f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e

Analysis

max time kernel
39s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
Size 7.8MB
Sample260510-b9ngmags21
SHA256 f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e
MD5 98f592617fda0e116aba0bc467af5990
SHA1 3db2fae89cf94e46a891189dd46625edff70398d
SHA512 7679ae58ac047dbcdc3b55c001f47faa4f5c6f463c8bb149bbcb4d26740216d01e5ddbf653170bc62330645cb3e7109c2bfba17651209a7f4798139deab4693a
SSDEEP 49152:FuG0UK/yAURCTytXTiANwSV8v2TVuzVM40+0lhFiNw4fX6MxxviYe08kzvPLOlMe:J
TLSH
T159867E4DE8E7B041AD2198C31F9EE7F1091E6316B99A1C52357C020847D58FF6F8AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
404	powershell.exe
2384	powershell.exe
2096	powershell.exe
820	powershell.exe
484	powershell.exe
3740	powershell.exe
4332	powershell.exe
4484	powershell.exe
3520	powershell.exe
2220	powershell.exe
1692	powershell.exe
3748	powershell.exe
3076	powershell.exe
2952	powershell.exe
3204	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
1440	4a1e5603.exe
4812	windows.exe
1540	windows.exe
3220	svchost.exe
4740	dllhost.exe
3712	SearchProtocolHost.exe
1464	SearchFilterHost.exe
4288	dllhost.exe

Loads dropped DLL 5 IoCs

pid	Process
1440	4a1e5603.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\windows\\windows.exe"	4a1e5603.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows\\windows.exe\""	4a1e5603.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3220	svchost.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 3220	1440	4a1e5603.exe	96
PID 3220 set thread context of 4740	3220	svchost.exe	97
PID 3220 set thread context of 3712	3220	svchost.exe	100
PID 3220 set thread context of 1464	3220	svchost.exe	101
PID 3220 set thread context of 4288	3220	svchost.exe	104

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\rt\debug.log	SearchProtocolHost.exe
File opened for modification	C:\Windows\SystemTemp\rt\debug.log	SearchFilterHost.exe
File opened for modification	C:\Windows\SystemTemp\rt\debug.log	dllhost.exe
File opened for modification	C:\Windows\SystemTemp\rt\debug.log	4a1e5603.exe
File opened for modification	C:\Windows\SystemTemp\rt\debug.log	svchost.exe
File opened for modification	C:\Windows\SystemTemp\rt\debug.log	dllhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4a1e5603.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4a1e5603.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4800	f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
4800	f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
1440	4a1e5603.exe
3076	powershell.exe
3076	powershell.exe
2952	powershell.exe
2952	powershell.exe
1692	powershell.exe
1692	powershell.exe
820	powershell.exe
820	powershell.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3204	powershell.exe
3204	powershell.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
4484	powershell.exe
4484	powershell.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe
484	powershell.exe
484	powershell.exe
3520	powershell.exe
3520	powershell.exe
404	powershell.exe
404	powershell.exe
2384	powershell.exe
2384	powershell.exe
3740	powershell.exe
3740	powershell.exe
2220	powershell.exe
2220	powershell.exe
3748	powershell.exe
3748	powershell.exe
4332	powershell.exe
4332	powershell.exe
2096	powershell.exe
2096	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
Token: SeDebugPrivilege	1440	4a1e5603.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 31	2952	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 31	2952	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 31	2952	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 31	2952	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 31	2952	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1440	3372	f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe	82
PID 1440 wrote to memory of 3076	1440	4a1e5603.exe	83
PID 1440 wrote to memory of 2952	1440	4a1e5603.exe	85
PID 1440 wrote to memory of 1692	1440	4a1e5603.exe	90
PID 1440 wrote to memory of 820	1440	4a1e5603.exe	94
PID 1440 wrote to memory of 3220	1440	4a1e5603.exe	96
PID 3220 wrote to memory of 4740	3220	svchost.exe	97
PID 3220 wrote to memory of 3204	3220	svchost.exe	98
PID 3220 wrote to memory of 3712	3220	svchost.exe	100
PID 3220 wrote to memory of 1464	3220	svchost.exe	101
PID 3220 wrote to memory of 4484	3220	svchost.exe	102
PID 3220 wrote to memory of 4288	3220	svchost.exe	104
PID 3220 wrote to memory of 484	3220	svchost.exe	105
PID 3220 wrote to memory of 3520	3220	svchost.exe	107
PID 3220 wrote to memory of 404	3220	svchost.exe	109
PID 3220 wrote to memory of 2384	3220	svchost.exe	111
PID 3220 wrote to memory of 3740	3220	svchost.exe	113
PID 3220 wrote to memory of 2220	3220	svchost.exe	115
PID 3220 wrote to memory of 3748	3220	svchost.exe	117
PID 3220 wrote to memory of 4332	3220	svchost.exe	119
PID 3220 wrote to memory of 2096	3220	svchost.exe	121

C:\Users\Admin\AppData\Local\Temp\f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
"C:\Users\Admin\AppData\Local\Temp\f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
- C:\Users\Admin\AppData\Local\Temp\f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
  C:\Users\Admin\AppData\Local\Temp\f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\4a1e5603.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\4a1e5603.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk');$s.TargetPath='C:\Users\Admin\AppData\Roaming\windows\windows.exe';$s.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(Get-ScheduledTask -TaskPath '\Microsoft\Windows\Shell\' -TaskName 'UpdateDetection' -ErrorAction SilentlyContinue).TaskName"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:1692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $folder = 'Microsoft\Windows\Shell' $leaf = 'UpdateDetection' $taskPath = '\' + $folder + '\' + $leaf $binPath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskPath ('\' + $folder + '\') -TaskName $leaf -ErrorAction SilentlyContinue if ($existing) { Unregister-ScheduledTask -TaskPath ('\' + $folder + '\') -TaskName $leaf -Confirm:$false -ErrorAction SilentlyContinue } $action = New-ScheduledTaskAction -Execute $binPath $trigger = New-ScheduledTaskTrigger -AtStartup $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) Register-ScheduledTask -TaskName $leaf -TaskPath ('\' + $folder + '\') -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force | Out-Null "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:820
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoP -W Hidden -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference='SilentlyContinue' $ns='root/subscription' $fn='windowsWF' $cn='windowsEC' Get-WmiObject -Namespace $ns -Class __EventFilter -Filter \"Name='$fn'\" | Remove-WmiObject Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter \"Name='$cn'\" | Remove-WmiObject Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like \"*$fn*\"} | Remove-WmiObject $f=Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments @{ Name='$fn' QueryLanguage='WQL' Query=\"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='windows.exe'\" EventNamespace='root\cimv2' } $c=Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments @{ Name='$cn' CommandLineTemplate='C:\\Users\\Admin\\AppData\\Roaming\\windows\\windows.exe' RunInteractively=[bool]$false } Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c} "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3204
    - - C:\Windows\system32\SearchProtocolHost.exe
        
        "C:\Windows\system32\SearchProtocolHost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3712
    - - C:\Windows\system32\SearchFilterHost.exe
        
        "C:\Windows\system32\SearchFilterHost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-ScheduledTask -TaskName 'windows' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty TaskName"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4484
    - - C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $taskName = 'windows' $exePath = 'C:\Users\Admin\AppData\Roaming\windows\windows.exe' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { exit 0 } $action = New-ScheduledTaskAction -Execute $exePath $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'CRRTOJJN\Admin' $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit ([TimeSpan]::Zero) Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2096

C:\Users\Admin\AppData\Roaming\windows\windows.exe
C:\Users\Admin\AppData\Roaming\windows\windows.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Users\Admin\AppData\Roaming\windows\windows.exe
"C:\Users\Admin\AppData\Roaming\windows\windows.exe"
1⤵
- Executes dropped EXE
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b14b48326a1201fc8b9667201c15392e52f7f5819c2aadafe19cbb72b08be51
MD5 04493ed4421328d5e40252891bfe515a
SHA1 ab8a4e3909ff849549ea989049ed30b490f274e7
SHA512 c8ca89143763a72f4ce8f10ffa2e161b59d41454bad0f71fcb4c7e9c8861a5d99bdc787907761bfb8439afad1f0557a1338bbb1054f5810de807633f515d5a76
TLSH
T1A551CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

4a1e5603.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\4a1e5603.exe
Size 6.6MB
SHA256 1b4ac1fce9381c7091ed4cfe8d8d9a4b933710a385445a9c3787da95caecb32d
MD5 b7ec370019322ed110cf2da51639eb19
SHA1 4c443dd61d12bda6f52bcd7fa910ff6fdd366ec2
SHA512 933791de15a7f0d6a6ea859e9c1e7226833e8604de308210e5654a27c6c7e7fb9367ea8bb8ee2dbaf4dd622da0b92dea813f01b264093ae08299518e892bc596
SSDEEP 49152:NtOsZlteVeq//XL4+MZUuoE6cgmZmoDWZ3Rj89jnP15WE0V7iTFcnSvk3WPKnFzW:DnB8AD0Rj89ZuElH3NSZ0
TLSH
T109666C0DA3D40AE5D527DA34CA77D633DA717C825637C20F0599E64A1F33AE18E2BA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download