Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
677be95825346cae080c802e8fde5d0285cbc0246d219f87b2747187d488a405.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
677be95825346cae080c802e8fde5d0285cbc0246d219f87b2747187d488a405.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 677be95825346cae080c802e8fde5d0285cbc0246d219f87b2747187d488a405.dll
- Size 1.1MB
- Sample260804-ysnsdsyerb
- SHA256 677be95825346cae080c802e8fde5d0285cbc0246d219f87b2747187d488a405
- MD5 7e706ec78bf86869d93770cdac3384bb
- SHA1 f0272e13c0546da8bdb6c54b907ee11af9fc821c
- SHA512 03404e3c8c0928e99316336f5c6e743914d9693551088faf95ae35508600b40957a1e21b8e2fbbb095ee4ea455ce0f0b9ef5099677f6d9f6269d34fe8ed43c63
- SSDEEP 12288:W9ACpACkQUmD+j7GsPjltUewEvzRNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+S5m8X:1COCjUmDQNW3AzX2X
- TLSH T186359324B9BA412DD037FFB83EDDF49EEDAB3A151545A46B0041034B8A26AD0CF5B63D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rundll32.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" rundll32.exe - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 3064 drv_BootRepair.sys - Windows security modification 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4512 cmd.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion rundll32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4348 wrote to memory of 4512 4348 rundll32.exe 91 PID 4512 wrote to memory of 4396 4512 cmd.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\677be95825346cae080c802e8fde5d0285cbc0246d219f87b2747187d488a405.dll,#11⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Boot or Logon Autostart Execution: LSASS Driver
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\system32\cmd.execmd.exe /c "gpupdate /force"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\system32\gpupdate.exegpupdate /force3⤵PID:4396
-
-
-
C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sysC:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys1⤵
- Executes dropped EXE
PID:3064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
- Size 29KB
- SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
- MD5 82699276b0f59a2304120a6baaf64a6b
- SHA1 87903559afa09a0dfe251598c14e58124bddde1d
- SHA512 a06b1bc82fffeb75ad5498ad8edb859ceb4cacd0d9f7cbe2d260b0c881fa9ef33d0389e6aa9f64fe4b8c3003423b1c71413ce5e1183a1e2b68ad5f528c9d7e5c
- SSDEEP 384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2
- TLSH T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A
- MD5 SHA1 SHA512 SSDEEP TLSH