cf5702427d2c572de7296211b24ef106103c4266ada9cb16944df8a755c7a000

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6622000003220000.ps1
Size 8KB
Sample260708-vjp3baes4t
SHA256 cf5702427d2c572de7296211b24ef106103c4266ada9cb16944df8a755c7a000
MD5 b3f0a0a7c5f8b2fa32dd509bc28d393c
SHA1 b26eab2d1855e2846006462b4adf8dd5412bf539
SHA512 cc17e75ab5449c14ef91193004f1d8f25b1699aaf5d83ebd29724ba89453320d2eefafa3928b0024f67fa93b0929de56e7a11cf342d4e48d3c98ea1806bc5f66
SSDEEP 192:OXnx9Tk0WqKPnHm5olmVpvU+2mDWaSXptgBxPktV/ahhdaTfufUyARV/:UQ0KPnHm5LvUwDWaSXptgBxPktV/aoT7
TLSH
T10702651E9A15425142F31376AC0B8589FCAA113F4A085B10355CD18DBFB5A2F9AF4FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4624	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
4508	LockScreenContentServer.exe

Loads dropped DLL 1 IoCs

pid	Process
4508	LockScreenContentServer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Logon Key Manager nqxiwl0z = "C:\\ProgramData\\WindowsLogonKeyManager_0cx1vtwa\\LockScreenContentServer.exe"	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4624	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4624	PowerShell.exe
4624	PowerShell.exe
4624	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4692	4624	PowerShell.exe	89
PID 4624 wrote to memory of 1364	4624	PowerShell.exe	90
PID 1364 wrote to memory of 4508	1364	cmd.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4692	attrib.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6622000003220000.ps1
1⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\ProgramData\WindowsLogonKeyManager_0cx1vtwa
  2⤵
  - Views/modifies file attributes
  PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\WindowsLogonKeyManager_0cx1vtwa\LockScreenContentServer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\ProgramData\WindowsLogonKeyManager_0cx1vtwa\LockScreenContentServer.exe
    C:\ProgramData\WindowsLogonKeyManager_0cx1vtwa\LockScreenContentServer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EzHrugYpplmE.png

Path C:\ProgramData\EzHrugYpplmE.png
Size 463KB
SHA256 57f84dd867e3a3857562f6dc08126608cf13a87f717602afb1a2526bddfc4ee7
MD5 a1ec9c76fbe9c74325c8f80841c870e7
SHA1 601b1b824e9d5cd0d5f32764924ef162d99f4ffc
SHA512 0555c36e0af03e1705c1a19698637fb693996ea226a23a10fdd935e436fdcc57e24cba6258ad941d4acd59674f7c55b168066c251d483b161260c6ac006df7fa
SSDEEP 12288:Cudi+v37/S+ezEvhG031clqYIHBPdqVI1T5:ClM37/SkAsclHGVoVU
TLSH
T1A5A42354A1DECA64E12E6264CAF03EEC249E06A24B1B4CF1ED07921D9DC70617BE9F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utg7vP6iX2sQ.png

Path C:\ProgramData\Utg7vP6iX2sQ.png
Size 30KB
SHA256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe
MD5 db26a20f72ca2d01d8c834159b7b5a8d
SHA1 11455dc20e59e5e027ca51914918487b29b5fc2e
SHA512 4f91e7ffaf143ba7ba851bf67a65cbc85f6ee14d1e7c098c1ab661186ac84c3e866381fab6131386557df7ad01378584199d77e38558d257075e63e336fe02bb
SSDEEP 768:N1frXsGi74HUK0o/GkZNAI7n40oIC7wNwfkj:H8f46ouKAx0o/7qwfo
TLSH
T1E3D2F1A21AC895AEDFE9F960A7CF0027587021175F25A64388194C86FDB60E315FF1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DUI70.dll

Path C:\ProgramData\WindowsLogonKeyManager_0cx1vtwa\DUI70.dll
Size 2.0MB
SHA256 906035b6092b2ce1290c566f590e88f1b960b25c6d987f46a3d99cca5b05ee9d
MD5 b2f2473d9058cb975a630485096e6bba
SHA1 9d6c2dd28cefd022b9b63767ce6000fd4e637a11
SHA512 ea35bbea0d2a420073b9099ab9f30f4aa0354ebb963c3cf76abbb86fc02f633530c214fa4c4bc9c71b59dec23ef495f8db753eb070fa24a1d8ea634bf47dacfe
SSDEEP 24576:3S9u7mMJjwtE/v50t/6/Vax3Bc/Tjd2kJKx2ozdoYq9tBGnr5xrYU:3eimMJj6E/c6U9BcLjd2kcxVqVw
TLSH
T191A55B0AB3E80096D0AEF23DE95F460EE3F37541572B86CF225903799E23BD5653A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockScreenContentServer.exe

Path C:\ProgramData\WindowsLogonKeyManager_0cx1vtwa\LockScreenContentServer.exe
Size 48KB
SHA256 de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2
MD5 2cf29ef0ae66fcea7056ae948ffd9541
SHA1 3d493a1afae9b38d3c0953016a00ef3d9ac514a0
SHA512 3fd5a0c603ef7630adfc10e69de373aeb66df75f1830cbe83c68df59cbd27bdbe3fe7394a0549ebf8470b48ad207b122acddddc4c0cb1a3ef5e253a462e5fe4b
SSDEEP 768:eQvZAVIG7PsefP8lAd7MtCwIpS9SL4WZwWCXeG1Po9zvR:ZvIIgL5ta+YFWZwWgeePgzZ
TLSH
T1D6233A49ABBA10C1E5ADD23C606A420AF476F262570706EF5199C33C5F73FD4AE39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nbJOotvrywqK.png

Path C:\ProgramData\nbJOotvrywqK.png
Size 646KB
SHA256 20a0f60d7364766ce7317dd17c0287c72cb2a402872e15fbdeaf9303bcf0ceb7
MD5 27005257dc88ded4c4aaf9c1064db694
SHA1 ddf937f25f659fcb865b249c75d893f86c9a5be1
SHA512 a8b75b5c2a60b620ee3cc892c709a2f2580f16841a0e64029b3d501da07a3761a87900294ceb89c5f9c80b05bca185f8d0d62de0641dfbc73614f8328e322e82
SSDEEP 12288:WCMLDfEC8xgxwoJ1YDv4x1eNDWq9hO0lyokWSlYtdH:WCMHwQwW1TK1O0MoNyYtB
TLSH
T121E433AFB65CBDF0B13B4A714396042B0FDB6818129FF1A92B1E582D87117C4EA0F1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0af8bb5-c090-4acf-bb56-57ff09ca98c3

Path C:\Users\Admin\AppData\Local\Temp\0af8bb5-c090-4acf-bb56-57ff09ca98c3
Size 25KB
SHA256 d13ae7ad2c3bd1233aed55eafde1d8b5163a6dd44406ee2c163a215334078e78
MD5 91729f7fa3cc4a773f2bd34692a424ef
SHA1 6905ccbc7bdc28e6587fe456331458017e7eca4f
SHA512 857c16e9a6e4d734ff1637773712f428fc9de937ff24724a4476cefaf77897bb3cf325bf1a2f7a58f8c663b535b1e4c7d3f49cc5a2c050d23f4e113cbd33a4cc
SSDEEP 768:M1BkAf0eRDH1Ii+8qKeJF5MSaVd2iHtYXmhgZpwBDK0k:MvkAf0eRDH1lteJF5RpwFrk
TLSH
T145C26032944D8C37032B52D979647B5860AF8E36E2968CC6F2FF8D1D5FC6D816E1E062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-23-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-8-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-11-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-14-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-15-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-18-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-0-0x00007FFB3560F000-0x00007FFB35610000-memory.dmp

Download

memory/4624-24-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-25-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-9-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-7-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-56-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-57-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-58-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-6-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-5-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-4-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-90-0x00007FFB35480000-0x00007FFB35E24000-memory.dmp

Download

memory/4624-3-0x0000027ECB650000-0x0000027ECB672000-memory.dmp

Download