Overview

overview

9

Static

static

3

no_escape_all.exe

windows10-2004-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    39s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/09/2026, 16:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    no_escape_all.exe
  • Size 231KB
  • Sample260926-tt5ebafa73
  • SHA256 d8ec1113db9b006b3604da742d0bb265c7c2f66d40c0cab026f01c7072d8f57a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
bootkitevasionexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\no_escape_all.exe
    "C:\Users\Admin\AppData\Local\Temp\no_escape_all.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\system32\ReAgentc.exe
        reagentc /disable
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:3532
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reagentc /enable 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:992
      • C:\Windows\system32\ReAgentc.exe
        reagentc /enable
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:3868
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3632
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1804
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} nx AlwaysOff 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} nx AlwaysOff
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4788
    • C:\Windows\SYSTEM32\mspaint.exe
      mspaint.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4340
    • C:\Windows\SYSTEM32\mspaint.exe
      mspaint.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4112
    • C:\Windows\SYSTEM32\dxdiag.exe
      dxdiag.exe
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:4236
    • C:\Windows\SYSTEM32\charmap.exe
      charmap.exe
      2⤵
        PID:2420
      • C:\Windows\SYSTEM32\sigverif.exe
        sigverif.exe
        2⤵
          PID:3868
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
        1⤵
          PID:1748

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              boot.sdi
              • Path C:\Recovery\WindowsRE\boot.sdi
              • Size 3.0MB
              • SHA256 cd2c00ce027687ce4a8bdc967f26a8ab82f651c9becd703658ba282ec49702bd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReAgent.log
              • Path C:\Windows\Logs\ReAgent\ReAgent.log
              • Size 2KB
              • SHA256 26089240e4fa95c32095d5fc23461e622ad270362b18be731efef77ddc8da96a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              diagerr.xml
              • Path C:\Windows\Panther\UnattendGC\diagerr.xml
              • Size 11KB
              • SHA256 ece65f8c300d778f7b3e5200828321306727fa9ca7658dfcef6f8169ee53654f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              diagwrn.xml
              • Path C:\Windows\Panther\UnattendGC\diagwrn.xml
              • Size 12KB
              • SHA256 c6fd761d604928a4c70de78a17fa21f4f27ed4b6a90b767487448b43c58cebb0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReAgent.xml
              • Path C:\Windows\System32\Recovery\ReAgent.xml
              • Size 1KB
              • SHA256 fc6ecf3fe340e5df0ebfb3187d7f9a038f91630ccec93154a061e01e1481e397
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ReAgent.xml
              • Path C:\Windows\system32\Recovery\ReAgent.xml
              • Size 1KB
              • SHA256 894ee2b19608d10df4bf8b8f5bbcf40ce38c09c1f4c5543b6164f40c04bb270d
              • MD5 SHA1 SHA512 TLSH
              Submit Download