dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418

Analysis

max time kernel
898s
max time network
416s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GuardianAngel.exe
Size 2.6MB
Sample260420-mk2thabz31
SHA256 dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418
MD5 e3622b8b4715286bc5dfae52e2ca94c7
SHA1 21d337a37000b058df340ad63252319b3a0f68df
SHA512 8a46bbb153b4628f5b77cd48369910d8c5fe039727ad7a8c64c0ee487bf476ac7c65c33d2a6ed7131382449fbaee4525e39fe70f6726c4270a3370d3ea22bba1
SSDEEP 49152:I1AI/mkgCL3LGnpsx3f9tANoOwfzRe/xn9+JqmIjsOAKxFqhb1icLJSj0RBYhRYB:IayGuANoOwfzRe/f9FaRicLJ
TLSH
T195D5BF5AA3B400D8C577C079CA4BA617E772704D13B197DF22E48AA52F63BE14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1452	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4716	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
1808	GuardianAngel.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2864	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1452	powershell.exe
1452	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1808	GuardianAngel.exe
1808	GuardianAngel.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3880	5020	GuardianAngel.exe	80
PID 3880 wrote to memory of 4140	3880	cmd.exe	82
PID 3880 wrote to memory of 2352	3880	cmd.exe	83
PID 3880 wrote to memory of 4716	3880	cmd.exe	84
PID 3880 wrote to memory of 1452	3880	cmd.exe	85
PID 5020 wrote to memory of 1808	5020	GuardianAngel.exe	86
PID 1808 wrote to memory of 3596	1808	GuardianAngel.exe	87
PID 3596 wrote to memory of 2864	3596	cmd.exe	89
PID 3596 wrote to memory of 2036	3596	cmd.exe	90
PID 3596 wrote to memory of 952	3596	cmd.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4716	attrib.exe

C:\Users\Admin\AppData\Local\Temp\GuardianAngel.exe
"C:\Users\Admin\AppData\Local\Temp\GuardianAngel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo d | xcopy "C:\Users\Admin\AppData\Local\Temp" "C:\GuardianAngel\" /Y && attrib +s +h "C:\GuardianAngel" && "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath \"C:\GuardianAngel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo d "
    3⤵
    PID:4140
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp" "C:\GuardianAngel\" /Y
    3⤵
    PID:2352
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\GuardianAngel"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4716
- - C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath \"C:\GuardianAngel\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- C:\GuardianAngel\GuardianAngel.exe
  C:\GuardianAngel\GuardianAngel.exe -r "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c TIMEOUT /T 2 /NOBREAK > NUL && echo y | rmdir /S "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /T 2 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:2864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y "
      4⤵
      PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" rmdir /S "C:\Users\Admin\AppData\Local\Temp""
      4⤵
      PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0cacb4b4-b3d0-4344-8f47-0d19cc475f8b.tmp

Path C:\GuardianAngel\0cacb4b4-b3d0-4344-8f47-0d19cc475f8b.tmp
Size 145KB
SHA256 88fd3339202fdf79ed79bfe483fcc57f322156f40cd75c47ee78efc5b203893a
MD5 fabbe8fb069e32ff7d1048cdd8871e5e
SHA1 d065636701c0c71037f44df340f4fa10c32e5ace
SHA512 8e0dc40c6afdf5bf250da1d401d9abcaf06db0577e0ad3b0ba15adc1600433dd5c354fcf54806554cfde8c1872d6a066c17313cc6da273c7b6e6b1d9d7e6d270
SSDEEP 3072:f1/GuTrhcnKXFmnvTtb44wLWklhluSMCRqVph3Wvlf9XXo:9/p5OKXcnJc4MrHRCpQVXXo
TLSH
T151E3D06C6FEACC26D51754797E54F0CBDB064F2F460A672F210A841C9A70A8D0BE19FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b62f597-4cd1-402a-bda7-5f006b06a268.tmp

Path C:\GuardianAngel\6b62f597-4cd1-402a-bda7-5f006b06a268.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuardianAngel.exe

Path C:\GuardianAngel\GuardianAngel.exe
Size 2.6MB
SHA256 dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418
MD5 e3622b8b4715286bc5dfae52e2ca94c7
SHA1 21d337a37000b058df340ad63252319b3a0f68df
SHA512 8a46bbb153b4628f5b77cd48369910d8c5fe039727ad7a8c64c0ee487bf476ac7c65c33d2a6ed7131382449fbaee4525e39fe70f6726c4270a3370d3ea22bba1
SSDEEP 49152:I1AI/mkgCL3LGnpsx3f9tANoOwfzRe/xn9+JqmIjsOAKxFqhb1icLJSj0RBYhRYB:IayGuANoOwfzRe/f9FaRicLJ
TLSH
T195D5BF5AA3B400D8C577C079CA4BA617E772704D13B197DF22E48AA52F63BE14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wct755E.tmp

Path C:\GuardianAngel\wct755E.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xi1dehjz.w5a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xi1dehjz.w5a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1452-155-0x000001C4D6900000-0x000001C4D691C000-memory.dmp

Download

memory/1452-157-0x000001C4D6A40000-0x000001C4D6A5A000-memory.dmp

Download

memory/1452-143-0x000001C4BD6C0000-0x000001C4BD6E2000-memory.dmp

Download

memory/1452-145-0x00007FF462B00000-0x00007FF462B10000-memory.dmp

Download

memory/1452-152-0x000001C4D6690000-0x000001C4D66AC000-memory.dmp

Download

memory/1452-153-0x000001C4D66F0000-0x000001C4D67A3000-memory.dmp

Download

memory/1452-154-0x000001C4D66B0000-0x000001C4D66BA000-memory.dmp

Download

memory/1452-135-0x000001C4D5CB0000-0x000001C4D5CC0000-memory.dmp

Download

memory/1452-156-0x000001C4D66C0000-0x000001C4D66CA000-memory.dmp

Download

memory/1452-144-0x000001C4D5CB0000-0x000001C4D5CC0000-memory.dmp

Download

memory/1452-159-0x000001C4D6A20000-0x000001C4D6A26000-memory.dmp

Download

memory/1452-160-0x000001C4D6A30000-0x000001C4D6A3A000-memory.dmp

Download

memory/1452-158-0x000001C4D66D0000-0x000001C4D66D8000-memory.dmp

Download

memory/1452-164-0x000001C4BD5E0000-0x000001C4BD5F2000-memory.dmp

Download

memory/1452-163-0x000001C4D5CC0000-0x000001C4D646E000-memory.dmp

Download

memory/1452-136-0x000001C4D5CB0000-0x000001C4D5CC0000-memory.dmp

Download

memory/1808-171-0x0000023082040000-0x00000230820E3000-memory.dmp

Download

memory/2864-169-0x0000023ABE0A0000-0x0000023ABE143000-memory.dmp

Download

memory/5020-168-0x000001EA53CB0000-0x000001EA53D53000-memory.dmp

Download