878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24

Analysis

max time kernel
101s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/10/2025, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
Size 4.0MB
Sample251006-v2aeksdp61
SHA256 878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24
MD5 1581b58ff0b130d3f58b557fadbadd07
SHA1 1058643a0f5d8c74be943799eb7ef7d4d3b2617e
SHA512 8a6e17c817b4d565c6c428217922e812bdf91d429be17acd3e7dce926ad93bf2564d158f484aa05520caf3503b32c811ef31d3e37eb7ed0661c0b1c456b36b49
SSDEEP 49152:tCcd2jdWYiZlnkdcq0DXUsIJhS5J+lB/yKo3D9f5:tNnkqK+D1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5480	powershell.exe

Deletes itself 1 IoCs

pid	Process
5812	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemL_0854 = "powershell \"start \\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\\\" -WindowStyle Hidden\""	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemL_0854 = "powershell \"start \\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\\\" -WindowStyle Hidden\""	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3868	powershell.exe
3868	powershell.exe
5480	powershell.exe
5480	powershell.exe
5004	powershell.exe
5004	powershell.exe
5812	powershell.exe
5812	powershell.exe
5560	powershell.exe
5560	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 3868	5748	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	80
PID 5748 wrote to memory of 3868	5748	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	80
PID 2944 wrote to memory of 5480	2944	cmd.exe	82
PID 2944 wrote to memory of 5480	2944	cmd.exe	82
PID 5480 wrote to memory of 4892	5480	powershell.exe	83
PID 5480 wrote to memory of 4892	5480	powershell.exe	83
PID 4892 wrote to memory of 5004	4892	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	84
PID 4892 wrote to memory of 5004	4892	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	84
PID 5748 wrote to memory of 5812	5748	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	86
PID 5748 wrote to memory of 5812	5748	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	86
PID 4892 wrote to memory of 5560	4892	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	88
PID 4892 wrote to memory of 5560	4892	878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe	88

C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
"C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Start-Sleep -Seconds 3; Remove-Item -Path C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe -Force
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell "start \"C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\" -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "start \"C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe\" -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe
    "C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 3; Remove-Item -Path C:\Users\Admin\AppData\Local\Temp\878fef63424d022a5402cf2f5d5ff2742eaa220a7d6f67b009046ce72ef18e24.exe -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 91befe12bcb2b08a3f9fbc5011fdbefff45ad2121ce22dfd78f2813c5537c8b6
MD5 e16af6168de27bf36ae85012562f316e
SHA1 c7e5600fb3301195f473a985e8fcce747cce7188
SHA512 eaf2ef9b204aadb83dc4defca47097c3008443b1e02d0fae36b5f95b57249b6081d8df391459ba25152984aaae41aac32491e3851eba91e8f8a23a09c0f4023e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 79a6d73147ba4039f55774cdd892dd3fa4ee3df57a747815f11decece5779af7
MD5 ce1f4b9a534e330e641f38239a1bc511
SHA1 ae4e9466f9ed12f18f62e86d2b1e9b827dc5a116
SHA512 2fa00792b3a3ce4a65cce066e6a6a014a0675fc7bbab38151b726652352ed124e4a552bb7ea8839f367389012266900c410211fa1471093a3452a6aa48b00ecd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zs3lnvig.hsn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zs3lnvig.hsn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3868-31-0x000001FB5D7F0000-0x000001FB5D836000-memory.dmp

Download

memory/3868-19-0x000001FB5D3D0000-0x000001FB5D3F2000-memory.dmp

Download

memory/3868-12-0x000001FB5D2C0000-0x000001FB5D2D0000-memory.dmp

Download

memory/3868-13-0x000001FB5D2C0000-0x000001FB5D2D0000-memory.dmp

Download

memory/4892-38-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/4892-40-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/4892-65-0x0000000000400000-0x000000000081B000-memory.dmp

Download

memory/4892-39-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/4892-41-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/5748-9-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/5748-0-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/5748-11-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/5748-53-0x0000000002B40000-0x0000000002BB1000-memory.dmp

Download

memory/5748-52-0x0000000000400000-0x000000000081B000-memory.dmp

Download

memory/5748-10-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/5748-8-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/5748-2-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/5748-1-0x0000000002B40000-0x0000000002BB1000-memory.dmp

Download