Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 23:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CombinedWindowsDefKiller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
CombinedWindowsDefKiller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target CombinedWindowsDefKiller.exe
- Size 71KB
- Sample260727-3dmc8stbmg
- SHA256 c2db3e3707175f7764d7454c515b544749a2830d787eab47556ee092dabcd25f
- MD5 a058760f682a6e28b77fcddd7b461971
- SHA1 60524b85f9b05ed34e300e7e73063e2a8b914bcd
- SHA512 0ec73bd8e91c72f95c303aec5fb5ac1147e9c566c996083876182ba665156079304526f7585a3e2c6ddb0b842f0e720d9c682cfb8d3df12de0d76e67cc41d960
- SSDEEP 1536:KSlXRBsRfEjqz6+lcVu+vQgGzVGORWItmhcK6OpQN9lcEz02:zsxEj4lygz8EN9lDV
- TLSH T132635C05D9AA90ABD36E8C74D5178907DEB2BCC343A1B9DF57808CD50E62BC49F3E246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" CombinedWindowsDefKiller.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1648 CombinedWindowsDefKiller.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe Token: SeDebugPrivilege 1648 CombinedWindowsDefKiller.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1