878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24

Analysis

max time kernel
103s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2025, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
Size 4.0MB
Sample251006-v2aeksdp61
SHA256 878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24
MD5 1581b58ff0b130d3f58b557fadbadd07
SHA1 1058643a0f5d8c74be943799eb7ef7d4d3b2617e
SHA512 8a6e17c817b4d565c6c428217922e812bdf91d429be17acd3e7dce926ad93bf2564d158f484aa05520caf3503b32c811ef31d3e37eb7ed0661c0b1c456b36b49
SSDEEP 49152:tCcd2jdWYiZlnkdcq0DXUsIJhS5J+lB/yKo3D9f5:tNnkqK+D1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe

Deletes itself 1 IoCs

pid	Process
452	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemL_0854 = "powershell \"start \\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\\\" -WindowStyle Hidden\""	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemL_0854 = "powershell \"start \\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\\\" -WindowStyle Hidden\""	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4396	powershell.exe
3460	powershell.exe
4396	powershell.exe
3460	powershell.exe
3676	powershell.exe
3676	powershell.exe
452	powershell.exe
452	powershell.exe
4984	powershell.exe
4984	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4396	2096	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	85
PID 2096 wrote to memory of 4396	2096	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	85
PID 3256 wrote to memory of 3460	3256	cmd.exe	87
PID 3256 wrote to memory of 3460	3256	cmd.exe	87
PID 3460 wrote to memory of 3504	3460	powershell.exe	88
PID 3460 wrote to memory of 3504	3460	powershell.exe	88
PID 3504 wrote to memory of 3676	3504	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	89
PID 3504 wrote to memory of 3676	3504	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	89
PID 2096 wrote to memory of 452	2096	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	91
PID 2096 wrote to memory of 452	2096	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	91
PID 3504 wrote to memory of 4984	3504	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	93
PID 3504 wrote to memory of 4984	3504	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	93

C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
"C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Start-Sleep -Seconds 3; Remove-Item -Path C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe -Force
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell "start \"C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\" -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "start \"C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\" -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
    "C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 3; Remove-Item -Path C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 2beed7d012669e244f264b74fea70c5835741924316ad25a03526b5d9531b1f0
MD5 a21fbb430b38885e7f6c3ce52e646a57
SHA1 ddbf8b9320470a42ff8d658c4992db77d7bc3d67
SHA512 af7622d0b5a732a408087dccf14a0d34f500a5615b43b01b60e8ab356c52aee25ff6763da0e8546b9fda08892e42d48e0e1afcb5a180214a9e56fb56db404fc6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5ba65623b2739407ddd1fa8d75335ee54a3575893bc6a226182972c1ef881e58
MD5 04c9ebf9c23c1d4d4a08c16e20fcceed
SHA1 67044e3f04584acefef2e09c2584e22e70fc5df4
SHA512 84cf13081ef3162995557677cfdae002ab7af81cf53ca874fbb046aa26facc375f8b533e6d2899240b3bdb06d26c6b322b60c4eca9a2a9570c54ba6d0350cd69
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_cy05gic2.ydx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cy05gic2.ydx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2096-11-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2096-8-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2096-61-0x0000000002AB0000-0x0000000002B21000-memory.dmp

Download

memory/2096-9-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2096-10-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2096-0-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/2096-2-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2096-1-0x0000000002AB0000-0x0000000002B21000-memory.dmp

Download

memory/2096-60-0x0000000000400000-0x000000000081B000-memory.dmp

Download

memory/3460-39-0x0000015EBE870000-0x0000015EBEA8C000-memory.dmp

Download

memory/3460-13-0x0000015EA4290000-0x0000015EA42A0000-memory.dmp

Download

memory/3460-12-0x0000015EA4290000-0x0000015EA42A0000-memory.dmp

Download

memory/3504-44-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/3504-47-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/3504-46-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/3504-45-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/3504-75-0x0000000000400000-0x000000000081B000-memory.dmp

Download

memory/3676-64-0x0000024DCBC80000-0x0000024DCBE9C000-memory.dmp

Download

memory/4396-36-0x000001A66C980000-0x000001A66C9F6000-memory.dmp

Download

memory/4396-59-0x000001A66C150000-0x000001A66C36C000-memory.dmp

Download

memory/4396-35-0x000001A66C6B0000-0x000001A66C6F4000-memory.dmp

Download

memory/4396-34-0x000001A66C4F0000-0x000001A66C512000-memory.dmp

Download

memory/4396-15-0x000001A66A0D0000-0x000001A66A0E0000-memory.dmp

Download

memory/4396-14-0x000001A66A0D0000-0x000001A66A0E0000-memory.dmp

Download