68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
Size 13.7MB
Sample260705-tcc9hahs2m
SHA256 68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee
MD5 a8677a450808a4be8857af5c6cffd836
SHA1 91fd716db049df251aeb238e6d283a2937d6a2b8
SHA512 396bbe1855bc687459fa30e697a53ba485f4c75d9ab16987e8a809262ac0609cd4e7f02bccc10a440877f3b15bcce128c764d39ddf8281bd59b9c92da0bfef8b
SSDEEP 393216:7/932dnLSb7gt17cFKRAylKNyEbXMCHWUjXTcuI3/PGTAI:DN+i7gtJcFK/QjbXMb8XQH/O7
TLSH
T1F9E6331862D013EFEBA341389BE0B5A2D8B2B8395775CB5F076887722E171D08D7D366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1888	powershell.exe
2388	powershell.exe
3804	powershell.exe
5456	powershell.exe
1796	powershell.exe
2804	powershell.exe
552	powershell.exe
5840	powershell.exe
1052	powershell.exe
2656	powershell.exe
5836	powershell.exe
5884	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
1888	powershell.exe
1888	powershell.exe
2388	powershell.exe
2388	powershell.exe
5840	powershell.exe
5840	powershell.exe
3804	powershell.exe
3804	powershell.exe
5456	powershell.exe
5456	powershell.exe
1796	powershell.exe
1796	powershell.exe
2804	powershell.exe
2804	powershell.exe
1052	powershell.exe
1052	powershell.exe
2656	powershell.exe
2656	powershell.exe
552	powershell.exe
552	powershell.exe
5836	powershell.exe
5836	powershell.exe
5884	powershell.exe
5884	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeIncreaseQuotaPrivilege	1888	powershell.exe
Token: SeSecurityPrivilege	1888	powershell.exe
Token: SeTakeOwnershipPrivilege	1888	powershell.exe
Token: SeLoadDriverPrivilege	1888	powershell.exe
Token: SeSystemProfilePrivilege	1888	powershell.exe
Token: SeSystemtimePrivilege	1888	powershell.exe
Token: SeProfSingleProcessPrivilege	1888	powershell.exe
Token: SeIncBasePriorityPrivilege	1888	powershell.exe
Token: SeCreatePagefilePrivilege	1888	powershell.exe
Token: SeBackupPrivilege	1888	powershell.exe
Token: SeRestorePrivilege	1888	powershell.exe
Token: SeShutdownPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeSystemEnvironmentPrivilege	1888	powershell.exe
Token: SeRemoteShutdownPrivilege	1888	powershell.exe
Token: SeUndockPrivilege	1888	powershell.exe
Token: SeManageVolumePrivilege	1888	powershell.exe
Token: 33	1888	powershell.exe
Token: 34	1888	powershell.exe
Token: 35	1888	powershell.exe
Token: 36	1888	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeIncreaseQuotaPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeTakeOwnershipPrivilege	2388	powershell.exe
Token: SeLoadDriverPrivilege	2388	powershell.exe
Token: SeSystemProfilePrivilege	2388	powershell.exe
Token: SeSystemtimePrivilege	2388	powershell.exe
Token: SeProfSingleProcessPrivilege	2388	powershell.exe
Token: SeIncBasePriorityPrivilege	2388	powershell.exe
Token: SeCreatePagefilePrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeRestorePrivilege	2388	powershell.exe
Token: SeShutdownPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeSystemEnvironmentPrivilege	2388	powershell.exe
Token: SeRemoteShutdownPrivilege	2388	powershell.exe
Token: SeUndockPrivilege	2388	powershell.exe
Token: SeManageVolumePrivilege	2388	powershell.exe
Token: 33	2388	powershell.exe
Token: 34	2388	powershell.exe
Token: 35	2388	powershell.exe
Token: 36	2388	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeIncreaseQuotaPrivilege	5840	powershell.exe
Token: SeSecurityPrivilege	5840	powershell.exe
Token: SeTakeOwnershipPrivilege	5840	powershell.exe
Token: SeLoadDriverPrivilege	5840	powershell.exe
Token: SeSystemProfilePrivilege	5840	powershell.exe
Token: SeSystemtimePrivilege	5840	powershell.exe
Token: SeProfSingleProcessPrivilege	5840	powershell.exe
Token: SeIncBasePriorityPrivilege	5840	powershell.exe
Token: SeCreatePagefilePrivilege	5840	powershell.exe
Token: SeBackupPrivilege	5840	powershell.exe
Token: SeRestorePrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeSystemEnvironmentPrivilege	5840	powershell.exe
Token: SeRemoteShutdownPrivilege	5840	powershell.exe
Token: SeUndockPrivilege	5840	powershell.exe
Token: SeManageVolumePrivilege	5840	powershell.exe
Token: 33	5840	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 5904	496	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	88
PID 5904 wrote to memory of 4736	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	89
PID 4736 wrote to memory of 1888	4736	cmd.exe	91
PID 5904 wrote to memory of 5368	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	93
PID 5368 wrote to memory of 2388	5368	cmd.exe	95
PID 5904 wrote to memory of 3624	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	96
PID 3624 wrote to memory of 5840	3624	cmd.exe	98
PID 5904 wrote to memory of 5488	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	99
PID 5488 wrote to memory of 3804	5488	cmd.exe	101
PID 5904 wrote to memory of 1588	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	102
PID 1588 wrote to memory of 5456	1588	cmd.exe	104
PID 5904 wrote to memory of 2008	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	105
PID 2008 wrote to memory of 1796	2008	cmd.exe	107
PID 5904 wrote to memory of 4968	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	108
PID 4968 wrote to memory of 2804	4968	cmd.exe	110
PID 5904 wrote to memory of 4720	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	111
PID 4720 wrote to memory of 1052	4720	cmd.exe	113
PID 5904 wrote to memory of 2536	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	114
PID 2536 wrote to memory of 2656	2536	cmd.exe	116
PID 5904 wrote to memory of 1872	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	117
PID 1872 wrote to memory of 552	1872	cmd.exe	119
PID 5904 wrote to memory of 1344	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	120
PID 1344 wrote to memory of 5836	1344	cmd.exe	122
PID 5904 wrote to memory of 4212	5904	_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe	123
PID 4212 wrote to memory of 5884	4212	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
"C:\Users\Admin\AppData\Local\Temp\_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:496
- C:\Users\Admin\AppData\Local\Temp\_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe
  "C:\Users\Admin\AppData\Local\Temp\_68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact