Overview

overview

10

Static

static

3

d9017fb9a0...c7.exe

windows10-2004-x64

10

d9017fb9a0...c7.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 10:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7.exe
  • Size 3.9MB
  • Sample260810-mdqsnafe25
  • SHA256 d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionpersistencetrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 32 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 2 IoCs

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies data under HKEY_USERS 30 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7.exe
    "C:\Users\Admin\AppData\Local\Temp\d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7.exe
      "C:\Users\Admin\AppData\Local\Temp\d9017fb9a03e7cb7eda1df21922d37e693c6d7a8261bd9757d19171778d7a2c7.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Modifies Windows Defender notification settings
      • UAC bypass
      • Windows security bypass
      • Server Software Component: Terminal Services DLL
      • Boot or Logon Autostart Execution: LSASS Driver
      • Loads dropped DLL
      • Windows security modification
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2080
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "gpupdate /force"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\system32\gpupdate.exe
          gpupdate /force
          4⤵
            PID:948
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "gpupdate /force"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\system32\gpupdate.exe
            gpupdate /force
            4⤵
              PID:2632
      • C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
        C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
        1⤵
        • Executes dropped EXE
        PID:1568
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k KillService -s KillService
        1⤵
        • Modifies Windows Defender Real-time Protection settings
        • Modifies Windows Defender TamperProtection settings
        • Modifies Windows Defender notification settings
        • Windows security bypass
        • Boot or Logon Autostart Execution: LSASS Driver
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\system32\conhost.exe
          "C:\Windows\system32\conhost.exe"
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4908
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe
            3⤵
              PID:3224
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "gpupdate /force"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\System32\gpupdate.exe
              gpupdate /force
              3⤵
                PID:1032
          • C:\Windows\TEMP\drv_BootRepair.sys
            C:\Windows\TEMP\drv_BootRepair.sys
            1⤵
            • Executes dropped EXE
            PID:4316

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                LSASS Driver

                1
                T1547.008

                Create or Modify System Process

                3
                T1543

                Windows Service

                3
                T1543.003

                Server Software Component

                1
                T1505

                Terminal Services DLL

                1
                T1505.005

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                1
                T1547

                LSASS Driver

                1
                T1547.008

                Create or Modify System Process

                3
                T1543

                Windows Service

                3
                T1543.003

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Impair Defenses

                6
                T1562

                Disable or Modify Tools

                6
                T1562.001

                Modify Registry

                7
                T1112

                Credential Access

                OS Credential Dumping

                1
                T1003

                LSASS Memory

                1
                T1003.001

                Discovery

                Query Registry

                1
                T1012

                System Information Discovery

                1
                T1082

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Svchost.dll
                • Path C:\ProgramData\OpenraVPN\Svchost.dll
                • Size 1009KB
                • SHA256 e46781237e87a1f34439b7a43c66851861a5ace05f1605447462dc00b2d42825
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                drv_BootRepair.sys
                • Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
                • Size 29KB
                • SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4908-12-0x0000021C22D60000-0x0000021C22D61000-memory.dmp
                Download