cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb

Analysis

max time kernel
10s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
Size 299KB
Sample260729-dd779sshpc
SHA256 cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb
MD5 1b7188bccb194e8ab89da7673ca9e029
SHA1 37b9cc0109457e3931d8638dacd6d07f6fb06ac9
SHA512 d3aeb93b42bd23ccb6d70682ccdb0d8b7be0543aaa2142fd1aedc879bb38904b5800680b63ad618853037281618f7124244a3dd8547378b4263c2bf537226a69
SSDEEP 6144:/aNAN6ij56+haK1aoAVhqRXBy0w8hFhTamraG:/aNAR3a2aoQKXBy0JFhTamr
TLSH
T1D6647B17B79555BCE15AC038934A95B3BA72B8CA06307DBF13E49A303F16D512F2CB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4152	wevtutil.exe
2996	wevtutil.exe
4440	wevtutil.exe
3664	wevtutil.exe
4312	wevtutil.exe
4808	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4004	netsh.exe
1228	netsh.exe
3756	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies boot configuration data using bcdedit 7 IoCs

pid	Process
944	bcdedit.exe
1824	bcdedit.exe
1088	bcdedit.exe
1856	bcdedit.exe
4400	bcdedit.exe
4428	bcdedit.exe
5040	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\SYSTEM	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SYSTEM.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SECURITY.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\kdcom.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SECURITY	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\hal.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\winresume.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\ci.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\bootreg.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\kernel32.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SAM	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SAM.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\MRT.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\winload.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\ntdll.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\DEFAULT.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SYSTEM.LOG1	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\clfs.sys	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	vds.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4480	sc.exe
3516	sc.exe
4432	sc.exe
916	sc.exe
1616	sc.exe
2868	sc.exe
3928	sc.exe
5024	sc.exe
3040	sc.exe
3884	sc.exe
2700	sc.exe
2264	sc.exe
2568	sc.exe
2692	sc.exe
5000	sc.exe
1768	sc.exe
1784	sc.exe
2796	sc.exe
260	sc.exe
3004	sc.exe
1368	sc.exe
3504	sc.exe
3920	sc.exe
2368	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fed0487e23000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000020c8f0fe00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3944	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5112	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
Token: SeSecurityPrivilege	3284	wevtutil.exe
Token: SeBackupPrivilege	3284	wevtutil.exe
Token: SeSecurityPrivilege	4312	wevtutil.exe
Token: SeBackupPrivilege	4312	wevtutil.exe
Token: SeSecurityPrivilege	4808	wevtutil.exe
Token: SeBackupPrivilege	4808	wevtutil.exe
Token: SeSecurityPrivilege	4152	wevtutil.exe
Token: SeBackupPrivilege	4152	wevtutil.exe
Token: SeSecurityPrivilege	2996	wevtutil.exe
Token: SeBackupPrivilege	2996	wevtutil.exe
Token: SeSecurityPrivilege	4440	wevtutil.exe
Token: SeBackupPrivilege	4440	wevtutil.exe
Token: SeSecurityPrivilege	3664	wevtutil.exe
Token: SeBackupPrivilege	3664	wevtutil.exe
Token: SeDebugPrivilege	5112	powershell.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 944	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	85
PID 3384 wrote to memory of 1824	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	86
PID 3384 wrote to memory of 1088	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	87
PID 3384 wrote to memory of 1856	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	88
PID 3384 wrote to memory of 4400	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	89
PID 3384 wrote to memory of 4428	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	90
PID 3384 wrote to memory of 5040	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	91
PID 3384 wrote to memory of 4184	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	92
PID 3384 wrote to memory of 692	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	93
PID 3384 wrote to memory of 4060	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	94
PID 3384 wrote to memory of 3412	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	95
PID 3384 wrote to memory of 2632	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	96
PID 3384 wrote to memory of 1472	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	97
PID 3384 wrote to memory of 5024	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	98
PID 3384 wrote to memory of 3284	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	99
PID 3384 wrote to memory of 4508	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	100
PID 3384 wrote to memory of 4004	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	101
PID 3384 wrote to memory of 2368	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	102
PID 3384 wrote to memory of 4312	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	103
PID 3384 wrote to memory of 3040	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	104
PID 3384 wrote to memory of 3884	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	105
PID 3384 wrote to memory of 1616	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	106
PID 3384 wrote to memory of 4808	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	107
PID 3384 wrote to memory of 3944	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	108
PID 3384 wrote to memory of 1768	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	109
PID 3384 wrote to memory of 4152	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	110
PID 3384 wrote to memory of 4480	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	111
PID 3384 wrote to memory of 5112	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	112
PID 3384 wrote to memory of 2700	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	113
PID 3384 wrote to memory of 1784	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	114
PID 3384 wrote to memory of 2996	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	115
PID 3384 wrote to memory of 2264	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	116
PID 3384 wrote to memory of 4440	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	117
PID 3384 wrote to memory of 3516	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	118
PID 3384 wrote to memory of 3664	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	119
PID 3384 wrote to memory of 2568	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	120
PID 3384 wrote to memory of 4432	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	121
PID 3384 wrote to memory of 2868	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	122
PID 3384 wrote to memory of 2796	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	123
PID 3384 wrote to memory of 2692	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	124
PID 3384 wrote to memory of 4584	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	125
PID 3384 wrote to memory of 5000	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	126
PID 3384 wrote to memory of 260	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	127
PID 3384 wrote to memory of 916	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	129
PID 3384 wrote to memory of 3004	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	130
PID 3384 wrote to memory of 1368	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	132
PID 3384 wrote to memory of 3928	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	133
PID 3384 wrote to memory of 3504	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	134
PID 3384 wrote to memory of 3920	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	135
PID 3384 wrote to memory of 1228	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	136
PID 3384 wrote to memory of 3756	3384	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {current} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:944
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {bootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1824
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {memdiag} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1088
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {fwbootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1856
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {bootsectbak} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4400
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /createstore C:\Boot\BCD
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4428
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /createstore S:\EFI\Microsoft\Boot\BCD
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5040
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /disable
  2⤵
  PID:4184
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /disable
  2⤵
  PID:692
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /disable
  2⤵
  PID:4060
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Verification" /disable
  2⤵
  PID:3412
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Change /TN "\Microsoft\Windows\RemovalTools\MRT_HB" /Disable
  2⤵
  PID:2632
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /TN "\Microsoft\Windows\RemovalTools\MRT_HB" /F
  2⤵
  PID:1472
- C:\Windows\SYSTEM32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil el
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3284
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:4508
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set domainprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4004
- C:\Windows\SYSTEM32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2368
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\SYSTEM32\sc.exe
  sc stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:3040
- C:\Windows\SYSTEM32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3884
- C:\Windows\SYSTEM32\sc.exe
  sc stop Sense
  2⤵
  - Launches sc.exe
  PID:1616
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Security"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3944
- C:\Windows\SYSTEM32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:1768
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Windows\SYSTEM32\sc.exe
  sc stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Disable-ComputerRestore -Drive 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\SYSTEM32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\SYSTEM32\sc.exe
  sc stop VSS
  2⤵
  - Launches sc.exe
  PID:1784
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\SYSTEM32\sc.exe
  sc config VSS start= disabled
  2⤵
  - Launches sc.exe
  PID:2264
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Microsoft-Windows-Kernel-General/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\SYSTEM32\sc.exe
  sc stop swprv
  2⤵
  - Launches sc.exe
  PID:3516
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\SYSTEM32\sc.exe
  sc config swprv start= disabled
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\SYSTEM32\sc.exe
  sc stop WSearch
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\SYSTEM32\sc.exe
  sc config WSearch start= disabled
  2⤵
  - Launches sc.exe
  PID:2868
- C:\Windows\SYSTEM32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:2796
- C:\Windows\SYSTEM32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2692
- C:\Windows\SYSTEM32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\\dp_destroy.txt
  2⤵
  PID:4584
- C:\Windows\SYSTEM32\sc.exe
  sc stop WerSvc
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\SYSTEM32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:260
- C:\Windows\SYSTEM32\sc.exe
  sc stop BITS
  2⤵
  - Launches sc.exe
  PID:916
- C:\Windows\SYSTEM32\sc.exe
  sc config BITS start= disabled
  2⤵
  - Launches sc.exe
  PID:3004
- C:\Windows\SYSTEM32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1368
- C:\Windows\SYSTEM32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:3928
- C:\Windows\SYSTEM32\sc.exe
  sc stop TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:3504
- C:\Windows\SYSTEM32\sc.exe
  sc config TrustedInstaller start= disabled
  2⤵
  - Launches sc.exe
  PID:3920
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set privateprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1228
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set publicprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3756

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:952

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_0ykbwzpv.fb3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ykbwzpv.fb3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dp_destroy.txt

Path C:\Users\Admin\AppData\Local\Temp\dp_destroy.txt
Size 108B
SHA256 2d6361cd6270b4050e7a9ae90502933e915df01efb054808b68646dd5ae00b83
MD5 f3a13568c3ad10bc758a7ad2d3b3484c
SHA1 26d4974ce538aeca059b15fe8ccc13a5c456d626
SHA512 ddac11568f2c67963b07fadf3d7e379f241537d025f33f557dde43008e44b627082eb63f334ba96b2694f21f7df6e6ed05e4da6cfbaa5d74c34495149a77b33f
TLSH
T1F0B0021145867535319BC652D6F03D19492600A48E71201DDE86B0950417A38A68BF47
MD5 SHA1 SHA512 TLSH

Submit Download

hive_SAM

Path C:\Users\Admin\AppData\Local\Temp\hive_SAM
Size 4KB
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA512 2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
MD5 SHA1 SHA512

Submit Download

debug_ntfs.txt

Path C:\debug_ntfs.txt
Size 4B
SHA256 b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
MD5 b326b5062b2f0e69046810717534cb09
SHA1 5ffe533b830f08a0326348a9160afafc8ada44db
SHA512 9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de
MD5 SHA1 SHA512

Submit Download

memory/5112-74-0x000001B35E200000-0x000001B35E222000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads