Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 19:06
Behavioral task
behavioral1
Sample
f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937.dll
- Size 308KB
- Sample260723-xsbmdshr9t
- SHA256 f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937
- MD5 7762b9b47b5b72adbf12804b3389e9c9
- SHA1 132344907a3d0cf744cfd933deada75b9091ac23
- SHA512 8593f9b5df8ab491b8bbf0c32cadf9801db955dd68c7df911c431124a71509b8800653011a72d21875083d0246e8e3c9765f336e0b5b9615d29577d6c7eb362b
- SSDEEP 6144:Hk37QOJk9jPbQk7rvYAOzuX1Tc558tkckU7aLOOwAn0VDMLnA8GsF:Wa9jPJ7DYAOSW558zGCbf1MsVsF
- TLSH T1076423106AFAE5D3D4A141B18E8851C43DBFA840571D1A7EB5C9E3773CBAD90EC0A36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rundll32.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" rundll32.exe - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 4064 drv_BootRepair.sys - Windows security modification 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features rundll32.exe -
resource yara_rule behavioral2/memory/4624-0-0x00007FFB1E760000-0x00007FFB1E84A000-memory.dmp upx behavioral2/memory/4624-5-0x00007FFB1E760000-0x00007FFB1E84A000-memory.dmp upx behavioral2/memory/4624-8-0x00007FFB1E760000-0x00007FFB1E84A000-memory.dmp upx behavioral2/memory/4624-9-0x00007FFB1E760000-0x00007FFB1E84A000-memory.dmp upx - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3712 cmd.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4624 wrote to memory of 3712 4624 rundll32.exe 91 PID 3712 wrote to memory of 3112 3712 cmd.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937.dll,#11⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Boot or Logon Autostart Execution: LSASS Driver
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\system32\cmd.execmd.exe /c "gpupdate /force"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\system32\gpupdate.exegpupdate /force3⤵PID:3112
-
-
-
C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sysC:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys1⤵
- Executes dropped EXE
PID:4064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
- Size 29KB
- SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
- MD5 82699276b0f59a2304120a6baaf64a6b
- SHA1 87903559afa09a0dfe251598c14e58124bddde1d
- SHA512 a06b1bc82fffeb75ad5498ad8edb859ceb4cacd0d9f7cbe2d260b0c881fa9ef33d0389e6aa9f64fe4b8c3003423b1c71413ce5e1183a1e2b68ad5f528c9d7e5c
- SSDEEP 384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2
- TLSH T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A
- MD5 SHA1 SHA512 SSDEEP TLSH