ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
Size 13.6MB
Sample260708-egekssa14r
SHA256 ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663
MD5 f2280cb04cc1dbd45e5a6721abae7834
SHA1 c697f8f2520cd42255f03de269b6a87eb997ad03
SHA512 b6d4cd550cf81ac40c2d76e365a534e24cad850fe3d5469c0bfb67f5d7dee632d004fe60e071aeb01c68538ffe0f21ae677adc540b4f25f1adeccbb269530393
SSDEEP 393216:0CVlisbmd9V6iY+GOaNEwkpjSOZXMCHWUjX5cuI3/PGTAI:0+iMmbV6iY+G/kpPZXMb8XOH/O7
TLSH
T1EAE6338496D043E9FA73503CDFE2828AE47570651775CACF4BB88352EE831E45E3EA46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe
4312	powershell.exe
2608	powershell.exe
2940	powershell.exe
1124	powershell.exe
4640	powershell.exe
5640	powershell.exe
4196	powershell.exe
4980	powershell.exe
4284	powershell.exe
2260	powershell.exe
2432	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
4196	powershell.exe
4196	powershell.exe
4980	powershell.exe
4980	powershell.exe
4284	powershell.exe
4284	powershell.exe
2260	powershell.exe
2260	powershell.exe
2608	powershell.exe
2608	powershell.exe
2940	powershell.exe
2940	powershell.exe
2432	powershell.exe
2432	powershell.exe
1124	powershell.exe
1124	powershell.exe
4640	powershell.exe
4640	powershell.exe
4708	powershell.exe
4708	powershell.exe
5640	powershell.exe
5640	powershell.exe
4312	powershell.exe
4312	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeIncreaseQuotaPrivilege	4196	powershell.exe
Token: SeSecurityPrivilege	4196	powershell.exe
Token: SeTakeOwnershipPrivilege	4196	powershell.exe
Token: SeLoadDriverPrivilege	4196	powershell.exe
Token: SeSystemProfilePrivilege	4196	powershell.exe
Token: SeSystemtimePrivilege	4196	powershell.exe
Token: SeProfSingleProcessPrivilege	4196	powershell.exe
Token: SeIncBasePriorityPrivilege	4196	powershell.exe
Token: SeCreatePagefilePrivilege	4196	powershell.exe
Token: SeBackupPrivilege	4196	powershell.exe
Token: SeRestorePrivilege	4196	powershell.exe
Token: SeShutdownPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeSystemEnvironmentPrivilege	4196	powershell.exe
Token: SeRemoteShutdownPrivilege	4196	powershell.exe
Token: SeUndockPrivilege	4196	powershell.exe
Token: SeManageVolumePrivilege	4196	powershell.exe
Token: 33	4196	powershell.exe
Token: 34	4196	powershell.exe
Token: 35	4196	powershell.exe
Token: 36	4196	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeIncreaseQuotaPrivilege	4980	powershell.exe
Token: SeSecurityPrivilege	4980	powershell.exe
Token: SeTakeOwnershipPrivilege	4980	powershell.exe
Token: SeLoadDriverPrivilege	4980	powershell.exe
Token: SeSystemProfilePrivilege	4980	powershell.exe
Token: SeSystemtimePrivilege	4980	powershell.exe
Token: SeProfSingleProcessPrivilege	4980	powershell.exe
Token: SeIncBasePriorityPrivilege	4980	powershell.exe
Token: SeCreatePagefilePrivilege	4980	powershell.exe
Token: SeBackupPrivilege	4980	powershell.exe
Token: SeRestorePrivilege	4980	powershell.exe
Token: SeShutdownPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeSystemEnvironmentPrivilege	4980	powershell.exe
Token: SeRemoteShutdownPrivilege	4980	powershell.exe
Token: SeUndockPrivilege	4980	powershell.exe
Token: SeManageVolumePrivilege	4980	powershell.exe
Token: 33	4980	powershell.exe
Token: 34	4980	powershell.exe
Token: 35	4980	powershell.exe
Token: 36	4980	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeIncreaseQuotaPrivilege	4284	powershell.exe
Token: SeSecurityPrivilege	4284	powershell.exe
Token: SeTakeOwnershipPrivilege	4284	powershell.exe
Token: SeLoadDriverPrivilege	4284	powershell.exe
Token: SeSystemProfilePrivilege	4284	powershell.exe
Token: SeSystemtimePrivilege	4284	powershell.exe
Token: SeProfSingleProcessPrivilege	4284	powershell.exe
Token: SeIncBasePriorityPrivilege	4284	powershell.exe
Token: SeCreatePagefilePrivilege	4284	powershell.exe
Token: SeBackupPrivilege	4284	powershell.exe
Token: SeRestorePrivilege	4284	powershell.exe
Token: SeShutdownPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeSystemEnvironmentPrivilege	4284	powershell.exe
Token: SeRemoteShutdownPrivilege	4284	powershell.exe
Token: SeUndockPrivilege	4284	powershell.exe
Token: SeManageVolumePrivilege	4284	powershell.exe
Token: 33	4284	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1772	2728	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	88
PID 1772 wrote to memory of 6100	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	89
PID 6100 wrote to memory of 4196	6100	cmd.exe	91
PID 1772 wrote to memory of 2096	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	93
PID 2096 wrote to memory of 4980	2096	cmd.exe	95
PID 1772 wrote to memory of 1692	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	96
PID 1692 wrote to memory of 4284	1692	cmd.exe	98
PID 1772 wrote to memory of 264	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	99
PID 264 wrote to memory of 2260	264	cmd.exe	101
PID 1772 wrote to memory of 3348	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	102
PID 3348 wrote to memory of 2608	3348	cmd.exe	104
PID 1772 wrote to memory of 5028	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	105
PID 5028 wrote to memory of 2940	5028	cmd.exe	107
PID 1772 wrote to memory of 3560	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	108
PID 3560 wrote to memory of 2432	3560	cmd.exe	110
PID 1772 wrote to memory of 2100	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	111
PID 2100 wrote to memory of 1124	2100	cmd.exe	113
PID 1772 wrote to memory of 3112	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	114
PID 3112 wrote to memory of 4640	3112	cmd.exe	116
PID 1772 wrote to memory of 2040	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	117
PID 2040 wrote to memory of 4708	2040	cmd.exe	119
PID 1772 wrote to memory of 5484	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	120
PID 5484 wrote to memory of 5640	5484	cmd.exe	122
PID 1772 wrote to memory of 2760	1772	_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe	123
PID 2760 wrote to memory of 4312	2760	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
"C:\Users\Admin\AppData\Local\Temp\_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe
  "C:\Users\Admin\AppData\Local\Temp\_ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\mikameta'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\mikameta'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact