385ba6ebc239d76e5617be4d57c0e46cbed21a6f0dfd615d1d580793e17f9d9d

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DuckInstaller.exe
Size 9.0MB
Sample260603-zpvbfaft8m
SHA256 385ba6ebc239d76e5617be4d57c0e46cbed21a6f0dfd615d1d580793e17f9d9d
MD5 b42b7d8b95ddd82db7a196aab380ced8
SHA1 540e6de75626d65f7e70c3163f7ea902c73e9344
SHA512 aa057b445c6acb6134a1ff0ccb6e4eaba4edb853b5f0c36f5bd2e36ffb7786db66873e658aadd46d7010daae1408c1ec912e566601131ab1d48dc81afd176cad
SSDEEP 196608:uWFsTuRN2zahf1Y7EcnGf7a+JJIlAmnVTvQf2b0U:NFsTuRN2zsmEzRJJPm2eb0U
TLSH
T10C96CF227D5AC52AD5610DB0593CAB6A911C7D290B60A4C7B3CC7D2FEBF00C61636F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4136	powershell.exe
5248	powershell.exe
3788	powershell.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
3708	cmd.exe
3628	cmd.exe
2816	cmd.exe

Power Settings 1 TTPs 11 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4132	powercfg.exe
2988	powercfg.exe
752	powercfg.exe
3372	powercfg.exe
5824	powercfg.exe
5148	powercfg.exe
5740	powercfg.exe
5220	powercfg.exe
1328	powercfg.exe
3280	powercfg.exe
5064	powercfg.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3332	sc.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5980	cmd.exe
2260	net.exe
6064	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3788	powershell.exe
3788	powershell.exe
4136	powershell.exe
4136	powershell.exe
5248	powershell.exe
5248	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeShutdownPrivilege	5220	powercfg.exe
Token: SeCreatePagefilePrivilege	5220	powercfg.exe
Token: SeShutdownPrivilege	1328	powercfg.exe
Token: SeCreatePagefilePrivilege	1328	powercfg.exe
Token: SeShutdownPrivilege	5824	powercfg.exe
Token: SeCreatePagefilePrivilege	5824	powercfg.exe
Token: SeShutdownPrivilege	3280	powercfg.exe
Token: SeCreatePagefilePrivilege	3280	powercfg.exe
Token: SeShutdownPrivilege	5064	powercfg.exe
Token: SeCreatePagefilePrivilege	5064	powercfg.exe
Token: SeShutdownPrivilege	5148	powercfg.exe
Token: SeCreatePagefilePrivilege	5148	powercfg.exe
Token: SeShutdownPrivilege	4132	powercfg.exe
Token: SeCreatePagefilePrivilege	4132	powercfg.exe
Token: SeShutdownPrivilege	5740	powercfg.exe
Token: SeCreatePagefilePrivilege	5740	powercfg.exe
Token: SeShutdownPrivilege	2988	powercfg.exe
Token: SeCreatePagefilePrivilege	2988	powercfg.exe
Token: SeShutdownPrivilege	752	powercfg.exe
Token: SeCreatePagefilePrivilege	752	powercfg.exe
Token: SeShutdownPrivilege	3372	powercfg.exe
Token: SeCreatePagefilePrivilege	3372	powercfg.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4820	2484	DuckInstaller.exe	81
PID 4820 wrote to memory of 3332	4820	cmd.exe	82
PID 2484 wrote to memory of 5980	2484	DuckInstaller.exe	83
PID 5980 wrote to memory of 2260	5980	cmd.exe	84
PID 2260 wrote to memory of 6064	2260	net.exe	85
PID 2484 wrote to memory of 4304	2484	DuckInstaller.exe	86
PID 4304 wrote to memory of 4308	4304	cmd.exe	87
PID 2484 wrote to memory of 3516	2484	DuckInstaller.exe	88
PID 3516 wrote to memory of 2536	3516	cmd.exe	89
PID 2484 wrote to memory of 4440	2484	DuckInstaller.exe	90
PID 2484 wrote to memory of 5816	2484	DuckInstaller.exe	91
PID 5816 wrote to memory of 4640	5816	cmd.exe	92
PID 2484 wrote to memory of 3708	2484	DuckInstaller.exe	93
PID 3708 wrote to memory of 3788	3708	cmd.exe	94
PID 2484 wrote to memory of 3628	2484	DuckInstaller.exe	95
PID 3628 wrote to memory of 4136	3628	cmd.exe	96
PID 2484 wrote to memory of 3472	2484	DuckInstaller.exe	97
PID 3472 wrote to memory of 6136	3472	cmd.exe	98
PID 2484 wrote to memory of 2816	2484	DuckInstaller.exe	99
PID 2816 wrote to memory of 5248	2816	cmd.exe	100
PID 2484 wrote to memory of 3176	2484	DuckInstaller.exe	101
PID 3176 wrote to memory of 3988	3176	cmd.exe	102
PID 2484 wrote to memory of 5580	2484	DuckInstaller.exe	103
PID 5580 wrote to memory of 5864	5580	cmd.exe	104
PID 2484 wrote to memory of 3916	2484	DuckInstaller.exe	105
PID 3916 wrote to memory of 5284	3916	cmd.exe	106
PID 2484 wrote to memory of 5220	2484	DuckInstaller.exe	107
PID 2484 wrote to memory of 1328	2484	DuckInstaller.exe	109
PID 2484 wrote to memory of 5824	2484	DuckInstaller.exe	111
PID 2484 wrote to memory of 3280	2484	DuckInstaller.exe	113
PID 2484 wrote to memory of 5064	2484	DuckInstaller.exe	115
PID 2484 wrote to memory of 5148	2484	DuckInstaller.exe	117
PID 2484 wrote to memory of 4132	2484	DuckInstaller.exe	119
PID 2484 wrote to memory of 5740	2484	DuckInstaller.exe	121
PID 2484 wrote to memory of 2988	2484	DuckInstaller.exe	123
PID 2484 wrote to memory of 752	2484	DuckInstaller.exe	125
PID 2484 wrote to memory of 3372	2484	DuckInstaller.exe	127
PID 2484 wrote to memory of 1136	2484	DuckInstaller.exe	129

C:\Users\Admin\AppData\Local\Temp\DuckInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\DuckInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config w32time start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\sc.exe
    sc config w32time start= auto
    3⤵
    - Launches sc.exe
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start w32time
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /config /manualpeerlist:"time.cloudflare.com time.google.com time.windows.com" /syncfromflags:manual /reliable:yes /update
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\w32tm.exe
    w32tm /config /manualpeerlist:"time.cloudflare.com time.google.com time.windows.com" /syncfromflags:manual /reliable:yes /update
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\\'
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath 'C:\\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
    3⤵
    PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
    3⤵
    PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
    3⤵
    PID:5284
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5220
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_usb USBSELECTIVE SUSPEND 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_pcie ASPM 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5148
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -change -monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -change -disk-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5740
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -change -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -change -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f375e15790002f55cf477a0aeef21c3dcb9d714d33e0685d7c3cbb9a20b50bcf
MD5 bf64e9f03999c507a79940537daed4fb
SHA1 2310a640f49146e85bfe3008a91be659d5a12a8f
SHA512 fef4e65e325c653328775cd4165b96c880a810be03b16b080324a620e3fff1169bdc217df7d3a2298d6d7bada6a9a589dfec0744a27afdbd9a41958d2f5e8209
TLSH
T12D21AB33B79CC134C8C9117A108DAD01B2B5C3C7449ECE8B7BC4C518A5BF899DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pxlq24fc.h5m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxlq24fc.h5m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3788-17-0x000001F365C70000-0x000001F365C7A000-memory.dmp

Download

memory/3788-16-0x000001F365CD0000-0x000001F365CEC000-memory.dmp

Download

memory/3788-15-0x000001F365C60000-0x000001F365C6A000-memory.dmp

Download

memory/3788-18-0x000001F37F7E0000-0x000001F37F7FA000-memory.dmp

Download

memory/3788-19-0x000001F302620000-0x000001F302628000-memory.dmp

Download

memory/3788-20-0x000001F302630000-0x000001F302636000-memory.dmp

Download

memory/3788-21-0x000001F365C80000-0x000001F365C8A000-memory.dmp

Download

memory/3788-14-0x000001F302550000-0x000001F302603000-memory.dmp

Download

memory/3788-13-0x000001F302530000-0x000001F30254C000-memory.dmp

Download

memory/3788-5-0x000001F365C90000-0x000001F365CB2000-memory.dmp

Download