Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 11:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57f277d57364a6d38ff802c39f5df3618e054fd779bd25b3f3901dd16a5c6963.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
57f277d57364a6d38ff802c39f5df3618e054fd779bd25b3f3901dd16a5c6963.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 57f277d57364a6d38ff802c39f5df3618e054fd779bd25b3f3901dd16a5c6963.dll
- Size 1.0MB
- Sample260720-njpcfsaw81
- SHA256 57f277d57364a6d38ff802c39f5df3618e054fd779bd25b3f3901dd16a5c6963
- MD5 c460cbb105655e294968bb88c290d298
- SHA1 e6069a0afba905271520fa342c51a28cb455f9c0
- SHA512 4df72d5ee634dedd40988d159be1900d1b61dcdb97b6feffdd11d52d15043b406b4897fe4bed6ca75e0de1aef312e9e7894d7e77a9b890d0f718783c01f62725
- SSDEEP 12288:hBKbdGnzvAQqwNjDBmzN3JgbRTxvF/NzUzv3IgNaSWYdU4881GNT0Qkb3NnX+S5L:hKGnzvAQ7NjDUMbfvFY4
- TLSH T169259324B9BA412DD037FFB83EDDF49EEDAB3A151545A46B0041034B8A26AD0CF5B63D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0" rundll32.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" rundll32.exe - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 1364 drv_BootRepair.sys - Windows security modification 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5976 cmd.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe 4076 rundll32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 824 Process not Found - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4076 wrote to memory of 5976 4076 rundll32.exe 91 PID 5976 wrote to memory of 52 5976 cmd.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57f277d57364a6d38ff802c39f5df3618e054fd779bd25b3f3901dd16a5c6963.dll,#11⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Boot or Logon Autostart Execution: LSASS Driver
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\cmd.execmd.exe /c "gpupdate /force"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\system32\gpupdate.exegpupdate /force3⤵PID:52
-
-
-
C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sysC:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys1⤵
- Executes dropped EXE
PID:1364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
- Size 29KB
- SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
- MD5 82699276b0f59a2304120a6baaf64a6b
- SHA1 87903559afa09a0dfe251598c14e58124bddde1d
- SHA512 a06b1bc82fffeb75ad5498ad8edb859ceb4cacd0d9f7cbe2d260b0c881fa9ef33d0389e6aa9f64fe4b8c3003423b1c71413ce5e1183a1e2b68ad5f528c9d7e5c
- SSDEEP 384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2
- TLSH T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A
- MD5 SHA1 SHA512 SSDEEP TLSH