Extracted

• • Target
    2026-07-30_11c12545487db5b1d6748ccb789da55c_hive
  • Size 817KB
  • SHA256 121401e7fb860cde7d047b81d5d92124346e9e43110310746315e5bb1ad96c85
  • MD5 11c12545487db5b1d6748ccb789da55c
  • SHA1 efcc3d0489de141faf51a210356dd58e72bb7564
  • SHA512 26548bf52013bf4191d7d6a468d9db8345eb7975eb738d388fed95f5d90f6fdf49be890d7a6bd1f69019460c3fa87ef48fe7a1a23a148e5a9366de78d972ed13
  • SSDEEP 24576:IePjBI+5jd4sA9VO67rtUW4a/21wN4eu:lLBIs4s76HtX4ahW
  • TLSH
    T15905333A9C1E7BFEC97074762A6A84303DD62407C8579A13E3DAB9A74CC760074365AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojanupx

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • UPX dump on OEP (original entry point)

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2