8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61

Analysis

max time kernel
29s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
Size 13.6MB
Sample260708-kceb5aet5j
SHA256 8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61
MD5 6e1979f470580841f5f5b0144d630ef0
SHA1 86fe7ed37744c99a8d0c37e06bf89cf654587786
SHA512 49954b148639b25ee8135b68b66b0acfe888e38aef46717b89c99fae1e78c2ccff44399ea2dddff961ff2e6322b74791e3bc2e0a6dc8edf90559b8a3bb7e5de5
SSDEEP 393216:ZE3UiGM3MEUztLu+D38oTXMCHWUjX1cuI3/PGTAI:y3UjoUztPj8cXMb8XCH/O7
TLSH
T101E63348BAC405EEE673813CDDE35995D17274F50731CACB0BA49B5ABD670A0CC3A6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6036	powershell.exe
3120	powershell.exe
4416	powershell.exe
2636	powershell.exe
5704	powershell.exe
4464	powershell.exe
5512	powershell.exe
2216	powershell.exe
2760	powershell.exe
1064	powershell.exe
1240	powershell.exe
5020	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
5704	powershell.exe
5704	powershell.exe
6036	powershell.exe
6036	powershell.exe
4464	powershell.exe
4464	powershell.exe
5512	powershell.exe
5512	powershell.exe
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeIncreaseQuotaPrivilege	5704	powershell.exe
Token: SeSecurityPrivilege	5704	powershell.exe
Token: SeTakeOwnershipPrivilege	5704	powershell.exe
Token: SeLoadDriverPrivilege	5704	powershell.exe
Token: SeSystemProfilePrivilege	5704	powershell.exe
Token: SeSystemtimePrivilege	5704	powershell.exe
Token: SeProfSingleProcessPrivilege	5704	powershell.exe
Token: SeIncBasePriorityPrivilege	5704	powershell.exe
Token: SeCreatePagefilePrivilege	5704	powershell.exe
Token: SeBackupPrivilege	5704	powershell.exe
Token: SeRestorePrivilege	5704	powershell.exe
Token: SeShutdownPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeSystemEnvironmentPrivilege	5704	powershell.exe
Token: SeRemoteShutdownPrivilege	5704	powershell.exe
Token: SeUndockPrivilege	5704	powershell.exe
Token: SeManageVolumePrivilege	5704	powershell.exe
Token: 33	5704	powershell.exe
Token: 34	5704	powershell.exe
Token: 35	5704	powershell.exe
Token: 36	5704	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeIncreaseQuotaPrivilege	6036	powershell.exe
Token: SeSecurityPrivilege	6036	powershell.exe
Token: SeTakeOwnershipPrivilege	6036	powershell.exe
Token: SeLoadDriverPrivilege	6036	powershell.exe
Token: SeSystemProfilePrivilege	6036	powershell.exe
Token: SeSystemtimePrivilege	6036	powershell.exe
Token: SeProfSingleProcessPrivilege	6036	powershell.exe
Token: SeIncBasePriorityPrivilege	6036	powershell.exe
Token: SeCreatePagefilePrivilege	6036	powershell.exe
Token: SeBackupPrivilege	6036	powershell.exe
Token: SeRestorePrivilege	6036	powershell.exe
Token: SeShutdownPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeSystemEnvironmentPrivilege	6036	powershell.exe
Token: SeRemoteShutdownPrivilege	6036	powershell.exe
Token: SeUndockPrivilege	6036	powershell.exe
Token: SeManageVolumePrivilege	6036	powershell.exe
Token: 33	6036	powershell.exe
Token: 34	6036	powershell.exe
Token: 35	6036	powershell.exe
Token: 36	6036	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4464	powershell.exe
Token: SeSecurityPrivilege	4464	powershell.exe
Token: SeTakeOwnershipPrivilege	4464	powershell.exe
Token: SeLoadDriverPrivilege	4464	powershell.exe
Token: SeSystemProfilePrivilege	4464	powershell.exe
Token: SeSystemtimePrivilege	4464	powershell.exe
Token: SeProfSingleProcessPrivilege	4464	powershell.exe
Token: SeIncBasePriorityPrivilege	4464	powershell.exe
Token: SeCreatePagefilePrivilege	4464	powershell.exe
Token: SeBackupPrivilege	4464	powershell.exe
Token: SeRestorePrivilege	4464	powershell.exe
Token: SeShutdownPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeSystemEnvironmentPrivilege	4464	powershell.exe
Token: SeRemoteShutdownPrivilege	4464	powershell.exe
Token: SeUndockPrivilege	4464	powershell.exe
Token: SeManageVolumePrivilege	4464	powershell.exe
Token: 33	4464	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2288	800	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe	89
PID 2288 wrote to memory of 4824	2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe	90
PID 4824 wrote to memory of 5704	4824	cmd.exe	92
PID 2288 wrote to memory of 5836	2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe	94
PID 5836 wrote to memory of 6036	5836	cmd.exe	96
PID 2288 wrote to memory of 4812	2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe	97
PID 4812 wrote to memory of 4464	4812	cmd.exe	99
PID 2288 wrote to memory of 2996	2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe	100
PID 2996 wrote to memory of 5512	2996	cmd.exe	102
PID 2288 wrote to memory of 1432	2288	8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe	103
PID 1432 wrote to memory of 2216	1432	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
"C:\Users\Admin\AppData\Local\Temp\8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe
  "C:\Users\Admin\AppData\Local\Temp\8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\mikameta'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\mikameta'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    PID:5284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    PID:2356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    PID:3504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    PID:4580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    PID:5628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    PID:2108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    PID:2920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact