2ff1c482e6f852af96b352aa0b98e7c77e0212c422de60c5c0525d4e9bb398e2

Analysis

user interaction
yes
max time kernel
6s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nylenia.exe
Size 9.4MB
Sample260626-syn3fsc16m
SHA256 2ff1c482e6f852af96b352aa0b98e7c77e0212c422de60c5c0525d4e9bb398e2
MD5 147b3c8361c0a4912771fae4eb277dc9
SHA1 aee8d50c6343e0a1ac1f64a510ac5761b513c00d
SHA512 9a556941e2ad05d9e44654158eec2adce0c0b9978635589d64e980fca21ca8d449024151c518fcdb955b07f5f00b1f49423ff6f9056a17b699ab65d0246c7037
SSDEEP 49152:C8b5K9Vjiw8PIh/tKgxz+vQpW/9bd29Gaci9iK+c1IrDGd+ac+Fxt7tnFaAgF5T5:C8b25MH9bzr+1c+pW/vsqPEtuLSCa6
TLSH
T183A62917EDA550E9C0EDD130C9769623BAB17C485B2023D71BA0F7242F76BE0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4444	powershell.exe
1348	powershell.exe
2376	powershell.exe
568	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-306957864.tmp	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3112690348.tmp	Nylenia.exe

Executes dropped EXE 1 IoCs

pid	Process
4100	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-9f82293d = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\svchost.exe\""	Nylenia.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-9f82293d = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\svchost.exe\""	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4444	powershell.exe
4444	powershell.exe
1348	powershell.exe
1348	powershell.exe
2376	powershell.exe
2376	powershell.exe
568	powershell.exe
568	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4444	4136	Nylenia.exe	88
PID 4136 wrote to memory of 1348	4136	Nylenia.exe	92
PID 4100 wrote to memory of 2376	4100	svchost.exe	95
PID 4100 wrote to memory of 568	4100	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\Nylenia.exe
"C:\Users\Admin\AppData\Local\Temp\Nylenia.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svchost_e3c6bd17' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'svchost_fe3c6bd17'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'svchost_ce3c6bd17'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='svchost_fe3c6bd17'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='svchost_ce3c6bd17'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1348

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svchost_e3c6bd17' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'svchost_fe3c6bd17'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'svchost_ce3c6bd17'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='svchost_fe3c6bd17'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='svchost_ce3c6bd17'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 91110b1d365db62306474e395fd0b71795343f32e7620b7ea76d1c4c70678a5e
MD5 05df1496dd78a96d13c6675d37a09cf9
SHA1 ef5b11b635be562c1938b1ca116e327a72bf1727
SHA512 061087d9b2ac9bd4b398d8e11bb627f83072b01ebf4ece70a12c360f7233c3a1b5b74569f571a572e301886d98747e39c359635353009d075e5b260543ef1472
TLSH
T140217823B39D8820CCD5153A108DAC5072B682C781DFCF9F6EC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2b7db7451da9af148e35877d16964eef716aaa7dc6d1b9b53be88af84fefc5c0
MD5 fdace1a4961c17316b6cc1713325d90f
SHA1 64ae5ffb6e74f560ea3424cd3bfdbed741ac8ba3
SHA512 64c105dcc60d920b44ddb4e57c7ce22e414c263862844eee5331d47b634fa4d17f6a3b2555373e63e65507da1f4c0729ebeaf3c2dea173e24ca9ed659547d36b
TLSH
T13C217823B39D8560CCD6163A109D9C5072A782C781DEDFDB2AC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0jurhcty.0an.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jurhcty.0an.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2378155670.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2378155670.tmp
Size 9.4MB
SHA256 2ff1c482e6f852af96b352aa0b98e7c77e0212c422de60c5c0525d4e9bb398e2
MD5 147b3c8361c0a4912771fae4eb277dc9
SHA1 aee8d50c6343e0a1ac1f64a510ac5761b513c00d
SHA512 9a556941e2ad05d9e44654158eec2adce0c0b9978635589d64e980fca21ca8d449024151c518fcdb955b07f5f00b1f49423ff6f9056a17b699ab65d0246c7037
SSDEEP 49152:C8b5K9Vjiw8PIh/tKgxz+vQpW/9bd29Gaci9iK+c1IrDGd+ac+Fxt7tnFaAgF5T5:C8b25MH9bzr+1c+pW/vsqPEtuLSCa6
TLSH
T183A62917EDA550E9C0EDD130C9769623BAB17C485B2023D71BA0F7242F76BE0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4100-53-0x00007FF7D3FE0000-0x00007FF7D69A5000-memory.dmp

Download

memory/4444-6-0x000001B3C4890000-0x000001B3C48A0000-memory.dmp

Download

memory/4444-12-0x000001B3C6980000-0x000001B3C69A2000-memory.dmp

Download

memory/4444-15-0x000001B3C4890000-0x000001B3C48A0000-memory.dmp

Download

memory/4444-18-0x000001B3C69B0000-0x000001B3C6BCC000-memory.dmp

Download