ea32788f2eb7dd049f85d60a1f91f3d1c80925341616e8b01c104968e0d4f5e2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.exe
Size 13.6MB
Sample260625-aptmgagw2z
SHA256 ea32788f2eb7dd049f85d60a1f91f3d1c80925341616e8b01c104968e0d4f5e2
MD5 cca178a47c145e680bd0dde632976f32
SHA1 f9fd324a70d8233d27a02f491a3c69177cee61cc
SHA512 7dbd7ded47f6a843bfdd43443714848e0889b5f161d39310f3f65a5231e9b84f6ed9d7d2c86b3d0edc18718b2688f8d8da4f9a96a2441ebf8d6c0ef1f2bbff06
SSDEEP 393216:wRkK9nm0FDlCfEnjFwvfgh/PYAdXMCHWUjXocuI3/PGTAI:w/m0F8MnjFwvfw/dXMb8XdH/O7
TLSH
T144E63358D5C406EEEA73903CEDF096AAD961F86D0332C9DB1B6843B1AD932C14D3C667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
5476	powershell.exe
2756	powershell.exe
1440	powershell.exe
5672	powershell.exe
1508	powershell.exe
3844	powershell.exe
2444	powershell.exe
1036	powershell.exe
1456	powershell.exe
5700	powershell.exe
5796	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe
1596	default.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1596	default.exe
1596	default.exe
2756	powershell.exe
2756	powershell.exe
1440	powershell.exe
1440	powershell.exe
1456	powershell.exe
1456	powershell.exe
5672	powershell.exe
5672	powershell.exe
1508	powershell.exe
1508	powershell.exe
3844	powershell.exe
3844	powershell.exe
5700	powershell.exe
5700	powershell.exe
2444	powershell.exe
2444	powershell.exe
5796	powershell.exe
5796	powershell.exe
4724	powershell.exe
4724	powershell.exe
5476	powershell.exe
5476	powershell.exe
1036	powershell.exe
1036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	default.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeIncreaseQuotaPrivilege	2756	powershell.exe
Token: SeSecurityPrivilege	2756	powershell.exe
Token: SeTakeOwnershipPrivilege	2756	powershell.exe
Token: SeLoadDriverPrivilege	2756	powershell.exe
Token: SeSystemProfilePrivilege	2756	powershell.exe
Token: SeSystemtimePrivilege	2756	powershell.exe
Token: SeProfSingleProcessPrivilege	2756	powershell.exe
Token: SeIncBasePriorityPrivilege	2756	powershell.exe
Token: SeCreatePagefilePrivilege	2756	powershell.exe
Token: SeBackupPrivilege	2756	powershell.exe
Token: SeRestorePrivilege	2756	powershell.exe
Token: SeShutdownPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeSystemEnvironmentPrivilege	2756	powershell.exe
Token: SeRemoteShutdownPrivilege	2756	powershell.exe
Token: SeUndockPrivilege	2756	powershell.exe
Token: SeManageVolumePrivilege	2756	powershell.exe
Token: 33	2756	powershell.exe
Token: 34	2756	powershell.exe
Token: 35	2756	powershell.exe
Token: 36	2756	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe
Token: SeTakeOwnershipPrivilege	1440	powershell.exe
Token: SeLoadDriverPrivilege	1440	powershell.exe
Token: SeSystemProfilePrivilege	1440	powershell.exe
Token: SeSystemtimePrivilege	1440	powershell.exe
Token: SeProfSingleProcessPrivilege	1440	powershell.exe
Token: SeIncBasePriorityPrivilege	1440	powershell.exe
Token: SeCreatePagefilePrivilege	1440	powershell.exe
Token: SeBackupPrivilege	1440	powershell.exe
Token: SeRestorePrivilege	1440	powershell.exe
Token: SeShutdownPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeSystemEnvironmentPrivilege	1440	powershell.exe
Token: SeRemoteShutdownPrivilege	1440	powershell.exe
Token: SeUndockPrivilege	1440	powershell.exe
Token: SeManageVolumePrivilege	1440	powershell.exe
Token: 33	1440	powershell.exe
Token: 34	1440	powershell.exe
Token: 35	1440	powershell.exe
Token: 36	1440	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeIncreaseQuotaPrivilege	1456	powershell.exe
Token: SeSecurityPrivilege	1456	powershell.exe
Token: SeTakeOwnershipPrivilege	1456	powershell.exe
Token: SeLoadDriverPrivilege	1456	powershell.exe
Token: SeSystemProfilePrivilege	1456	powershell.exe
Token: SeSystemtimePrivilege	1456	powershell.exe
Token: SeProfSingleProcessPrivilege	1456	powershell.exe
Token: SeIncBasePriorityPrivilege	1456	powershell.exe
Token: SeCreatePagefilePrivilege	1456	powershell.exe
Token: SeBackupPrivilege	1456	powershell.exe
Token: SeRestorePrivilege	1456	powershell.exe
Token: SeShutdownPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeSystemEnvironmentPrivilege	1456	powershell.exe
Token: SeRemoteShutdownPrivilege	1456	powershell.exe
Token: SeUndockPrivilege	1456	powershell.exe
Token: SeManageVolumePrivilege	1456	powershell.exe
Token: 33	1456	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 1596	5516	default.exe	89
PID 1596 wrote to memory of 2992	1596	default.exe	90
PID 2992 wrote to memory of 2756	2992	cmd.exe	92
PID 1596 wrote to memory of 5968	1596	default.exe	94
PID 5968 wrote to memory of 1440	5968	cmd.exe	96
PID 1596 wrote to memory of 5880	1596	default.exe	97
PID 5880 wrote to memory of 1456	5880	cmd.exe	99
PID 1596 wrote to memory of 2420	1596	default.exe	100
PID 2420 wrote to memory of 5672	2420	cmd.exe	102
PID 1596 wrote to memory of 2996	1596	default.exe	103
PID 2996 wrote to memory of 1508	2996	cmd.exe	105
PID 1596 wrote to memory of 696	1596	default.exe	106
PID 696 wrote to memory of 3844	696	cmd.exe	108
PID 1596 wrote to memory of 2816	1596	default.exe	109
PID 2816 wrote to memory of 5700	2816	cmd.exe	111
PID 1596 wrote to memory of 4636	1596	default.exe	112
PID 4636 wrote to memory of 2444	4636	cmd.exe	114
PID 1596 wrote to memory of 4052	1596	default.exe	115
PID 4052 wrote to memory of 5796	4052	cmd.exe	117
PID 1596 wrote to memory of 2504	1596	default.exe	118
PID 2504 wrote to memory of 4724	2504	cmd.exe	120
PID 1596 wrote to memory of 3988	1596	default.exe	121
PID 3988 wrote to memory of 5476	3988	cmd.exe	123
PID 1596 wrote to memory of 5040	1596	default.exe	125
PID 5040 wrote to memory of 1036	5040	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.exe
"C:\Users\Admin\AppData\Local\Temp\default.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Users\Admin\AppData\Local\Temp\default.exe
  "C:\Users\Admin\AppData\Local\Temp\default.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\bibexose'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\bibexose'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact