6b6e4cdcd769adc9f62ac63a599a96c373e8fc344e2e5abdb192cee7cf68b1a8

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.exe
Size 963KB
Sample260605-e2pw9sb15n
SHA256 6b6e4cdcd769adc9f62ac63a599a96c373e8fc344e2e5abdb192cee7cf68b1a8
MD5 1eb9e715a7eaad547dacc808e02df5e7
SHA1 064d2bac72a96522fbad9ad5c988a14fe7a61326
SHA512 dbe9f442426762138f9073616cc68e4df28d5663632af7a6adca61973d18667b061606ac1bf79b32837446e38a2f78e4c983fcdbc7eb1c74a6f7448450d879b2
SSDEEP 24576:drAgfhdYzX8/dbMX4+FutZbJcMFumJIUXW:qgfhdYzXAdbMXH8c
TLSH
T19D25495027FC2109F2FF4B75E4755441CFB2B5665B3AD39E299864AD0EB37808AA3323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe = "0"	Update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update = "0"	Update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\update.exe = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update = "0"	update.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2624	powershell.exe
1964	powershell.exe
3616	powershell.exe
2544	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4976	Update.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe = "0"	Update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update = "0"	Update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\update.exe = "0"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe = "0"	update.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Update\\Update.exe\""	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Update\\Update.exe\""	Update.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2624	powershell.exe
2624	powershell.exe
1964	powershell.exe
1964	powershell.exe
3616	powershell.exe
3616	powershell.exe
2544	powershell.exe
2544	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	update.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	4976	Update.exe
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 2624	3880	update.exe	82
PID 3880 wrote to memory of 1964	3880	update.exe	84
PID 4976 wrote to memory of 3616	4976	Update.exe	88
PID 4976 wrote to memory of 2544	4976	Update.exe	90

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -w h -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe','C:\Users\Admin\AppData\Roaming\Microsoft\Update','C:\Users\Admin\AppData\Local\Temp\update.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -w h -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe','C:\Users\Admin\AppData\Roaming\Microsoft\Update','C:\Users\Admin\AppData\Local\Temp\update.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -w h -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe','C:\Users\Admin\AppData\Roaming\Microsoft\Update','C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -w h -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe','C:\Users\Admin\AppData\Roaming\Microsoft\Update','C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4789c28f49d38770f44ac17ec6fd0a9311267d419a13f4b97ed6d70e38dac740
MD5 655a5a9c4481818d7932aade3aa29712
SHA1 75f8071bda0e0480feac5f60f66fc9b901dc5bff
SHA512 25f75f57c749fd72ec5837b1d1395d4e5fac6e45ebb857f43d0f92f1aeb4c3ede92db17b30373cddb2a6349a0b23e6d19f4b5d9f49474cecd0a7e6c377a296a3
TLSH
T1E6218933B7ACC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b24bfb2a6d8cd1858d14373146bd232d9bf630f5f73460729ff43b7f43ec2561
MD5 372699d7f299252ebb26d1b8ea32ec7f
SHA1 8db283c48379a11b7ebeb7b23e1b269237c19b7f
SHA512 e2330fa5fe07fcf30cf1164ae449d3f7467b5b715670b0bca017e9d9d39e7c193c5c003d45014dc0fe52ec8299e480aad725c69e387e0a4271f1f2a551109281
TLSH
T177218933B79CC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C518A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_23gmr4da.srl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_23gmr4da.srl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Update\Update.exe
Size 963KB
SHA256 6b6e4cdcd769adc9f62ac63a599a96c373e8fc344e2e5abdb192cee7cf68b1a8
MD5 1eb9e715a7eaad547dacc808e02df5e7
SHA1 064d2bac72a96522fbad9ad5c988a14fe7a61326
SHA512 dbe9f442426762138f9073616cc68e4df28d5663632af7a6adca61973d18667b061606ac1bf79b32837446e38a2f78e4c983fcdbc7eb1c74a6f7448450d879b2
SSDEEP 24576:drAgfhdYzX8/dbMX4+FutZbJcMFumJIUXW:qgfhdYzXAdbMXH8c
TLSH
T19D25495027FC2109F2FF4B75E4755441CFB2B5665B3AD39E299864AD0EB37808AA3323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-16-0x000001AD1B740000-0x000001AD1B75C000-memory.dmp

Download

memory/2624-24-0x000001AD7FEA0000-0x000001AD7FEAA000-memory.dmp

Download

memory/2624-19-0x000001AD7FFD0000-0x000001AD7FFEC000-memory.dmp

Download

memory/2624-20-0x000001AD7FE60000-0x000001AD7FE6A000-memory.dmp

Download

memory/2624-21-0x000001AD7FFF0000-0x000001AD8000A000-memory.dmp

Download

memory/2624-22-0x000001AD1B760000-0x000001AD1B768000-memory.dmp

Download

memory/2624-23-0x000001AD1B770000-0x000001AD1B776000-memory.dmp

Download

memory/2624-18-0x000001AD7FE50000-0x000001AD7FE5A000-memory.dmp

Download

memory/2624-25-0x000001AD1B7C0000-0x000001AD1B7D0000-memory.dmp

Download

memory/2624-17-0x000001AD1B9D0000-0x000001AD1BA83000-memory.dmp

Download

memory/2624-0-0x000001AD1B7C0000-0x000001AD1B7D0000-memory.dmp

Download

memory/2624-9-0x00007FF45F310000-0x00007FF45F320000-memory.dmp

Download

memory/2624-8-0x000001AD1B7C0000-0x000001AD1B7D0000-memory.dmp

Download

memory/2624-1-0x000001AD7FE70000-0x000001AD7FE92000-memory.dmp

Download

memory/3616-59-0x000001F46EF90000-0x000001F46F043000-memory.dmp

Download