Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 19:52
Behavioral task
behavioral1
Sample
4b75e07bed02dc725b9ca05c523045b4f33ca75d5cca69702face42fe399f014.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b75e07bed02dc725b9ca05c523045b4f33ca75d5cca69702face42fe399f014.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 4b75e07bed02dc725b9ca05c523045b4f33ca75d5cca69702face42fe399f014.dll
- Size 314KB
- Sample260804-ylcfsawzhx
- SHA256 4b75e07bed02dc725b9ca05c523045b4f33ca75d5cca69702face42fe399f014
- MD5 6234660228e57745898d2942b845fa45
- SHA1 e27025befa7310d276e389477135b1186cbc3aab
- SHA512 6dd4d43b69eff38a60b4ddf2927e712cb02f3d09e9aa5b9f1b9c398ae7c33a9f87847f37b5c563e93d8f81d2ff4b4e59743c627e49c67b64ef2617063d8a6653
- SSDEEP 6144:b1xO4J48tQi41t5O+IJZVMszVaCqZoRi35v44qmJXDKPdxtJ2y1/J86rF:bTO/8tQt75U7VMaUoRixJOZJT/J/rF
- TLSH T18E6423AA29DEF552F6C88D748944ABC27C729C410F430BEA15DC50BB2DB90977A1E31F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rundll32.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" rundll32.exe - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 2504 drv_BootRepair.sys - Windows security modification 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe -
resource yara_rule behavioral2/memory/5104-0-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-5-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-4-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-6-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-7-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-8-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-9-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx behavioral2/memory/5104-14-0x00007FFC28A70000-0x00007FFC28B7D000-memory.dmp upx - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6132 cmd.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 808 Process not Found - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5104 wrote to memory of 6132 5104 rundll32.exe 91 PID 6132 wrote to memory of 2696 6132 cmd.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b75e07bed02dc725b9ca05c523045b4f33ca75d5cca69702face42fe399f014.dll,#11⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Boot or Logon Autostart Execution: LSASS Driver
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\cmd.execmd.exe /c "gpupdate /force"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\system32\gpupdate.exegpupdate /force3⤵PID:2696
-
-
-
C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sysC:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys1⤵
- Executes dropped EXE
PID:2504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
- Size 29KB
- SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
- MD5 82699276b0f59a2304120a6baaf64a6b
- SHA1 87903559afa09a0dfe251598c14e58124bddde1d
- SHA512 a06b1bc82fffeb75ad5498ad8edb859ceb4cacd0d9f7cbe2d260b0c881fa9ef33d0389e6aa9f64fe4b8c3003423b1c71413ce5e1183a1e2b68ad5f528c9d7e5c
- SSDEEP 384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2
- TLSH T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A
- MD5 SHA1 SHA512 SSDEEP TLSH