d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe
Size 310KB
Sample260805-wlm66sda88
SHA256 d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704
MD5 19b830a02f84cb5e6d94d3855bb92d86
SHA1 b9da8d818cba9a0c61e1ea6a477511607e7812a8
SHA512 64fec1e9f5269aa09e8bab389d6e0acd93e7dbe8707ac0177052bd3383eabe134cf1229736e119d0b10aa0c2284457555df5e9a1302cea6f22d64ebccc5e8115
SSDEEP 6144:47WyGmQE/fMbr809X3vESjkvF3g9Uupt:47WUkV9X3vESjDm
TLSH
T158647D19F7A510F9E5B78679CD438906E7727C464760E78F23A04AA63F332A05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4996	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1844	WindowsUpdate.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsUpdate.exe"	d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000700000001725d-44.dat	suspicious_telegram_bot

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4232	sc.exe
3096	sc.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5500	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeBackupPrivilege	3928	vssvc.exe
Token: SeRestorePrivilege	3928	vssvc.exe
Token: SeAuditPrivilege	3928	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4996	powershell.exe
Token: SeSecurityPrivilege	4996	powershell.exe
Token: SeTakeOwnershipPrivilege	4996	powershell.exe
Token: SeLoadDriverPrivilege	4996	powershell.exe
Token: SeSystemProfilePrivilege	4996	powershell.exe
Token: SeSystemtimePrivilege	4996	powershell.exe
Token: SeProfSingleProcessPrivilege	4996	powershell.exe
Token: SeIncBasePriorityPrivilege	4996	powershell.exe
Token: SeCreatePagefilePrivilege	4996	powershell.exe
Token: SeBackupPrivilege	4996	powershell.exe
Token: SeRestorePrivilege	4996	powershell.exe
Token: SeShutdownPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeSystemEnvironmentPrivilege	4996	powershell.exe
Token: SeRemoteShutdownPrivilege	4996	powershell.exe
Token: SeUndockPrivilege	4996	powershell.exe
Token: SeManageVolumePrivilege	4996	powershell.exe
Token: 33	4996	powershell.exe
Token: 34	4996	powershell.exe
Token: 35	4996	powershell.exe
Token: 36	4996	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4996	4556	d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe	88
PID 4556 wrote to memory of 3096	4556	d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe	89
PID 4556 wrote to memory of 4232	4556	d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe	91
PID 4556 wrote to memory of 5500	4556	d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe
"C:\Users\Admin\AppData\Local\Temp\d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\SYSTEM32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:3096
- C:\Windows\SYSTEM32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4232
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe"
1⤵
- Executes dropped EXE
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe
Size 310KB
SHA256 d2cb6bf9fcd9004f0925fef6fb2c02435236d690f857fabe2903946a01ce4704
MD5 19b830a02f84cb5e6d94d3855bb92d86
SHA1 b9da8d818cba9a0c61e1ea6a477511607e7812a8
SHA512 64fec1e9f5269aa09e8bab389d6e0acd93e7dbe8707ac0177052bd3383eabe134cf1229736e119d0b10aa0c2284457555df5e9a1302cea6f22d64ebccc5e8115
SSDEEP 6144:47WyGmQE/fMbr809X3vESjkvF3g9Uupt:47WUkV9X3vESjDm
TLSH
T158647D19F7A510F9E5B78679CD438906E7727C464760E78F23A04AA63F332A05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4996-42-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-43-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-34-0x00000229FBA40000-0x00000229FBA62000-memory.dmp

Download

memory/4996-29-0x00007FF91322F000-0x00007FF913230000-memory.dmp

Download

memory/4996-36-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-37-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-38-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-39-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-33-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-40-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-35-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-30-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-48-0x00000229FBD60000-0x00000229FBE12000-memory.dmp

Download

memory/4996-47-0x00000229FBB00000-0x00000229FBB1E000-memory.dmp

Download

memory/4996-49-0x00000229FBB20000-0x00000229FBB2A000-memory.dmp

Download

memory/4996-41-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-51-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-52-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download

memory/4996-53-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp

Download