valleyrat_s2 | ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Size 3.8MB
Sample260810-vlnl9stdmb
SHA256 ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1
MD5 85143917eaa42805d666a2e56cfbd8c2
SHA1 ff53fa6fb7ee5b59f49817ba6f5fe80c98b5090c
SHA512 ecf475c3879d702b3e0221defabdc8f1c6e51336395e71004f08b8ae668328c39dc684dbe7b47d2efd7c65c154ac833a28d9eaa3553ee293178b082300ecbc05
SSDEEP 24576:9zSNEWT0gd3PZj3mj1P4BRcUEaOhvXIDMWle5:9zSNEWT0AP1321P4rcU9OXIoW4
TLSH
T1FA16AD24BDBA811DD027FFB83DECF99EE9EB66191506646B001703478626AC0CF4B5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor credential_access defense_evasion evasion execution valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

154.12.19.70:22011
154.12.19.70:22012

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/3848-18-0x000001937BF60000-0x000001937BFAD000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/3848-19-0x000001937BF60000-0x000001937BFAD000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/3848-23-0x000001937BF60000-0x000001937BFAD000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/3848-22-0x000001937BF60000-0x000001937BFAD000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/3848-26-0x000001937BF60000-0x000001937BFAD000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/3848-42-0x000001937BF60000-0x000001937BFAD000-memory.dmp	family_valleyrat_stage_2_v2

Modifies Windows Defender Real-time Protection settings 3 TTPs 32 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	svchost.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	svchost.exe

Modifies Windows Defender notification settings 3 TTPs 6 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Modifies firewall policy service 3 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\RESTRICTEDSERVICES\STATIC\SYSTEM	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KillService\Parameters\ServiceDll = "C:\\ProgramData\\OpenraVPN\\Svchost.dll"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 2 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
2532	~tmp_93408.tmp
1392	~tmp_79775.tmp
4432	drv_BootRepair.sys

Loads dropped DLL 2 IoCs

pid	Process
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
552	svchost.exe

Windows security modification 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\MpPlatformKillbitsFromEngine = 0000000000000000	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\MpCapability = 0000000000000000	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	conhost.exe
File opened (read-only)	\??\B:	conhost.exe
File opened (read-only)	\??\R:	conhost.exe
File opened (read-only)	\??\E:	conhost.exe
File opened (read-only)	\??\G:	conhost.exe
File opened (read-only)	\??\K:	conhost.exe
File opened (read-only)	\??\L:	conhost.exe
File opened (read-only)	\??\M:	conhost.exe
File opened (read-only)	\??\N:	conhost.exe
File opened (read-only)	\??\V:	conhost.exe
File opened (read-only)	\??\W:	conhost.exe
File opened (read-only)	\??\J:	conhost.exe
File opened (read-only)	\??\O:	conhost.exe
File opened (read-only)	\??\S:	conhost.exe
File opened (read-only)	\??\Z:	conhost.exe
File opened (read-only)	\??\H:	conhost.exe
File opened (read-only)	\??\I:	conhost.exe
File opened (read-only)	\??\P:	conhost.exe
File opened (read-only)	\??\Q:	conhost.exe
File opened (read-only)	\??\T:	conhost.exe
File opened (read-only)	\??\U:	conhost.exe
File opened (read-only)	\??\X:	conhost.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3812	cmd.exe
4300	cmd.exe
4944	cmd.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\PreventOverride = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenEnabled\ = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings	svchost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe
552	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3848	conhost.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3848	conhost.exe
3848	conhost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3812	4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe	86
PID 3812 wrote to memory of 3772	3812	cmd.exe	89
PID 4508 wrote to memory of 4300	4508	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe	93
PID 4300 wrote to memory of 2232	4300	cmd.exe	95
PID 552 wrote to memory of 3848	552	svchost.exe	111
PID 3848 wrote to memory of 3988	3848	conhost.exe	112
PID 552 wrote to memory of 3848	552	svchost.exe	111
PID 552 wrote to memory of 4944	552	svchost.exe	113
PID 4944 wrote to memory of 892	4944	cmd.exe	115

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe
"C:\Users\Admin\AppData\Local\Temp\ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Server Software Component: Terminal Services DLL
- Boot or Logon Autostart Execution: LSASS Driver
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "gpupdate /force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\gpupdate.exe
    gpupdate /force
    3⤵
    PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "gpupdate /force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\gpupdate.exe
    gpupdate /force
    3⤵
    PID:2232

C:\Users\Admin\AppData\Local\Temp\~tmp_93408.tmp
C:\Users\Admin\AppData\Local\Temp\~tmp_93408.tmp
1⤵
- Executes dropped EXE
PID:2532

C:\Users\Admin\AppData\Local\Temp\~tmp_79775.tmp
C:\Users\Admin\AppData\Local\Temp\~tmp_79775.tmp
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k KillService -s KillService
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Boot or Logon Autostart Execution: LSASS Driver
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  cmd.exe /c "gpupdate /force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\gpupdate.exe
    gpupdate /force
    3⤵
    PID:892

C:\Windows\TEMP\drv_BootRepair.sys
C:\Windows\TEMP\drv_BootRepair.sys
1⤵
- Executes dropped EXE
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Svchost.dll

Path C:\ProgramData\OpenraVPN\Svchost.dll
Size 1007KB
SHA256 9307331912424541feccdc8b347f17d68d3478d6413905b382d3024fb3eddaf4
MD5 b0cec4666c48eff28366ed97a7247737
SHA1 5616eaf242e0030cced1f7735aec28d92f54d6de
SHA512 17a2bb5969d600dea0196fc2abd6be40d284b0c0f846b5708e502fef85ef43cb7d127a18c4ffb418bcc6a0043ad12e3d5b3914978a632e1c4aa426172a85855a
SSDEEP 12288:C15B4BXBcUsK1o/9Nn7IORfoE+W5NzUzv3IgNaSWYdU4881GNT0Qkb3NnX+S7m8m:C1P4BRcUEaOhvXIDM
TLSH
T193258324B9BA812DD037FFB83EDDF49EECAB36151545A46B0041034B8A26AD0DF5B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~tmp_79775.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tmp_79775.tmp
Size 29KB
SHA256 d25e2d524c5abf1de38bd286117f79d4c9a36a020efb3faa6de0ce42a5274eef
MD5 dc4059ec07ab8262c70f62a017e07d46
SHA1 e6efa71bf798cd565a4091abf9c3c0f733c86c66
SHA512 b08b001de1baf3f3bdf8dbf2bffa21511d371d219ce896f0fcda6edb814c85c672caf81071f6dca5ac0b38e7fed069dc168838ca42b1922d2678c7bed19a8e9f
SSDEEP 384:qrTrGpbobrvD/aLczwnBMkRJwCTVmL4nNy4bRN9McUPocTUHeMcCd+SclU1AVhTj:q7iOyczwnBpvwzLOdNqc8ocNe+ScH8y
TLSH
T179D228A3461C6885FD9BAE78D0A5D92BDD74B3911FC465CB207180A41F12BD07F3E68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~tmp_93408.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tmp_93408.tmp
Size 265KB
SHA256 84e3cd38f23376851e5b1b083e869bf3fe50513d13c75e6a8c42b6447d6e1051
MD5 f2b451182161ece2ed3c1e8b5f7d232e
SHA1 e5a47ecbcf7803cc8ce875d8599e9885993a12c4
SHA512 c240673775370f94a11fe95801e3c4b44bdd1df541bcbcbd5a4482b1029545a30eee99a21d0dca606d92a32dba66ac4c050c8d375dc83fa86bfc5543769c5eca
SSDEEP 6144:jcJCXQUsJhlk4Fw7NzzdqrnHWWJPzzeecqySUFk0r5Bz:Bik8w+JP/e9qy//z
TLSH
T117440146052858D2FD876E70C064E95F5DB2FB522FD18DCB41BAC0789E827E06E7C89B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drv_BootRepair.sys

Path C:\Windows\Temp\drv_BootRepair.sys
Size 29KB
SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
MD5 82699276b0f59a2304120a6baaf64a6b
SHA1 87903559afa09a0dfe251598c14e58124bddde1d
SHA512 a06b1bc82fffeb75ad5498ad8edb859ceb4cacd0d9f7cbe2d260b0c881fa9ef33d0389e6aa9f64fe4b8c3003423b1c71413ce5e1183a1e2b68ad5f528c9d7e5c
SSDEEP 384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2
TLSH
T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-17-0x000001937BCB0000-0x000001937BCD9000-memory.dmp

Download

memory/3848-23-0x000001937BF60000-0x000001937BFAD000-memory.dmp

Download

memory/3848-15-0x000001937BCB0000-0x000001937BCD9000-memory.dmp

Download

memory/3848-16-0x000001937BCB0000-0x000001937BCD9000-memory.dmp

Download

memory/3848-13-0x0000019377AD0000-0x0000019377AD1000-memory.dmp

Download

memory/3848-18-0x000001937BF60000-0x000001937BFAD000-memory.dmp

Download

memory/3848-19-0x000001937BF60000-0x000001937BFAD000-memory.dmp

Download

memory/3848-14-0x000001937BCB0000-0x000001937BCD9000-memory.dmp

Download

memory/3848-22-0x000001937BF60000-0x000001937BFAD000-memory.dmp

Download

memory/3848-24-0x000001937BCB0000-0x000001937BCD9000-memory.dmp

Download

memory/3848-25-0x000001937BCB0000-0x000001937BCD9000-memory.dmp

Download

memory/3848-26-0x000001937BF60000-0x000001937BFAD000-memory.dmp

Download

memory/3848-27-0x0000000180000000-0x0000000180076000-memory.dmp

Download

memory/3848-42-0x000001937BF60000-0x000001937BFAD000-memory.dmp

Download