4ae4d4f2faf96941187abdf2d292b4ce995ecc94dc68f8e7d4e0e49747caed6d

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.exe
Size 13.6MB
Sample260704-d35tfaey5n
SHA256 4ae4d4f2faf96941187abdf2d292b4ce995ecc94dc68f8e7d4e0e49747caed6d
MD5 6bedd45f963b7f078071bb6eeb1edcae
SHA1 fc778892bd31ad42e967890ca0d4e2a661897841
SHA512 d21e0863d60a2a2ecaadac9c37e5f589089e670e01dd872b948f0fd94e9155ac98c0a195f2096ee0e70c4e66feda336f60104893dd7bdc1a2e1d18c47824e8f8
SSDEEP 393216:SsYkXVJgsRfKe9AbXMCHWUjXocuI3/PGTAI:SsdVnJKe9AbXMb8XdH/O7
TLSH
T197E6331896D411EEE2B38638FED26DA5E4A978610371C6CF1FA447D12E632E08D3D637
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
684	powershell.exe
2056	powershell.exe
1436	powershell.exe
1044	powershell.exe
3324	powershell.exe
2452	powershell.exe
2156	powershell.exe
2928	powershell.exe
1344	powershell.exe
3152	powershell.exe
1416	powershell.exe
4872	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe
5680	default.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5680	default.exe
5680	default.exe
2156	powershell.exe
2156	powershell.exe
684	powershell.exe
684	powershell.exe
2928	powershell.exe
2928	powershell.exe
2056	powershell.exe
2056	powershell.exe
1344	powershell.exe
1344	powershell.exe
1436	powershell.exe
1436	powershell.exe
1044	powershell.exe
1044	powershell.exe
3324	powershell.exe
3324	powershell.exe
2452	powershell.exe
2452	powershell.exe
3152	powershell.exe
3152	powershell.exe
1416	powershell.exe
1416	powershell.exe
4872	powershell.exe
4872	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	default.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe
Token: 33	2156	powershell.exe
Token: 34	2156	powershell.exe
Token: 35	2156	powershell.exe
Token: 36	2156	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeIncreaseQuotaPrivilege	684	powershell.exe
Token: SeSecurityPrivilege	684	powershell.exe
Token: SeTakeOwnershipPrivilege	684	powershell.exe
Token: SeLoadDriverPrivilege	684	powershell.exe
Token: SeSystemProfilePrivilege	684	powershell.exe
Token: SeSystemtimePrivilege	684	powershell.exe
Token: SeProfSingleProcessPrivilege	684	powershell.exe
Token: SeIncBasePriorityPrivilege	684	powershell.exe
Token: SeCreatePagefilePrivilege	684	powershell.exe
Token: SeBackupPrivilege	684	powershell.exe
Token: SeRestorePrivilege	684	powershell.exe
Token: SeShutdownPrivilege	684	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeSystemEnvironmentPrivilege	684	powershell.exe
Token: SeRemoteShutdownPrivilege	684	powershell.exe
Token: SeUndockPrivilege	684	powershell.exe
Token: SeManageVolumePrivilege	684	powershell.exe
Token: 33	684	powershell.exe
Token: 34	684	powershell.exe
Token: 35	684	powershell.exe
Token: 36	684	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeIncreaseQuotaPrivilege	2928	powershell.exe
Token: SeSecurityPrivilege	2928	powershell.exe
Token: SeTakeOwnershipPrivilege	2928	powershell.exe
Token: SeLoadDriverPrivilege	2928	powershell.exe
Token: SeSystemProfilePrivilege	2928	powershell.exe
Token: SeSystemtimePrivilege	2928	powershell.exe
Token: SeProfSingleProcessPrivilege	2928	powershell.exe
Token: SeIncBasePriorityPrivilege	2928	powershell.exe
Token: SeCreatePagefilePrivilege	2928	powershell.exe
Token: SeBackupPrivilege	2928	powershell.exe
Token: SeRestorePrivilege	2928	powershell.exe
Token: SeShutdownPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeSystemEnvironmentPrivilege	2928	powershell.exe
Token: SeRemoteShutdownPrivilege	2928	powershell.exe
Token: SeUndockPrivilege	2928	powershell.exe
Token: SeManageVolumePrivilege	2928	powershell.exe
Token: 33	2928	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 5680	2060	default.exe	88
PID 5680 wrote to memory of 5476	5680	default.exe	89
PID 5476 wrote to memory of 2156	5476	cmd.exe	91
PID 5680 wrote to memory of 792	5680	default.exe	93
PID 792 wrote to memory of 684	792	cmd.exe	95
PID 5680 wrote to memory of 1316	5680	default.exe	96
PID 1316 wrote to memory of 2928	1316	cmd.exe	98
PID 5680 wrote to memory of 256	5680	default.exe	99
PID 256 wrote to memory of 2056	256	cmd.exe	101
PID 5680 wrote to memory of 1716	5680	default.exe	102
PID 1716 wrote to memory of 1344	1716	cmd.exe	104
PID 5680 wrote to memory of 1788	5680	default.exe	105
PID 1788 wrote to memory of 1436	1788	cmd.exe	107
PID 5680 wrote to memory of 2040	5680	default.exe	108
PID 2040 wrote to memory of 1044	2040	cmd.exe	110
PID 5680 wrote to memory of 3320	5680	default.exe	111
PID 3320 wrote to memory of 3324	3320	cmd.exe	113
PID 5680 wrote to memory of 5348	5680	default.exe	114
PID 5348 wrote to memory of 2452	5348	cmd.exe	116
PID 5680 wrote to memory of 4988	5680	default.exe	117
PID 4988 wrote to memory of 3152	4988	cmd.exe	119
PID 5680 wrote to memory of 2536	5680	default.exe	120
PID 2536 wrote to memory of 1416	2536	cmd.exe	122
PID 5680 wrote to memory of 4700	5680	default.exe	123
PID 4700 wrote to memory of 4872	4700	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.exe
"C:\Users\Admin\AppData\Local\Temp\default.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\default.exe
  "C:\Users\Admin\AppData\Local\Temp\default.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\koyocido'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\koyocido'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact