dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418

Analysis

user interaction
yes
max time kernel
131s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GuardianAngel.exe
Size 2.6MB
Sample260420-mk2thabz31
SHA256 dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418
MD5 e3622b8b4715286bc5dfae52e2ca94c7
SHA1 21d337a37000b058df340ad63252319b3a0f68df
SHA512 8a46bbb153b4628f5b77cd48369910d8c5fe039727ad7a8c64c0ee487bf476ac7c65c33d2a6ed7131382449fbaee4525e39fe70f6726c4270a3370d3ea22bba1
SSDEEP 49152:I1AI/mkgCL3LGnpsx3f9tANoOwfzRe/xn9+JqmIjsOAKxFqhb1icLJSj0RBYhRYB:IayGuANoOwfzRe/f9FaRicLJ
TLSH
T195D5BF5AA3B400D8C577C079CA4BA617E772704D13B197DF22E48AA52F63BE14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2840	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1248	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
2008	GuardianAngel.exe
1516	GuardianAngel.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2116	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	powershell.exe
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2008	GuardianAngel.exe
2008	GuardianAngel.exe
1516	GuardianAngel.exe
1516	GuardianAngel.exe
1516	GuardianAngel.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4468	3432	GuardianAngel.exe	86
PID 4468 wrote to memory of 4268	4468	cmd.exe	88
PID 4468 wrote to memory of 644	4468	cmd.exe	89
PID 4468 wrote to memory of 1248	4468	cmd.exe	90
PID 4468 wrote to memory of 2840	4468	cmd.exe	91
PID 3432 wrote to memory of 2008	3432	GuardianAngel.exe	92
PID 2008 wrote to memory of 3236	2008	GuardianAngel.exe	93
PID 3236 wrote to memory of 2116	3236	cmd.exe	95
PID 3236 wrote to memory of 4208	3236	cmd.exe	96
PID 3236 wrote to memory of 1728	3236	cmd.exe	97

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1248	attrib.exe

C:\Users\Admin\AppData\Local\Temp\GuardianAngel.exe
"C:\Users\Admin\AppData\Local\Temp\GuardianAngel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo d | xcopy "C:\Users\Admin\AppData\Local\Temp" "C:\GuardianAngel\" /Y && attrib +s +h "C:\GuardianAngel" && "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath \"C:\GuardianAngel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo d "
    3⤵
    PID:4268
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp" "C:\GuardianAngel\" /Y
    3⤵
    PID:644
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\GuardianAngel"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1248
- - C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath \"C:\GuardianAngel\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\GuardianAngel\GuardianAngel.exe
  C:\GuardianAngel\GuardianAngel.exe -r "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c TIMEOUT /T 2 /NOBREAK > NUL && echo y | rmdir /S "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /T 2 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:2116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y "
      4⤵
      PID:4208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" rmdir /S "C:\Users\Admin\AppData\Local\Temp""
      4⤵
      PID:1728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4812

C:\GuardianAngel\GuardianAngel.exe
"C:\GuardianAngel\GuardianAngel.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22848e96-5fd9-40b0-bcde-17d086f1ff3c.tmp

Path C:\GuardianAngel\22848e96-5fd9-40b0-bcde-17d086f1ff3c.tmp
Size 145KB
SHA256 88fd3339202fdf79ed79bfe483fcc57f322156f40cd75c47ee78efc5b203893a
MD5 fabbe8fb069e32ff7d1048cdd8871e5e
SHA1 d065636701c0c71037f44df340f4fa10c32e5ace
SHA512 8e0dc40c6afdf5bf250da1d401d9abcaf06db0577e0ad3b0ba15adc1600433dd5c354fcf54806554cfde8c1872d6a066c17313cc6da273c7b6e6b1d9d7e6d270
SSDEEP 3072:f1/GuTrhcnKXFmnvTtb44wLWklhluSMCRqVph3Wvlf9XXo:9/p5OKXcnJc4MrHRCpQVXXo
TLSH
T151E3D06C6FEACC26D51754797E54F0CBDB064F2F460A672F210A841C9A70A8D0BE19FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuardianAngel.exe

Path C:\GuardianAngel\GuardianAngel.exe
Size 2.6MB
SHA256 dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418
MD5 e3622b8b4715286bc5dfae52e2ca94c7
SHA1 21d337a37000b058df340ad63252319b3a0f68df
SHA512 8a46bbb153b4628f5b77cd48369910d8c5fe039727ad7a8c64c0ee487bf476ac7c65c33d2a6ed7131382449fbaee4525e39fe70f6726c4270a3370d3ea22bba1
SSDEEP 49152:I1AI/mkgCL3LGnpsx3f9tANoOwfzRe/xn9+JqmIjsOAKxFqhb1icLJSj0RBYhRYB:IayGuANoOwfzRe/f9FaRicLJ
TLSH
T195D5BF5AA3B400D8C577C079CA4BA617E772704D13B197DF22E48AA52F63BE14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eace2f37-8e7b-4901-ac56-86e2f8ba919d.tmp

Path C:\GuardianAngel\eace2f37-8e7b-4901-ac56-86e2f8ba919d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i.log

Path C:\GuardianAngel\i.log
Size 523B
SHA256 c2a2cd007bed3ba124acb66a7ee8c26285954a638f86f902de22ab30636a34dc
MD5 ffd49318f641866444cb6e52205a07aa
SHA1 52822d3de36bf1b2c30a726749e5cb8abb96658f
SHA512 d5ec274b6f09d52703a380e020ad4006414eeb6474b28b3954fb444340e6bd9be01b963d7855f2bd3d1aa14f382bd8fcfcfb7d3a0383b66dc4f50a7f2ff54310
TLSH
T16BF0B48D33F4C5FD6A69E8F47F204C488601FA8585A8E535B36CC16221290D01FC3331
MD5 SHA1 SHA512 TLSH

Submit Download

wct6617.tmp

Path C:\GuardianAngel\wct6617.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sxdspedf.yxd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxdspedf.yxd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2840-156-0x000001A6A5D10000-0x000001A6A5D20000-memory.dmp

Download

memory/2840-157-0x000001A6A5D10000-0x000001A6A5D20000-memory.dmp

Download

memory/2840-158-0x000001A6BFCC0000-0x000001A6BFCE2000-memory.dmp

Download

memory/2840-166-0x000001A6A5D10000-0x000001A6A5D20000-memory.dmp

Download

memory/2840-169-0x000001A6A5D40000-0x000001A6A5D4C000-memory.dmp

Download

memory/2840-170-0x000001A6BFBD0000-0x000001A6BFC7D000-memory.dmp

Download