b5f91a81a239e6da6b237376a3a7b9e0d3bab72dcf75ea470b2cd
MD5 9a2f5a7c171c95e61fbbfe90c71e3e92
SHA1 63cd733abb48a2c9ea6645fb058fc1fd56d66c12
SHA512 642f077fa8285776a05ada5156ffba7807b3d5a70987230c8745d1ee4afb06ce12a93ac8ac79f6408c6828d3f1e82499d293bdeeac99368bd01f006b7768aae9
TLSH
T17E51279715E367B1A001CA7ABB63CA36C721F5938A3A6162055D341E9D8F40884F7ECF
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 3 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable\VulnerableDriverBlocklistEnable = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable\Enabled = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
1148	timeout.exe
2592	timeout.exe
4036	timeout.exe
3464	timeout.exe
5036	timeout.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4036	1980	cmd.exe	85
PID 1980 wrote to memory of 4164	1980	cmd.exe	86
PID 1980 wrote to memory of 2436	1980	cmd.exe	87
PID 1980 wrote to memory of 728	1980	cmd.exe	88
PID 1980 wrote to memory of 1836	1980	cmd.exe	89
PID 1980 wrote to memory of 4136	1980	cmd.exe	90
PID 1980 wrote to memory of 3392	1980	cmd.exe	91
PID 1980 wrote to memory of 2488	1980	cmd.exe	92
PID 1980 wrote to memory of 5076	1980	cmd.exe	93
PID 1980 wrote to memory of 1136	1980	cmd.exe	94
PID 1980 wrote to memory of 4088	1980	cmd.exe	95
PID 1980 wrote to memory of 4076	1980	cmd.exe	96
PID 1980 wrote to memory of 3464	1980	cmd.exe	97
PID 1980 wrote to memory of 5036	1980	cmd.exe	100
PID 1980 wrote to memory of 2088	1980	cmd.exe	103
PID 1980 wrote to memory of 4244	1980	cmd.exe	104
PID 1980 wrote to memory of 4524	1980	cmd.exe	105
PID 1980 wrote to memory of 1456	1980	cmd.exe	106
PID 1980 wrote to memory of 2384	1980	cmd.exe	107
PID 1980 wrote to memory of 3920	1980	cmd.exe	108
PID 1980 wrote to memory of 1592	1980	cmd.exe	109
PID 1980 wrote to memory of 2628	1980	cmd.exe	110
PID 1980 wrote to memory of 472	1980	cmd.exe	111
PID 1980 wrote to memory of 3268	1980	cmd.exe	112
PID 1980 wrote to memory of 1148	1980	cmd.exe	113
PID 1980 wrote to memory of 2592	1980	cmd.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\FIX DRIVER ERROR.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4036
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:4164
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet001\CI\Config" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:728
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /f
  2⤵
  PID:1836
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default\VulnerableDriverBlocklistEnableConfig" /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "Enabled" /f
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\CI\Config" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\CI\Config" /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\CI" /f
  2⤵
  PID:4076
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3464
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5036
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  PID:2088
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet001\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default\VulnerableDriverBlocklistEnableConfig" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  PID:3920
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  PID:1592
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\CI" /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\CI\Config" /f
  2⤵
  PID:472
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  PID:3268
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1148
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads