General
- Target CombinedWindowsDefKiller.exe
- Size 71KB
- Sample260727-3dmc8stbmg
- SHA256 c2db3e3707175f7764d7454c515b544749a2830d787eab47556ee092dabcd25f
- MD5 a058760f682a6e28b77fcddd7b461971
- SHA1 60524b85f9b05ed34e300e7e73063e2a8b914bcd
- SHA512 0ec73bd8e91c72f95c303aec5fb5ac1147e9c566c996083876182ba665156079304526f7585a3e2c6ddb0b842f0e720d9c682cfb8d3df12de0d76e67cc41d960
- SSDEEP 1536:KSlXRBsRfEjqz6+lcVu+vQgGzVGORWItmhcK6OpQN9lcEz02:zsxEj4lygz8EN9lDV
- TLSH T132635C05D9AA90ABD36E8C74D5178907DEB2BCC343A1B9DF57808CD50E62BC49F3E246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CombinedWindowsDefKiller.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
CombinedWindowsDefKiller.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target CombinedWindowsDefKiller.exe
- Size 71KB
- SHA256 c2db3e3707175f7764d7454c515b544749a2830d787eab47556ee092dabcd25f
- MD5 a058760f682a6e28b77fcddd7b461971
- SHA1 60524b85f9b05ed34e300e7e73063e2a8b914bcd
- SHA512 0ec73bd8e91c72f95c303aec5fb5ac1147e9c566c996083876182ba665156079304526f7585a3e2c6ddb0b842f0e720d9c682cfb8d3df12de0d76e67cc41d960
- SSDEEP 1536:KSlXRBsRfEjqz6+lcVu+vQgGzVGORWItmhcK6OpQN9lcEz02:zsxEj4lygz8EN9lDV
- TLSH T132635C05D9AA90ABD36E8C74D5178907DEB2BCC343A1B9DF57808CD50E62BC49F3E246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1