bc59df7c616b5f91a81a239e6da6b237376a3a7b9e0d3bab72dcf75ea470b2cd

Analysis

max time kernel
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACK/HELPERS/FIX DRIVER ERROR.bat
Size 2KB
Sample260706-ts5npadt3k
SHA256 bc59df7c616b5f91a81a239e6da6b237376a3a7b9e0d3bab72dcf75ea470b2cd
MD5 9a2f5a7c171c95e61fbbfe90c71e3e92
SHA1 63cd733abb48a2c9ea6645fb058fc1fd56d66c12
SHA512 642f077fa8285776a05ada5156ffba7807b3d5a70987230c8745d1ee4afb06ce12a93ac8ac79f6408c6828d3f1e82499d293bdeeac99368bd01f006b7768aae9
TLSH
T17E51279715E367B1A001CA7ABB63CA36C721F5938A3A6162055D341E9D8F40884F7ECF
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 3 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable\VulnerableDriverBlocklistEnable = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable\Enabled = "0"	reg.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
5808	timeout.exe
4232	timeout.exe
4832	timeout.exe
2876	timeout.exe
2584	timeout.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4832	3068	cmd.exe	89
PID 3068 wrote to memory of 4112	3068	cmd.exe	90
PID 3068 wrote to memory of 3876	3068	cmd.exe	91
PID 3068 wrote to memory of 992	3068	cmd.exe	92
PID 3068 wrote to memory of 5168	3068	cmd.exe	93
PID 3068 wrote to memory of 3948	3068	cmd.exe	94
PID 3068 wrote to memory of 5636	3068	cmd.exe	95
PID 3068 wrote to memory of 2732	3068	cmd.exe	96
PID 3068 wrote to memory of 3620	3068	cmd.exe	97
PID 3068 wrote to memory of 1736	3068	cmd.exe	98
PID 3068 wrote to memory of 4316	3068	cmd.exe	99
PID 3068 wrote to memory of 1088	3068	cmd.exe	100
PID 3068 wrote to memory of 2876	3068	cmd.exe	101
PID 3068 wrote to memory of 2584	3068	cmd.exe	102
PID 3068 wrote to memory of 4920	3068	cmd.exe	103
PID 3068 wrote to memory of 3428	3068	cmd.exe	104
PID 3068 wrote to memory of 4276	3068	cmd.exe	105
PID 3068 wrote to memory of 1100	3068	cmd.exe	106
PID 3068 wrote to memory of 3456	3068	cmd.exe	107
PID 3068 wrote to memory of 4252	3068	cmd.exe	108
PID 3068 wrote to memory of 4664	3068	cmd.exe	109
PID 3068 wrote to memory of 3968	3068	cmd.exe	110
PID 3068 wrote to memory of 3916	3068	cmd.exe	111
PID 3068 wrote to memory of 3132	3068	cmd.exe	112
PID 3068 wrote to memory of 5808	3068	cmd.exe	113
PID 3068 wrote to memory of 4232	3068	cmd.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\FIX DRIVER ERROR.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4832
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet001\CI\Config" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:3876
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:992
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /f
  2⤵
  PID:5168
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default\VulnerableDriverBlocklistEnableConfig" /f
  2⤵
  PID:3948
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:5636
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "Enabled" /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\CI\Config" /v "VulnerableDriverBlocklistEnable" /f
  2⤵
  PID:1736
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\CI\Config" /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  REG DELETE "HKLM\SYSTEM\CurrentControlSet\CI" /f
  2⤵
  PID:1088
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2876
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2584
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  PID:4920
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet001\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:1100
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\Default\VulnerableDriverBlocklistEnableConfig" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  PID:4252
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  PID:4664
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\CI" /f
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\CI\Config" /f
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
  2⤵
  PID:3132
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5808
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads