a6f5cda2302f174e0790d2d31325b0a91596c10d2d9ea94504f0640bfc9053db

Analysis

max time kernel
52s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
thoukeys/thykey.exe
Size 14.6MB
Sample261113-wa7fnset2w
SHA256 a6f5cda2302f174e0790d2d31325b0a91596c10d2d9ea94504f0640bfc9053db
MD5 30e0d7006406115e990a50d20d93fa74
SHA1 02f26aabb1c36b6203ca41cb04ab4db38fca39c4
SHA512 a67cb9588a3828eb1a95daea2db70f0d0300e9eab01d9c8dc4f8de6aac28c6b41107e6ae3ee69ad8a48a8519aefe6b1711e05810af7bdb73fb8e9400a82b9672
SSDEEP 196608:vWG3xCICMdU5My34+OcgswKEu4SYdw3x2:v64+fc
TLSH
T158F68CC777275CEEC9A50374CDA723293374F844371E6F332608A6206D676D89E4AA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion execution persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	thykey.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6108	cmd.exe
3824	cmd.exe
4200	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
6056	taskkill.exe
4308	taskkill.exe
5652	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 6108	2412	thykey.exe	90
PID 6108 wrote to memory of 6056	6108	cmd.exe	92
PID 2412 wrote to memory of 3824	2412	thykey.exe	93
PID 3824 wrote to memory of 4308	3824	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\thoukeys\thykey.exe
"C:\Users\Admin\AppData\Local\Temp\thoukeys\thykey.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im svchost.exe
  2⤵
  - Executes a command shell one-liner
  PID:4200
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im svchost.exe
    3⤵
    - Kills process with taskkill
    PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-0-0x00007FF7FE200000-0x00007FF7FEEF6000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads