ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Size 3.9MB
Sample260815-v271vaem7v
SHA256 ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9
MD5 bd2dcc9b164eeee212736e4781cfb3e5
SHA1 681fb4bb6f4e5332c5c8ad528b9be774726877d6
SHA512 37cb86494b6ab162906e69234beedf8883e80762ce64b9dad1192bdd3c9857d11839dd33a91f2bf14bb1ef08064ac1ec8837829f8a3cf7fca3fd60f1ab2ed6e1
SSDEEP 98304:7PM0QpaVys/qHIDqBlQEn4Gv9DFn710boWjVwnu:7PXQpLHKCVZMoWjVV
TLSH
T150160242F3A681D9D06FC5B5CA11563BFB70784DC03897A797A4CEA22F23761A63D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3848	sg.tmp
5632	IFW4_BypassLauncher.exe
3384	RunAsDate.exe
2472	imagew64.exe

Loads dropped DLL 1 IoCs

pid	Process
2472	imagew64.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	imagew64.exe
File opened (read-only)	\??\F:	imagew64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	imagew64.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d00000001c48f-19.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4280	cmd.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeBackupPrivilege	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeRestorePrivilege	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: 33	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeIncBasePriorityPrivilege	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: 33	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeIncBasePriorityPrivilege	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: 33	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeIncBasePriorityPrivilege	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeRestorePrivilege	3848	sg.tmp
Token: 35	3848	sg.tmp
Token: SeSecurityPrivilege	3848	sg.tmp
Token: SeSecurityPrivilege	3848	sg.tmp
Token: 33	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeIncBasePriorityPrivilege	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
Token: SeShutdownPrivilege	2472	imagew64.exe
Token: SeCreatePagefilePrivilege	2472	imagew64.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe
5632	IFW4_BypassLauncher.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4280	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe	89
PID 4220 wrote to memory of 3848	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe	91
PID 4220 wrote to memory of 5632	4220	ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe	93
PID 5632 wrote to memory of 3384	5632	IFW4_BypassLauncher.exe	95
PID 3384 wrote to memory of 2472	3384	RunAsDate.exe	96
PID 3384 wrote to memory of 2472	3384	RunAsDate.exe	96
PID 3384 wrote to memory of 2472	3384	RunAsDate.exe	96

C:\Users\Admin\AppData\Local\Temp\ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe
"C:\Users\Admin\AppData\Local\Temp\ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\~3194855152630496618~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\ea7de42fa96ab17f4c548b6dd258d53ceb573918f4783f50da96f994abf455a9.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~4279691036801533164"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\IFW4_BypassLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\IFW4_BypassLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\RunAsDate.exe
    "C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\RunAsDate.exe" /movetime 05\01\2000 12:00:00 "C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\imagew64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\imagew64.exe
      "C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\imagew64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Suspicious use of AdjustPrivilegeToken
      PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dateinj01_64.dll

Path C:\Users\Admin\AppData\Local\Temp\dateinj01_64.dll
Size 4KB
SHA256 64ea248c7688c8dfd5f5c30a5268d874df466a4ad1ea3d2d494b4f1545c4d87a
MD5 aa2415f21ae6320d6ea2c920baafa0dd
SHA1 999cc914cb85eda1486545db72b2b4d1f393e6a3
SHA512 1af68dd535dca710596d4ddc7a4fd0c910e05e947370941f2fe04f996ba5c12e0805ee24aa815765600fa48a0a09012b39d86fc1985d01ba6b96bb81f266e487
SSDEEP 48:qP5G03VWvnzfnc0rmgwlQDK/WoKjiwoHgqppK/VmGJykDwrl:+5FFWvnrnFtwaOZzwRzVuz
TLSH
T1D491B6AFF31186EAC85E47B8CEF99D027274356983B4432F049340EACE635492F26E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~3194855152630496618~\sg.tmp
Size 1.3MB
SHA256 c56f687ae0f6d73c79b14676b18453a825de03c63b19fdce8675204ced838dc6
MD5 00510df6ea607460a2a6eca1e3c97896
SHA1 eba3c4147ce16f20f3f99e2828cc1abf411fbfae
SHA512 eed3d4eee64ac50951cd2d7979fdb4ad7ecc489caf7b1066c5782e0b02482b6e2a3f4d53cb676940b4a5c292188bb373e3486d0564c2f65c0c59fed90e24b634
SSDEEP 12288:uQ1FjWVULUZLeRjSVlPR2ggn3HHlNnP6p2legOW7q35zwzx6d9gF2Kxrz+27f9PV:LWOUVeRylPRFM/O7pC6/grzdf
TLSH
T157551A66F9748275D0B3C0BAC5D29B9AFE723085173096C70289876C3F57BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IFW.INI

Path C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\IFW.INI
Size 149B
SHA256 da71f2c3bc479cd187d85f7fdeea5a7fa72a67c43893471d24d7abe7def6777b
MD5 6c0c9cabc7a169b879d6bb3d2086c4c4
SHA1 0524ee0b6a2b0a832c4ee70c651ed9e5f9fd06df
SHA512 1a2b28f30d3b54548652792bf5374ff16d22777f3e0e66b8611ea204906db48753af15132d62b2401ab0c1a0f77f67cbd7914b0e575867ea5855e3bba2c727c4
TLSH
T112C08C1900728BB5606710A44621901860A0839F82027026182A452A86002B0D0FEA4A
MD5 SHA1 SHA512 TLSH

Submit Download

IFW4_BypassLauncher.exe

Path C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\IFW4_BypassLauncher.exe
Size 1.0MB
SHA256 0aabd325fae2e7e32601aa1cde277a79228208f870aba3db048597e23f80cad6
MD5 a5b589af9904416b7e01ce4322d4612f
SHA1 5bdd52d01dc2c95416f20bba94e43997e810fdcc
SHA512 edceec8c04dec673dbebd7c90fc5e027d1fd9a4caf2374987b974ea15057f8290b077ed726ccf06d76a790000f916fb15ebff498fbaacb7fba87e9587441b421
SSDEEP 24576:7CZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrVUAu:c1H4jR2TYrQbDTrSA
TLSH
T1CD357C0573B442DDFEABE1768A13C60BC7B1B8450777861F06606A766F33B712A2E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunAsDate.exe

Path C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\RunAsDate.exe
Size 99KB
SHA256 0a6696db24b9f6b6d5919b6a85574ec93e1f658299a81e3df7252ecfb824db0d
MD5 ea578b7831ff40dbd547a065382c5960
SHA1 8d772cefc50d6cdbbcfb13bb9526ef9b168fbc39
SHA512 1a93ea417652fa3b39a27e6bd773c5fd5e5c67dd908956dbe1ee43193f49d6a5c08bede512cc263890911d61c13b23b292e82648c797c5fb9a701457944f62a3
SSDEEP 3072:uS6B+TjnwdE/hs10zHve/zWezruMAzzDRf84PeaCM:uS+QWuPe/zWezruMAzzx84Z/
TLSH
T1C0A34C4A67B800D9E8BBDA31C9668A13D7F0BC514975C30F0BA0DA9F6F63760AD15723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunAsDate_lng.ini

Path C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\RunAsDate_lng.ini
Size 1KB
SHA256 2d0f11d901884ac7783e6ef3bf89290f3e3402dc10a31adc243ec41e1c9b6b5c
MD5 15deaa8a8ef7bbb0d9ac517cc5f37f7c
SHA1 2f0d12ce29f1d3bce76a4f8624cc0be9034f659c
SHA512 c0a13f05b0e8951dcf7b46eaa71957efe27835abd3b92b95cda48fe7d3af43862350d05f767bc3c7a664164094d819dfc7bf1cfe78774922ff8b0aafc85b0090
TLSH
T15E118662434E80286EAF168C17215FE86550CC64B83114AF7BA0A6CDA0805DF5AFB071
MD5 SHA1 SHA512 TLSH

Submit Download

imagew64.exe

Path C:\Users\Admin\AppData\Local\Temp\~4279691036801533164\imagew64.exe
Size 5.4MB
SHA256 6491dbe8fee57bb60359fc28e326a1faefbe8d0c59646ac99595ac8b88b0aba4
MD5 e0c5c7583f3e3d186250447f9170436e
SHA1 ffafc24aa85c1b3f7816c7c6ae03a9dfcf2857d9
SHA512 15879b1a7343238c1878fea7cb23845c7b89b3dc17e0b46ee4cc9e8f6453ef092a1313802f90b149d762e9ee09bf26e236e0fab15155a0177b2745a21b488b33
SSDEEP 98304:SyqmQ/NYqsQp0CSfh8ZdgbtUU2eSpSZsCCtRq1bqhixRYzaAIEjFcuMVB6Os:SbmQ/NYqsQp0CSfh8Zdgbtj2eSpSZsCp
TLSH
T1B8468D42F3A540E8C5678134CE9B8627E7B17C45C7249BDB12A0FF6A2F33AD1663A315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2472-28-0x00000232F4530000-0x00000232F4531000-memory.dmp

Download

memory/4220-0-0x0000000140000000-0x0000000140200000-memory.dmp

Download