89ab78d8c4f4b2a542ae4ba0800a448cb265a2ead00e5c57da65aecb594e815a

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qwerqwer.exe
Size 67.2MB
Sample260706-wnrmdaey2p
SHA256 89ab78d8c4f4b2a542ae4ba0800a448cb265a2ead00e5c57da65aecb594e815a
MD5 f909b8e7d043b52b992029f773cebd61
SHA1 5bb09e3fb87f996c65e2501d10c33d4824918b99
SHA512 24868bb6cd8f7175e6b631629374806e688cd0eb270458c1fb61ce849c912ef0a936659aaed47e4eaee6216b15ac0a8744a19c44ca355774b74049ed11b7de51
SSDEEP 393216:5mHNzQa2AWJq+7QJuGh8OsP89OFlZiiYdYG5zglb/vG5L5OtsFtoNTaUYd44/J8K:c2A0+j8Oa89TsG5YWV5OtsFGtatWK
TLSH
T108F79E11A7E80B06D73FC27CC5639252E7B1B4531351C6CF0498EA993F53BE1AA362B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qwerqwer.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qwerqwer.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ClickAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qwerqwer.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2544	powershell.exe
6116	powershell.exe
1292	powershell.exe
1864	powershell.exe
3740	powershell.exe
4732	powershell.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2912	reg.exe
2860	reg.exe
2764	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2544	powershell.exe
2544	powershell.exe
6116	powershell.exe
6116	powershell.exe
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
3740	powershell.exe
3740	powershell.exe
3740	powershell.exe
4732	powershell.exe
4732	powershell.exe
4732	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	qwerqwer.exe
Token: SeDebugPrivilege	2436	qwerqwer.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeIncreaseQuotaPrivilege	2544	powershell.exe
Token: SeSecurityPrivilege	2544	powershell.exe
Token: SeTakeOwnershipPrivilege	2544	powershell.exe
Token: SeLoadDriverPrivilege	2544	powershell.exe
Token: SeSystemProfilePrivilege	2544	powershell.exe
Token: SeSystemtimePrivilege	2544	powershell.exe
Token: SeProfSingleProcessPrivilege	2544	powershell.exe
Token: SeIncBasePriorityPrivilege	2544	powershell.exe
Token: SeCreatePagefilePrivilege	2544	powershell.exe
Token: SeBackupPrivilege	2544	powershell.exe
Token: SeRestorePrivilege	2544	powershell.exe
Token: SeShutdownPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeSystemEnvironmentPrivilege	2544	powershell.exe
Token: SeRemoteShutdownPrivilege	2544	powershell.exe
Token: SeUndockPrivilege	2544	powershell.exe
Token: SeManageVolumePrivilege	2544	powershell.exe
Token: 33	2544	powershell.exe
Token: 34	2544	powershell.exe
Token: 35	2544	powershell.exe
Token: 36	2544	powershell.exe
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeIncreaseQuotaPrivilege	6116	powershell.exe
Token: SeSecurityPrivilege	6116	powershell.exe
Token: SeTakeOwnershipPrivilege	6116	powershell.exe
Token: SeLoadDriverPrivilege	6116	powershell.exe
Token: SeSystemProfilePrivilege	6116	powershell.exe
Token: SeSystemtimePrivilege	6116	powershell.exe
Token: SeProfSingleProcessPrivilege	6116	powershell.exe
Token: SeIncBasePriorityPrivilege	6116	powershell.exe
Token: SeCreatePagefilePrivilege	6116	powershell.exe
Token: SeBackupPrivilege	6116	powershell.exe
Token: SeRestorePrivilege	6116	powershell.exe
Token: SeShutdownPrivilege	6116	powershell.exe
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeSystemEnvironmentPrivilege	6116	powershell.exe
Token: SeRemoteShutdownPrivilege	6116	powershell.exe
Token: SeUndockPrivilege	6116	powershell.exe
Token: SeManageVolumePrivilege	6116	powershell.exe
Token: 33	6116	powershell.exe
Token: 34	6116	powershell.exe
Token: 35	6116	powershell.exe
Token: 36	6116	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeIncreaseQuotaPrivilege	1292	powershell.exe
Token: SeSecurityPrivilege	1292	powershell.exe
Token: SeTakeOwnershipPrivilege	1292	powershell.exe
Token: SeLoadDriverPrivilege	1292	powershell.exe
Token: SeSystemProfilePrivilege	1292	powershell.exe
Token: SeSystemtimePrivilege	1292	powershell.exe
Token: SeProfSingleProcessPrivilege	1292	powershell.exe
Token: SeIncBasePriorityPrivilege	1292	powershell.exe
Token: SeCreatePagefilePrivilege	1292	powershell.exe
Token: SeBackupPrivilege	1292	powershell.exe
Token: SeRestorePrivilege	1292	powershell.exe
Token: SeShutdownPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeSystemEnvironmentPrivilege	1292	powershell.exe
Token: SeRemoteShutdownPrivilege	1292	powershell.exe
Token: SeUndockPrivilege	1292	powershell.exe
Token: SeManageVolumePrivilege	1292	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2912	1360	qwerqwer.exe	90
PID 2436 wrote to memory of 1600	2436	qwerqwer.exe	94
PID 1600 wrote to memory of 2544	1600	cmd.exe	96
PID 2436 wrote to memory of 4300	2436	qwerqwer.exe	98
PID 4300 wrote to memory of 6116	4300	cmd.exe	100
PID 2436 wrote to memory of 4428	2436	qwerqwer.exe	102
PID 4428 wrote to memory of 1292	4428	cmd.exe	104
PID 2436 wrote to memory of 3704	2436	qwerqwer.exe	105
PID 3704 wrote to memory of 1864	3704	cmd.exe	107
PID 2436 wrote to memory of 2860	2436	qwerqwer.exe	108
PID 1360 wrote to memory of 2092	1360	qwerqwer.exe	110
PID 2092 wrote to memory of 3740	2092	cmd.exe	112
PID 1360 wrote to memory of 5072	1360	qwerqwer.exe	113
PID 5072 wrote to memory of 4732	5072	cmd.exe	115
PID 1360 wrote to memory of 2764	1360	qwerqwer.exe	116

C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe
"C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AntivirusSignatureVersion | Format-List"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AntivirusSignatureVersion | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3740
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -Command "Get-MpThreatDetection | Select-Object ProcessName,InitialDetectionTime | Format-Table -Auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpThreatDetection | Select-Object ProcessName,InitialDetectionTime | Format-Table -Auto"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- C:\Windows\SYSTEM32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2764

C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe
C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AntivirusSignatureVersion | Format-List"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AntivirusSignatureVersion | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -Command "Get-MpThreatDetection | Select-Object ProcessName,InitialDetectionTime | Format-Table -Auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpThreatDetection | Select-Object ProcessName,InitialDetectionTime | Format-Table -Auto"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AntivirusSignatureVersion | Format-List"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AntivirusSignatureVersion | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -Command "Get-MpThreatDetection | Select-Object ProcessName,InitialDetectionTime | Format-Table -Auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpThreatDetection | Select-Object ProcessName,InitialDetectionTime | Format-Table -Auto"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1864
- C:\Windows\System32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3ClickAgent /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\qwerqwer.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...