valleyrat_s2 | 0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Size 1.1MB
Sample260813-yvrxtser2v
SHA256 0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55
MD5 b144fe12ff36f576e02765e348a5c894
SHA1 078068df2405d2af406df2deb7e5fa8b688ec096
SHA512 9dc482dc3a2f21701344acd3413742f801a901913d7e0b2af2de310671532f3a6762cd446ee2a27bfcc08fc016c68d1fdf1a751a5a75bfc243f03c019e8ffa0d
SSDEEP 12288:UMhn46Yd4FxerPgETvQZKPudo2R+EA+8c7HCeSv7r8dNgt9A1UjvVQ3s0S5/gI1O:N4u/eLJPudokBA1TwS0hfmhs
TLSH
T153450624BABA816CC063F7785DEEE55FEABA7A050644A56F014513170F3ABD08B1733E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor credential_access defense_evasion evasion valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

154.12.19.70:22011
154.12.19.70:22012

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 7 IoCs

resource	yara_rule
behavioral1/memory/2192-18-0x0000022274DE0000-0x0000022274E2D000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2192-17-0x0000022274DE0000-0x0000022274E2D000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2192-16-0x0000022274DE0000-0x0000022274E2D000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2192-15-0x0000022274D90000-0x0000022274DD7000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2192-21-0x0000022274DE0000-0x0000022274E2D000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2192-22-0x0000022274DE0000-0x0000022274E2D000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2192-25-0x0000022274DE0000-0x0000022274E2D000-memory.dmp	family_valleyrat_stage_2_v2

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Modifies firewall policy service 3 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\RESTRICTEDSERVICES\STATIC\SYSTEM	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KillService\Parameters\ServiceDll = "C:\\ProgramData\\OpenraVPN\\Svchost.dll"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Executes dropped EXE 1 IoCs

pid	Process
3796	~tmp_61984.tmp

Loads dropped DLL 2 IoCs

pid	Process
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
5116	svchost.exe

Windows security modification 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirstRunDisabled = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\MpPlatformKillbitsFromEngine = 0000000000000000	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\MpCapability = 0000000000000000	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	conhost.exe
File opened (read-only)	\??\X:	conhost.exe
File opened (read-only)	\??\Z:	conhost.exe
File opened (read-only)	\??\B:	conhost.exe
File opened (read-only)	\??\M:	conhost.exe
File opened (read-only)	\??\R:	conhost.exe
File opened (read-only)	\??\V:	conhost.exe
File opened (read-only)	\??\W:	conhost.exe
File opened (read-only)	\??\E:	conhost.exe
File opened (read-only)	\??\H:	conhost.exe
File opened (read-only)	\??\I:	conhost.exe
File opened (read-only)	\??\J:	conhost.exe
File opened (read-only)	\??\L:	conhost.exe
File opened (read-only)	\??\N:	conhost.exe
File opened (read-only)	\??\P:	conhost.exe
File opened (read-only)	\??\T:	conhost.exe
File opened (read-only)	\??\K:	conhost.exe
File opened (read-only)	\??\O:	conhost.exe
File opened (read-only)	\??\Q:	conhost.exe
File opened (read-only)	\??\S:	conhost.exe
File opened (read-only)	\??\Y:	conhost.exe
File opened (read-only)	\??\G:	conhost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe
2192	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	conhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
848	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	conhost.exe
2192	conhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2192	5116	svchost.exe	89
PID 2192 wrote to memory of 4748	2192	conhost.exe	90
PID 5116 wrote to memory of 2192	5116	svchost.exe	89

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe
"C:\Users\Admin\AppData\Local\Temp\0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Server Software Component: Terminal Services DLL
- Boot or Logon Autostart Execution: LSASS Driver
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:848

C:\Users\Admin\AppData\Local\Temp\~tmp_61984.tmp
C:\Users\Admin\AppData\Local\Temp\~tmp_61984.tmp
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k KillService -s KillService
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Svchost.dll

Path C:\ProgramData\OpenraVPN\Svchost.dll
Size 422KB
SHA256 34b602d42af81c968ba9253fcfb405b8be0335a299b8fc6802fa8a9abf7938b3
MD5 ef094cd8c4dc068ed8b3e984918aded3
SHA1 e208ff9071ba094ee3b3bd4b92a3ac208524b820
SHA512 c36a07d8f8583d1bec685dd9de164836ef0037bf889d0a1aebe818db1e6f99549fef01a9afacf972962df0469f38745dcfdfa68ce8764e289af93161b737fcd2
SSDEEP 6144:oVQlJs0PTTG+9qlL5/gIx3Vx8gwR71il3iXnDZHq9LH7QyhDWgSK:oVQ3s0S5/gI1fHwRh2iXnmh3
TLSH
T13A945C45A3F400B9F0B39278CEB75906DA76BC554770E29F13A0926B1F33F919A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~tmp_61984.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tmp_61984.tmp
Size 41KB
SHA256 820f1c457d65bce3045dee53febd81af756e1684a70427a4afeb3f9e34e16ad7
MD5 9cea9e2584737c6e98ed19ec6c4dca60
SHA1 18d1978f2a7bd7fe911ae910d3328e78c9c1383e
SHA512 82f11512a4bdffe0fe2674033c2f93d76faac6b02a2899185b8b103b9444cb2cb4f0be0e3c9093bf880297e25e77eed2dc0fe9f92a52d65aafd63d6e18f25463
SSDEEP 768:Bd7JuFhej4gpHkkq9ycewnBpvwzLOdNqc8ocNe+Sci82:BLeeGnwcewnrwOWc8ocNeci82
TLSH
T1FB135B134AA918D5FB9A8EB5E075CA37DC72B6811F8095DF50B480941E22BE07F3CB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2192-8-0x0000022272320000-0x0000022272321000-memory.dmp

Download

memory/2192-9-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-10-0x0000022272520000-0x00000222725A1000-memory.dmp

Download

memory/2192-11-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-12-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-13-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-18-0x0000022274DE0000-0x0000022274E2D000-memory.dmp

Download

memory/2192-17-0x0000022274DE0000-0x0000022274E2D000-memory.dmp

Download

memory/2192-16-0x0000022274DE0000-0x0000022274E2D000-memory.dmp

Download

memory/2192-15-0x0000022274D90000-0x0000022274DD7000-memory.dmp

Download

memory/2192-14-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-21-0x0000022274DE0000-0x0000022274E2D000-memory.dmp

Download

memory/2192-22-0x0000022274DE0000-0x0000022274E2D000-memory.dmp

Download

memory/2192-23-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-24-0x0000022274B50000-0x0000022274B79000-memory.dmp

Download

memory/2192-25-0x0000022274DE0000-0x0000022274E2D000-memory.dmp

Download