2bc85e540a631cf84d9ca8265ffbd41512568315e45bd7d9faa54c38b6e8b82f

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Զȵ/wifi.exe
Size 333KB
Sample260601-phbkmsdv5l
SHA256 2bc85e540a631cf84d9ca8265ffbd41512568315e45bd7d9faa54c38b6e8b82f
MD5 6234394b13ef7ac8dbcc749f8c4286ae
SHA1 54cb403245b11ac6cba7cbae2b27c2d73fa7977c
SHA512 7a1d5087082740028d7d2f7f396bb6663d64a69b8bec88b96ad0d9c7ca5349800457db9d35a06c82cfb284af39dc99f5939a2c47c897e017721714e45f83bf0c
SSDEEP 6144:AoTf1YKSP3zJI2c0ROBSs5X4/eGb7cHdS4nAXlgtDit:AoTfx+l1c0ROBSaX/VS
TLSH
T19D74E5C6F45042E2EC294A75D19A7CB00947BE3EDB6D8CCB32C8F69235A30E345B595B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4968	powershell.exe
4924	powershell.exe
3972	powershell.exe
4880	powershell.exe
5232	powershell.exe
2332	powershell.exe
5276	powershell.exe
3348	powershell.exe
2468	powershell.exe
1040	powershell.exe
2036	powershell.exe
2524	powershell.exe
1692	powershell.exe
5040	powershell.exe
4660	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wifi.exe

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
4128	timeout.exe
4684	timeout.exe
3964	timeout.exe
2308	timeout.exe
2196	timeout.exe
5876	timeout.exe
5604	timeout.exe
2796	timeout.exe
5464	timeout.exe
1516	timeout.exe
4400	timeout.exe
1876	timeout.exe
1100	timeout.exe
2176	timeout.exe
652	timeout.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2468	powershell.exe
2468	powershell.exe
4880	powershell.exe
4880	powershell.exe
5232	powershell.exe
5232	powershell.exe
1040	powershell.exe
1040	powershell.exe
3348	powershell.exe
3348	powershell.exe
1692	powershell.exe
1692	powershell.exe
2036	powershell.exe
2036	powershell.exe
2332	powershell.exe
2332	powershell.exe
5040	powershell.exe
5040	powershell.exe
4660	powershell.exe
4660	powershell.exe
4968	powershell.exe
4968	powershell.exe
4924	powershell.exe
4924	powershell.exe
5276	powershell.exe
5276	powershell.exe
3972	powershell.exe
3972	powershell.exe
2524	powershell.exe
2524	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4620	3612	wifi.exe	80
PID 4620 wrote to memory of 2468	4620	cmd.exe	82
PID 4620 wrote to memory of 3964	4620	cmd.exe	83
PID 4620 wrote to memory of 4880	4620	cmd.exe	84
PID 4620 wrote to memory of 2796	4620	cmd.exe	85
PID 4620 wrote to memory of 5232	4620	cmd.exe	86
PID 4620 wrote to memory of 5464	4620	cmd.exe	87
PID 4620 wrote to memory of 1040	4620	cmd.exe	88
PID 4620 wrote to memory of 2176	4620	cmd.exe	89
PID 4620 wrote to memory of 3348	4620	cmd.exe	90
PID 4620 wrote to memory of 2308	4620	cmd.exe	91
PID 4620 wrote to memory of 1692	4620	cmd.exe	92
PID 4620 wrote to memory of 1516	4620	cmd.exe	93
PID 4620 wrote to memory of 2036	4620	cmd.exe	94
PID 4620 wrote to memory of 4400	4620	cmd.exe	95
PID 4620 wrote to memory of 2332	4620	cmd.exe	96
PID 4620 wrote to memory of 2196	4620	cmd.exe	97
PID 4620 wrote to memory of 5040	4620	cmd.exe	98
PID 4620 wrote to memory of 1876	4620	cmd.exe	99
PID 4620 wrote to memory of 4660	4620	cmd.exe	100
PID 4620 wrote to memory of 4128	4620	cmd.exe	101
PID 4620 wrote to memory of 4968	4620	cmd.exe	102
PID 4620 wrote to memory of 4684	4620	cmd.exe	103
PID 4620 wrote to memory of 4924	4620	cmd.exe	104
PID 4620 wrote to memory of 5876	4620	cmd.exe	105
PID 4620 wrote to memory of 5276	4620	cmd.exe	106
PID 4620 wrote to memory of 5604	4620	cmd.exe	107
PID 4620 wrote to memory of 3972	4620	cmd.exe	108
PID 4620 wrote to memory of 652	4620	cmd.exe	109
PID 4620 wrote to memory of 2524	4620	cmd.exe	110
PID 4620 wrote to memory of 1100	4620	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Զȵ\wifi.exe
"C:\Users\Admin\AppData\Local\Temp\Զȵ\wifi.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\48F.tmp\490.bat C:\Users\Admin\AppData\Local\Temp\??????\wifi.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5232
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\system32\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...