c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0

Analysis

max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Size 1.9MB
Sample260426-v1rx8sc16w
SHA256 c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0
MD5 b0487bfacb148d68055aa7bbe2d0eee3
SHA1 4356dce47042e4b3bcbba456dd13e986f4f9c2e6
SHA512 4010b0ff5e674de7c3b13a537360e72821295eb4aedd2cd520733c525b9059925a0af8ea610683d4504133406d1c6c14db1366e7fdfc59cd9e0f82a71fc27957
SSDEEP 24576:FMyrv4FQ+c5IktyHa9vhwpHVCJ3taIL3OreJOw1OwJ:X4F5O9ECEIDseJOw1OwJ
TLSH
T116954B23B6457529E45ADE3A7826B2FC543F7DA06502BD0F67E0350CBE392402D2A67F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3908	powershell.exe
3304	powershell.exe
4952	powershell.exe
2464	powershell.exe
2248	powershell.exe
5048	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
2464	powershell.exe
4952	powershell.exe
2248	powershell.exe
5048	powershell.exe
4952	powershell.exe
3908	powershell.exe
3304	powershell.exe
2464	powershell.exe
2248	powershell.exe
5048	powershell.exe
3908	powershell.exe
3304	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4952	1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	79
PID 1584 wrote to memory of 2464	1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	81
PID 1584 wrote to memory of 2248	1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	83
PID 1584 wrote to memory of 5048	1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	85
PID 1584 wrote to memory of 3908	1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	87
PID 1584 wrote to memory of 3304	1584	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	89

C:\Users\Admin\AppData\Local\Temp\c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
"C:\Users\Admin\AppData\Local\Temp\c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 112cb0aed0a39b7bb04054e34724c860e49800682a838b8860ef55004dd39e4d
MD5 df1c341c284efd20827fae41d92f676c
SHA1 1633242ce4fa842a101e2ad7f4bd721d052e4a1c
SHA512 fa1978b7cd5694e90d32e3e5ead481db31b9c8454fed5689a4731be4d050f70f6f37729cd70fed0a431d1866fbc2a614a97316103f7a141b73abeb6ac5b7771c
SSDEEP 384:BL3Hht1SS1UrOng65FRHEMESHRnNvjs26tgiNry49V9JEu0iF1X:JpSSCqn3RPESfvj76tgyryyV9JEu0Q
TLSH
T17C92C5AE711F22C3C89563B8D107050FE8F2DE8D431912D9BB2E9F7B89AC95E817D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 edf022aa0ec18f81f53c86b31c03025d8b0fc6bceec1810347a58a4eda07c048
MD5 27849ba42e725b8e37ba520faf1c18ce
SHA1 ed11b5ec93e5e8c119ba0143dabf4e8401a3835b
SHA512 b0fa6a1d2704d8e2e1397d55e23e5683dc4bfc3331c2958c2752b631f17c273628bf160ea3fa64b9ee19e6219f3a8e04b7fc244edfa25b1337ce42c3e1f6e427
SSDEEP 384:gL3Hht1SS1UXCSgoOFRHEMEjMHnnN/js26tguNrC2L9B9Jsu0iFpX:GpSSCS6eRPEj4N/j76tg2rCeB9Jsu0M
TLSH
T12F92D4AE711F22C3C89563B8D107050FE8F2DE8D431A13D9BB2E9E7B89AC55E817D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 9ee5bc3cf865c33d9b7c7ca14f20db43b1b847c920e6707821e24480c84a98cc
MD5 583ae36d1de7404f8aa0648a92287584
SHA1 4f6f142e239ae24b55e6b59b9d1538c987f56588
SHA512 88372f810fe6e3c5a997d202bdc4522c67bdc95e7b8ce169a8e0f87e2576036aacb5b2ec215344e48aadceea21aad11fb30fb65fa4642e69db6a7a64141081b7
SSDEEP 384:+THht1SS1UIikZFqFRHEMEF5Hn3N3js26tg2Nri2L949J8X0iFBX:ySSCItvqRPEv93j76tg+rie49J8X0U
TLSH
T18E92B4AE711F22C3C89553B8E10B050FE8F2DE8D431913D9B72A9F7B89AC95E813D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 196235afc0ac4678b840e7568e24de0b4a5f36e89e8581ccd4f3e1cf2671025a
MD5 78428621318f9c2583554fd663f070de
SHA1 4fc60d5cf60af0182081a9a3441091e9a09b6959
SHA512 582b5f59f54a381eab3def01354b7be77a6e27bdf52ce56cb9a04562afbab01494248c417e11509ce47744eb46320cf87f463d65852b50d7b241b1ee93a6ca84
SSDEEP 384:gTHht12S1UeJtP6FRHEMElHjq+qaN/js26tguNrC2L9M9JsX0iFpX:42SCS56RPEpjJ9/j76tg2rCeM9JsX0M
TLSH
T13692C5AE711F22C3C89553B8D107050FE8F2DE8D431A52D8BB2E9F7B8AAC95E413D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4rdlnxag.crb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4rdlnxag.crb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-140-0x0000000000BC0000-0x0000000000DB6000-memory.dmp

Download

memory/1584-119-0x0000000000BC0000-0x0000000000DB6000-memory.dmp

Download

memory/2248-101-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

Download

memory/2248-65-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download

memory/2248-100-0x0000000007AC0000-0x0000000007AD5000-memory.dmp

Download

memory/2248-5-0x00000000050B0000-0x00000000050C0000-memory.dmp

Download

memory/2464-7-0x0000000005310000-0x0000000005376000-memory.dmp

Download

memory/2464-56-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download

memory/2464-8-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/2464-107-0x00000000027D0000-0x00000000027E0000-memory.dmp

Download

memory/2464-102-0x00000000027D0000-0x00000000027E0000-memory.dmp

Download

memory/2464-15-0x0000000005B40000-0x0000000005E97000-memory.dmp

Download

memory/2464-82-0x0000000007600000-0x0000000007696000-memory.dmp

Download

memory/2464-2-0x00000000027D0000-0x00000000027E0000-memory.dmp

Download

memory/3304-91-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download

memory/3908-84-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download

memory/4952-57-0x0000000006630000-0x000000000664E000-memory.dmp

Download

memory/4952-58-0x00000000072C0000-0x0000000007364000-memory.dmp

Download

memory/4952-83-0x0000000007630000-0x0000000007641000-memory.dmp

Download

memory/4952-74-0x0000000007490000-0x000000000749A000-memory.dmp

Download

memory/4952-73-0x0000000007420000-0x000000000743A000-memory.dmp

Download

memory/4952-98-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Download

memory/4952-99-0x0000000007660000-0x000000000766E000-memory.dmp

Download

memory/4952-66-0x0000000007A60000-0x00000000080DA000-memory.dmp

Download

memory/4952-0-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Download

memory/4952-1-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download

memory/4952-103-0x0000000007760000-0x0000000007768000-memory.dmp

Download

memory/4952-106-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Download

memory/4952-48-0x00000000066B0000-0x00000000066E4000-memory.dmp

Download

memory/4952-49-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download

memory/4952-41-0x0000000006650000-0x000000000669C000-memory.dmp

Download

memory/4952-40-0x00000000060D0000-0x00000000060EE000-memory.dmp

Download

memory/4952-4-0x0000000005370000-0x000000000599A000-memory.dmp

Download

memory/4952-3-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Download

memory/4952-6-0x0000000005230000-0x0000000005252000-memory.dmp

Download

memory/5048-75-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download