Overview

overview

8

Static

static

3

MelonaiumI...1).exe

windows10-2004-x64

8

MelonaiumI...1).exe

windows11-21h2-x64

8

Analysis

  • geolocation tags

    eueuropefrfrance
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-fr
  • resource tags

    arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
  • submitted
    17/05/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MelonaiumInstaller (1).exe
  • Size 46KB
  • Sample260517-vcz9pse17l
  • SHA256 d794df6633806fbadd683848ebe01cdc92ad706135dcf8ea79318bac7091c8ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MelonaiumInstaller (1).exe
    "C:\Users\Admin\AppData\Local\Temp\MelonaiumInstaller (1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5540
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5564
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 4KB
        • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 99cf1438b80924d9cfddee2c1ae8a5c2c9d328dff6cee063a6abc152c73786d6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 52191a2db3ef19e04d0bc8b40506a9025ee3908aa2e07c317b29b87175d5c05b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 cada2587aee7931f38056eb24d9fd98bf1cbfc7d0accdceb115b911367e071d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2d320a76e4755daecbc09763a4a7dbe40f286adc71cb27a168552565688895f6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 08f10e2e703ff73c2e787516078f33d525747268642324e9d9525932ceec4db4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 379725b221f4f46fd50b6cc7dfbe9b5ba0733f46d6f3d8b842803267790962a7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b24bfb2a6d8cd1858d14373146bd232d9bf630f5f73460729ff43b7f43ec2561
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e6c13f83007b09a5d5b63078e3ec24154f10583cb45934593d4ad19884a18c65
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 02d1755c4972b3d2fd058e520266fca7a8942d8ab41f4cd7f29d2b0a82248cb1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ffa435fb234d2d2e62f3e74a3fc436a886a8d9d9a76f31ec0ea3eba99cc59abb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 3a31ff8d06cfcc95f7c8a5777e480a7d6088f629b53549c9a7726e01af0180b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 37d4833f27ee0deca675f1cd0e5c546255fa6867617e1039f3ab379530b0b796
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e28151dd57dd2f286a21a96def8b660a93f787da6ad52af5048b534a14c2ab25
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 1ed62f61f0f95b146730990b47c24451b67133426378b2f10eb1a10ce4e1d655
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 f2aaec18b74edfffd64ff42ac090a56ea84259c03af23398646e1f5176beba1d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ad8886fc4ddeb30ecf1f4c8ac1f2a7534fdf950f587c819cdf8957d296f828d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2efb5c487454487fb4b7e4129bda59b44120e30fa6e8a479b8176ec4973aa6bc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 16fd6d94e0c7b32399059973de03a1dbb59b775d635e3cdbaf884aed03828607
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 601f72d67f730d4e8795bdfe14c905e104e3c307df44f63d95866ea2622eede2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_o2gcgn2w.fwj.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2gcgn2w.fwj.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3636-201-0x000001A3673B0000-0x000001A367463000-memory.dmp
        Download

        memory/3928-314-0x0000020554420000-0x00000205544D3000-memory.dmp
        Download

        memory/4968-11-0x00000162092D0000-0x00000162092E0000-memory.dmp
        Download

        memory/4968-25-0x0000016224C10000-0x0000016224C1A000-memory.dmp
        Download

        memory/4968-28-0x0000016224C50000-0x0000016224C56000-memory.dmp
        Download

        memory/4968-10-0x0000016224A80000-0x0000016224A90000-memory.dmp
        Download

        memory/4968-2-0x0000016224AF0000-0x0000016224B7A000-memory.dmp
        Download

        memory/4968-1-0x00000162092D0000-0x00000162092E0000-memory.dmp
        Download

        memory/4968-0-0x00000162092D0000-0x00000162092E0000-memory.dmp
        Download

        memory/4968-27-0x0000016224C20000-0x0000016224C28000-memory.dmp
        Download

        memory/4968-29-0x0000016224CC0000-0x0000016224CCA000-memory.dmp
        Download

        memory/4968-26-0x0000016225340000-0x000001622535A000-memory.dmp
        Download

        memory/4968-3-0x0000016224A90000-0x0000016224AB2000-memory.dmp
        Download

        memory/4968-24-0x0000016224C30000-0x0000016224C4C000-memory.dmp
        Download

        memory/4968-23-0x0000016224C60000-0x0000016224CAC000-memory.dmp
        Download

        memory/4968-22-0x0000016224C00000-0x0000016224C0A000-memory.dmp
        Download

        memory/4968-21-0x0000016224FE0000-0x0000016225093000-memory.dmp
        Download

        memory/4968-20-0x0000016224BE0000-0x0000016224BFC000-memory.dmp
        Download

        memory/4968-13-0x00007FF400770000-0x00007FF400780000-memory.dmp
        Download

        memory/4968-30-0x00000162092D0000-0x00000162092E0000-memory.dmp
        Download

        memory/4968-12-0x0000016224CD0000-0x0000016224DD2000-memory.dmp
        Download