0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
Size 13.6MB
Sample260706-tc7s4shv5s
SHA256 0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b
MD5 8ef53e9ef1ab2f6cc70f30775cf35b55
SHA1 28758bba837722e8f31a9858ea8ddd3c26462295
SHA512 1872ed7cd9407c42c20450a1193d99cf4fed1df2e6173944f75667e4dcc1009479727761f3a02a3f81ca8b421cd910b16dd56195b9b5ffb0324eef06c90dede7
SSDEEP 393216:Mc/FAFH4v9saYZUOLfKbXMCHWUjXWcuI3/PGTAI:Mc/mH4FqZUiYXMb8XrH/O7
TLSH
T184E633489ED001FEE7A3427DFEA16485E4B674794B32CACB1794DA927E772D18C3C122
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4336	powershell.exe
956	powershell.exe
3236	powershell.exe
5848	powershell.exe
1272	powershell.exe
5064	powershell.exe
1232	powershell.exe
1300	powershell.exe
4956	powershell.exe
3972	powershell.exe
4720	powershell.exe
1428	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
5064	powershell.exe
5064	powershell.exe
4336	powershell.exe
4336	powershell.exe
1232	powershell.exe
1232	powershell.exe
1300	powershell.exe
1300	powershell.exe
956	powershell.exe
956	powershell.exe
4956	powershell.exe
4956	powershell.exe
3972	powershell.exe
3972	powershell.exe
4720	powershell.exe
4720	powershell.exe
3236	powershell.exe
3236	powershell.exe
1428	powershell.exe
1428	powershell.exe
5848	powershell.exe
5848	powershell.exe
1272	powershell.exe
1272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeIncreaseQuotaPrivilege	5064	powershell.exe
Token: SeSecurityPrivilege	5064	powershell.exe
Token: SeTakeOwnershipPrivilege	5064	powershell.exe
Token: SeLoadDriverPrivilege	5064	powershell.exe
Token: SeSystemProfilePrivilege	5064	powershell.exe
Token: SeSystemtimePrivilege	5064	powershell.exe
Token: SeProfSingleProcessPrivilege	5064	powershell.exe
Token: SeIncBasePriorityPrivilege	5064	powershell.exe
Token: SeCreatePagefilePrivilege	5064	powershell.exe
Token: SeBackupPrivilege	5064	powershell.exe
Token: SeRestorePrivilege	5064	powershell.exe
Token: SeShutdownPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeSystemEnvironmentPrivilege	5064	powershell.exe
Token: SeRemoteShutdownPrivilege	5064	powershell.exe
Token: SeUndockPrivilege	5064	powershell.exe
Token: SeManageVolumePrivilege	5064	powershell.exe
Token: 33	5064	powershell.exe
Token: 34	5064	powershell.exe
Token: 35	5064	powershell.exe
Token: 36	5064	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeIncreaseQuotaPrivilege	4336	powershell.exe
Token: SeSecurityPrivilege	4336	powershell.exe
Token: SeTakeOwnershipPrivilege	4336	powershell.exe
Token: SeLoadDriverPrivilege	4336	powershell.exe
Token: SeSystemProfilePrivilege	4336	powershell.exe
Token: SeSystemtimePrivilege	4336	powershell.exe
Token: SeProfSingleProcessPrivilege	4336	powershell.exe
Token: SeIncBasePriorityPrivilege	4336	powershell.exe
Token: SeCreatePagefilePrivilege	4336	powershell.exe
Token: SeBackupPrivilege	4336	powershell.exe
Token: SeRestorePrivilege	4336	powershell.exe
Token: SeShutdownPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeSystemEnvironmentPrivilege	4336	powershell.exe
Token: SeRemoteShutdownPrivilege	4336	powershell.exe
Token: SeUndockPrivilege	4336	powershell.exe
Token: SeManageVolumePrivilege	4336	powershell.exe
Token: 33	4336	powershell.exe
Token: 34	4336	powershell.exe
Token: 35	4336	powershell.exe
Token: 36	4336	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeIncreaseQuotaPrivilege	1232	powershell.exe
Token: SeSecurityPrivilege	1232	powershell.exe
Token: SeTakeOwnershipPrivilege	1232	powershell.exe
Token: SeLoadDriverPrivilege	1232	powershell.exe
Token: SeSystemProfilePrivilege	1232	powershell.exe
Token: SeSystemtimePrivilege	1232	powershell.exe
Token: SeProfSingleProcessPrivilege	1232	powershell.exe
Token: SeIncBasePriorityPrivilege	1232	powershell.exe
Token: SeCreatePagefilePrivilege	1232	powershell.exe
Token: SeBackupPrivilege	1232	powershell.exe
Token: SeRestorePrivilege	1232	powershell.exe
Token: SeShutdownPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeSystemEnvironmentPrivilege	1232	powershell.exe
Token: SeRemoteShutdownPrivilege	1232	powershell.exe
Token: SeUndockPrivilege	1232	powershell.exe
Token: SeManageVolumePrivilege	1232	powershell.exe
Token: 33	1232	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 5944	696	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	88
PID 5944 wrote to memory of 5500	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	89
PID 5500 wrote to memory of 5064	5500	cmd.exe	91
PID 5944 wrote to memory of 4652	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	93
PID 4652 wrote to memory of 4336	4652	cmd.exe	95
PID 5944 wrote to memory of 5280	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	96
PID 5280 wrote to memory of 1232	5280	cmd.exe	98
PID 5944 wrote to memory of 3504	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	99
PID 3504 wrote to memory of 1300	3504	cmd.exe	101
PID 5944 wrote to memory of 428	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	102
PID 428 wrote to memory of 956	428	cmd.exe	104
PID 5944 wrote to memory of 5008	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	105
PID 5008 wrote to memory of 4956	5008	cmd.exe	107
PID 5944 wrote to memory of 2220	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	108
PID 2220 wrote to memory of 3972	2220	cmd.exe	110
PID 5944 wrote to memory of 6044	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	111
PID 6044 wrote to memory of 4720	6044	cmd.exe	113
PID 5944 wrote to memory of 1412	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	115
PID 1412 wrote to memory of 3236	1412	cmd.exe	117
PID 5944 wrote to memory of 4164	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	118
PID 4164 wrote to memory of 1428	4164	cmd.exe	120
PID 5944 wrote to memory of 1384	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	121
PID 1384 wrote to memory of 5848	1384	cmd.exe	123
PID 5944 wrote to memory of 2004	5944	_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe	124
PID 2004 wrote to memory of 1272	2004	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
"C:\Users\Admin\AppData\Local\Temp\_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe
  "C:\Users\Admin\AppData\Local\Temp\_0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\bupojoyu'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\bupojoyu'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact