b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe
Size 280KB
Sample260706-j93kjsct4w
SHA256 b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc
MD5 4310185098e94636a7b1ad7b80ac343c
SHA1 a4037a07789fa911c478c1ecc715965158325b29
SHA512 3027ea5f9661d49a0968a9b65fda19ee90f9820854ad5d4eae0910a724a3f1974e5552da081c69f833b5f219ca08b1873d66751d924d6cc536e6ac0080a08b3a
SSDEEP 3072:aIojVUz0vNYBpN7wFP3SJEJUh78yRLBoEuMgAvrggMGhjQaaWJsV2OBfHaNCM9ND:jsvNYFEFPCJnh7bLBjuJAPaEshMr
TLSH
T1D6547D16B3A50CF9EDA7923CC8524906E7B2BC164761D7CF03A046572F272E1AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1376	powershell.exe
976	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
976	powershell.exe
976	powershell.exe
1376	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	powershell.exe
Token: SeIncreaseQuotaPrivilege	976	powershell.exe
Token: SeSecurityPrivilege	976	powershell.exe
Token: SeTakeOwnershipPrivilege	976	powershell.exe
Token: SeLoadDriverPrivilege	976	powershell.exe
Token: SeSystemProfilePrivilege	976	powershell.exe
Token: SeSystemtimePrivilege	976	powershell.exe
Token: SeProfSingleProcessPrivilege	976	powershell.exe
Token: SeIncBasePriorityPrivilege	976	powershell.exe
Token: SeCreatePagefilePrivilege	976	powershell.exe
Token: SeBackupPrivilege	976	powershell.exe
Token: SeRestorePrivilege	976	powershell.exe
Token: SeShutdownPrivilege	976	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeSystemEnvironmentPrivilege	976	powershell.exe
Token: SeRemoteShutdownPrivilege	976	powershell.exe
Token: SeUndockPrivilege	976	powershell.exe
Token: SeManageVolumePrivilege	976	powershell.exe
Token: 33	976	powershell.exe
Token: 34	976	powershell.exe
Token: 35	976	powershell.exe
Token: 36	976	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeIncreaseQuotaPrivilege	1376	powershell.exe
Token: SeSecurityPrivilege	1376	powershell.exe
Token: SeTakeOwnershipPrivilege	1376	powershell.exe
Token: SeLoadDriverPrivilege	1376	powershell.exe
Token: SeSystemProfilePrivilege	1376	powershell.exe
Token: SeSystemtimePrivilege	1376	powershell.exe
Token: SeProfSingleProcessPrivilege	1376	powershell.exe
Token: SeIncBasePriorityPrivilege	1376	powershell.exe
Token: SeCreatePagefilePrivilege	1376	powershell.exe
Token: SeBackupPrivilege	1376	powershell.exe
Token: SeRestorePrivilege	1376	powershell.exe
Token: SeShutdownPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeSystemEnvironmentPrivilege	1376	powershell.exe
Token: SeRemoteShutdownPrivilege	1376	powershell.exe
Token: SeUndockPrivilege	1376	powershell.exe
Token: SeManageVolumePrivilege	1376	powershell.exe
Token: 33	1376	powershell.exe
Token: 34	1376	powershell.exe
Token: 35	1376	powershell.exe
Token: 36	1376	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2740	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	89
PID 2884 wrote to memory of 1520	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	90
PID 2884 wrote to memory of 5732	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	91
PID 2884 wrote to memory of 1424	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	92
PID 2884 wrote to memory of 3372	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	93
PID 2884 wrote to memory of 5320	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	94
PID 2884 wrote to memory of 2288	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	95
PID 2884 wrote to memory of 5380	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	96
PID 2884 wrote to memory of 5788	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	97
PID 2884 wrote to memory of 1100	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	98
PID 2884 wrote to memory of 628	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	99
PID 2884 wrote to memory of 4720	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	100
PID 2884 wrote to memory of 4404	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	101
PID 2884 wrote to memory of 5428	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	102
PID 2884 wrote to memory of 1660	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	103
PID 2884 wrote to memory of 620	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	104
PID 2884 wrote to memory of 3872	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	105
PID 2884 wrote to memory of 1492	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	106
PID 1492 wrote to memory of 976	1492	cmd.exe	107
PID 2884 wrote to memory of 2420	2884	b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe	109
PID 2420 wrote to memory of 1376	2420	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe
"C:\Users\Admin\AppData\Local\Temp\b21e25e30fb0c241aa5e5646ea5f9b3093edd982d72bb6537c1a84e8562bd1cc.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\XVVJF'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\XVVJF'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yif5ehe4.zay.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yif5ehe4.zay.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

htuiiaedjtra.exe

Path C:\XVVJF\htuiiaedjtra.exe
Size 292KB
SHA256 cfdeda190f3cdd86988f2fb64be10f40a3b836d947192b804f561d7f5108876f
MD5 cc6fee433a5c40f00f50328cb64b0bbf
SHA1 fff983d86a02bcd1c77403530183511702590b1f
SHA512 6cd6f6f105c9f7f4791000f13308b3087668dd2f49117b71bb625df49cbc77cd819ffa5e616ea2f8e940336801dfb1e421329eb300e55d7f3f5268c1e92da251
SSDEEP 6144:AD91HRhfpZwz/JZI7xqdn5pjUsvVm7MVqWX8ijE9WXdueJ5PTQYbeHxHA7op9hrA:C91HRhfpZwz/JZI7xqdn5pjUsvVm7MVT
TLSH
T1C7544A71A178A23E012F368AF271D314D7A7A31BD79816F5B93ED2B857C3C84EA53058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-5-0x0000024AD3300000-0x0000024AD3322000-memory.dmp

Download

memory/976-13-0x0000024AD36F0000-0x0000024AD370E000-memory.dmp

Download

memory/976-14-0x0000024AD37A0000-0x0000024AD3852000-memory.dmp

Download

memory/976-15-0x0000024AD36E0000-0x0000024AD36EA000-memory.dmp

Download