dad0994aaf5c4563e20c8c3ff122851cf2219930eed0f3e1eeb079f30afbde6c

Analysis

user interaction
yes
max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Silviozas Premium Proxy.exe
Size 10.8MB
Sample260709-rnkfvaby7j
SHA256 dad0994aaf5c4563e20c8c3ff122851cf2219930eed0f3e1eeb079f30afbde6c
MD5 11470804eb7608b3844cc451b598d4a7
SHA1 802236cc392c4b586ae6a3ed14fe80a64ea9be31
SHA512 d171feac684ce06313dcba6d579e4378bef0012ccd47d23110178514cde0a71e76a7cc2382994ba97229a6b030d8fee360b312da6ebea32276c425d27c4de238
SSDEEP 49152:kRVwASOVGtlqc4IU6it0q+jiGJBEQ+aST9YARWhcB+9RmWkC8s+iKlaj0+Rwjjgg:7H+HfFWkC8s7uzGaGjT0NbCzNaAyr
TLSH
T10AB6F60AEA7691E1D1FAD139C2526627BC323C5DC334A7E38A859B175F267E0E93D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Silviozas Premium Proxy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3100	Silviozas Premium Proxy.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	powershell.exe
Token: SeSecurityPrivilege	3892	powershell.exe
Token: SeTakeOwnershipPrivilege	3892	powershell.exe
Token: SeLoadDriverPrivilege	3892	powershell.exe
Token: SeSystemProfilePrivilege	3892	powershell.exe
Token: SeSystemtimePrivilege	3892	powershell.exe
Token: SeProfSingleProcessPrivilege	3892	powershell.exe
Token: SeIncBasePriorityPrivilege	3892	powershell.exe
Token: SeCreatePagefilePrivilege	3892	powershell.exe
Token: SeBackupPrivilege	3892	powershell.exe
Token: SeRestorePrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeSystemEnvironmentPrivilege	3892	powershell.exe
Token: SeRemoteShutdownPrivilege	3892	powershell.exe
Token: SeUndockPrivilege	3892	powershell.exe
Token: SeManageVolumePrivilege	3892	powershell.exe
Token: 33	3892	powershell.exe
Token: 34	3892	powershell.exe
Token: 35	3892	powershell.exe
Token: 36	3892	powershell.exe
Token: SeDebugPrivilege	3100	Silviozas Premium Proxy.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3820	3100	Silviozas Premium Proxy.exe	89
PID 3820 wrote to memory of 6112	3820	cmd.exe	90
PID 3820 wrote to memory of 4316	3820	cmd.exe	91
PID 3820 wrote to memory of 2200	3820	cmd.exe	92
PID 3100 wrote to memory of 5804	3100	Silviozas Premium Proxy.exe	93
PID 5804 wrote to memory of 6096	5804	cmd.exe	94
PID 5804 wrote to memory of 5980	5804	cmd.exe	95
PID 5804 wrote to memory of 5992	5804	cmd.exe	96
PID 3100 wrote to memory of 6056	3100	Silviozas Premium Proxy.exe	97
PID 6056 wrote to memory of 3644	6056	cmd.exe	98
PID 6056 wrote to memory of 4240	6056	cmd.exe	99
PID 6056 wrote to memory of 3388	6056	cmd.exe	100
PID 3100 wrote to memory of 3048	3100	Silviozas Premium Proxy.exe	101
PID 3048 wrote to memory of 1568	3048	cmd.exe	102
PID 3048 wrote to memory of 1344	3048	cmd.exe	103
PID 3048 wrote to memory of 5348	3048	cmd.exe	104
PID 3100 wrote to memory of 5008	3100	Silviozas Premium Proxy.exe	105
PID 5008 wrote to memory of 3052	5008	cmd.exe	106
PID 5008 wrote to memory of 3028	5008	cmd.exe	107
PID 5008 wrote to memory of 5244	5008	cmd.exe	108
PID 3100 wrote to memory of 2316	3100	Silviozas Premium Proxy.exe	109
PID 2316 wrote to memory of 2876	2316	cmd.exe	110
PID 2316 wrote to memory of 5796	2316	cmd.exe	111
PID 2316 wrote to memory of 2604	2316	cmd.exe	112
PID 3100 wrote to memory of 1696	3100	Silviozas Premium Proxy.exe	113
PID 1696 wrote to memory of 3964	1696	cmd.exe	114
PID 1696 wrote to memory of 984	1696	cmd.exe	115
PID 1696 wrote to memory of 2716	1696	cmd.exe	116
PID 3100 wrote to memory of 3652	3100	Silviozas Premium Proxy.exe	117
PID 3100 wrote to memory of 4196	3100	Silviozas Premium Proxy.exe	118
PID 4196 wrote to memory of 3892	4196	cmd.exe	119
PID 3100 wrote to memory of 3500	3100	Silviozas Premium Proxy.exe	121
PID 3500 wrote to memory of 4144	3500	cmd.exe	122
PID 3500 wrote to memory of 2996	3500	cmd.exe	123
PID 3500 wrote to memory of 696	3500	cmd.exe	124
PID 3100 wrote to memory of 1108	3100	Silviozas Premium Proxy.exe	125

C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe
"C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:6112
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4316
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:6096
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5980
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:3644
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4240
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:1568
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1344
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:3052
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3028
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:2876
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5796
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:3964
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:984
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0A
  2⤵
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Add-MpPreference -ExclusionPath 'C:\Users\Public\Proxy_Stuff\Silviozas Premium Proxy.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-MpPreference -ExclusionPath 'C:\Users\Public\Proxy_Stuff\Silviozas Premium Proxy.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Silviozas Premium Proxy.exe" MD5
    3⤵
    PID:4144
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2996
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0A
  2⤵
  PID:1108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-17-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-18-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-25-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-14-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-20-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-12-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-15-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-22-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-13-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3100-0-0x0000000140000000-0x0000000140AD5000-memory.dmp

Download

memory/3892-4-0x0000022B4AC40000-0x0000022B4AC62000-memory.dmp

Download

memory/3892-9-0x0000022B4B000000-0x0000022B4B00A000-memory.dmp

Download

memory/3892-7-0x0000022B4AF20000-0x0000022B4AF3E000-memory.dmp

Download

memory/3892-8-0x0000022B4AF40000-0x0000022B4AFF2000-memory.dmp

Download