093027c5f937fe6871992c230f5fb83791ddb4838c4a4af5c3b36d0e1d77b10e

Analysis

user interaction
yes
max time kernel
46s
max time network
48s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/06/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zbjdyaol.exe
Size 11.2MB
Sample260622-xsd3hsfz21
SHA256 093027c5f937fe6871992c230f5fb83791ddb4838c4a4af5c3b36d0e1d77b10e
MD5 f61d3285f2b6db5023f9410fe57718ad
SHA1 76c8f2116704f7777f30f0230ef616ed15a15431
SHA512 7a6ddcf9029348dce04f3b4173115d80902a8ca65c82453f4f450966958ba3921eca285008ca340dddb5ec392d5043b1fce71805c12978d234c4cf8719b83178
SSDEEP 196608:4aqFFgM4+54EO7Ryo2ykSzKL9k+6cJoNzxo91wIKe4V0HyRc9K4MVBWglkURkVuu:4aw3ARr7KL9IcJyK3Ke60SRuDMVDlkZg
TLSH
T11FC633FD72483358C41EC8749133ED44F2BA129D1AE9DABD77CA7AC06B7B900DA05B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	zbjdyaol.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6020	cmd.exe
5052	powercfg.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1940	sc.exe
5824	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
3616	taskkill.exe
5080	taskkill.exe
1644	taskkill.exe
5376	taskkill.exe
2872	taskkill.exe
4424	taskkill.exe
4188	taskkill.exe
1800	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4980	powershell.exe
4980	powershell.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe
4880	zbjdyaol.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeShutdownPrivilege	5052	powercfg.exe
Token: SeCreatePagefilePrivilege	5052	powercfg.exe
Token: SeShutdownPrivilege	5052	powercfg.exe
Token: SeCreatePagefilePrivilege	5052	powercfg.exe
Token: SeSystemEnvironmentPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 6020	4880	zbjdyaol.exe	84
PID 4880 wrote to memory of 2912	4880	zbjdyaol.exe	85
PID 2912 wrote to memory of 4980	2912	cmd.exe	86
PID 6020 wrote to memory of 5052	6020	cmd.exe	88
PID 4880 wrote to memory of 4920	4880	zbjdyaol.exe	89
PID 4880 wrote to memory of 6104	4880	zbjdyaol.exe	90
PID 4880 wrote to memory of 2556	4880	zbjdyaol.exe	91
PID 4880 wrote to memory of 3704	4880	zbjdyaol.exe	92
PID 4880 wrote to memory of 544	4880	zbjdyaol.exe	93
PID 4880 wrote to memory of 376	4880	zbjdyaol.exe	94
PID 4880 wrote to memory of 1732	4880	zbjdyaol.exe	95
PID 6104 wrote to memory of 5080	6104	cmd.exe	96
PID 1732 wrote to memory of 5384	1732	cmd.exe	97
PID 2556 wrote to memory of 1644	2556	cmd.exe	98
PID 3704 wrote to memory of 1940	3704	cmd.exe	99
PID 544 wrote to memory of 2872	544	cmd.exe	100
PID 4920 wrote to memory of 5376	4920	cmd.exe	101
PID 4880 wrote to memory of 4316	4880	zbjdyaol.exe	103
PID 4880 wrote to memory of 5484	4880	zbjdyaol.exe	104
PID 4880 wrote to memory of 3728	4880	zbjdyaol.exe	105
PID 4880 wrote to memory of 4312	4880	zbjdyaol.exe	106
PID 4880 wrote to memory of 3552	4880	zbjdyaol.exe	107
PID 4880 wrote to memory of 3812	4880	zbjdyaol.exe	108
PID 4316 wrote to memory of 4188	4316	cmd.exe	109
PID 3728 wrote to memory of 4424	3728	cmd.exe	110
PID 3552 wrote to memory of 1800	3552	cmd.exe	111
PID 4312 wrote to memory of 5824	4312	cmd.exe	112
PID 5484 wrote to memory of 3616	5484	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\zbjdyaol.exe
"C:\Users\Admin\AppData\Local\Temp\zbjdyaol.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C Powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\system32\powercfg.exe
    Powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Confirm-SecureBootUEFI"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\zbjdyaol.exe" MD5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\zbjdyaol.exe" MD5
    3⤵
    PID:5384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5as52q04.rdc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5as52q04.rdc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

secureboot_status.txt

Path C:\secureboot_status.txt
Size 420B
SHA256 a9aac8c0cfbbeefd52ba4cca1c99c6bd4e16d28792d695ce0271761701868e0a
MD5 6bb2c33bff35de3d3e6660cb183f7182
SHA1 b00ef727ef3df7a501caa49c5b4e458c6bd90eba
SHA512 3650c068da0c025611a2d3716a6017296329bfa49e68e03f8da4fdf1984ccef176679584b455156e1f46468cd5861804e06104db39cb26097ecd1e7addc79617
TLSH
T1FCE0D83E81B955435880E0C1154223AD2B43E2376C8586577A1E2F081F3E6F6F96E2EB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4880-0-0x00007FF88E210000-0x00007FF88E212000-memory.dmp

Download

memory/4880-2-0x00007FF75399F000-0x00007FF754222000-memory.dmp

Download

memory/4880-1-0x00007FF7538B0000-0x00007FF754D62000-memory.dmp

Download

memory/4880-6-0x00007FF7538B0000-0x00007FF754D62000-memory.dmp

Download

memory/4880-22-0x00007FF75399F000-0x00007FF754222000-memory.dmp

Download

memory/4880-23-0x00007FF7538B0000-0x00007FF754D62000-memory.dmp

Download

memory/4980-8-0x0000016C66670000-0x0000016C66680000-memory.dmp

Download

memory/4980-7-0x0000016C66670000-0x0000016C66680000-memory.dmp

Download

memory/4980-16-0x0000016C4E080000-0x0000016C4E0A2000-memory.dmp

Download