e005f4371595d366f009d37294af1a6f894fbcad4487f92a50124237523f4ec1

Analysis

user interaction
yes
max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01_default.exe
Size 13.6MB
Sample260709-snretsdw41
SHA256 e005f4371595d366f009d37294af1a6f894fbcad4487f92a50124237523f4ec1
MD5 a5e54656b4967f3399969170ee6263cd
SHA1 ebdbfb0cd5aff1a15c70070bf57854e4f480c2ef
SHA512 1a69e3d0838aa7e3dedf22cdd5898f147b64ecb58c9df48614e0dbb73b5b4632d18253ab167c48774044ba80413cb742b9ac64d5deb06a5d58035ceb4a71adfe
SSDEEP 393216:C4bF3zQsXzBrNPjncobyeVTWXMCHWUjXrcuI3/PGTAI:C4blJBhn9xWXMb8XIH/O7
TLSH
T18DE6330889D110FDD1B3043CEAA25694D94A70710B75CBCF47B8DBA16E63AE38CB5B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1400	powershell.exe
3396	powershell.exe
3348	powershell.exe
2292	powershell.exe
1396	powershell.exe
5572	powershell.exe
1504	powershell.exe
3872	powershell.exe
1412	powershell.exe
4504	powershell.exe
5336	powershell.exe
2992	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe
4248	01_default.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4248	01_default.exe
4248	01_default.exe
1400	powershell.exe
1400	powershell.exe
3396	powershell.exe
3396	powershell.exe
3348	powershell.exe
3348	powershell.exe
2292	powershell.exe
2292	powershell.exe
1396	powershell.exe
1396	powershell.exe
5572	powershell.exe
5572	powershell.exe
1412	powershell.exe
1412	powershell.exe
1504	powershell.exe
1504	powershell.exe
3872	powershell.exe
3872	powershell.exe
4504	powershell.exe
4504	powershell.exe
5336	powershell.exe
5336	powershell.exe
2992	powershell.exe
2992	powershell.exe
5116	powershell.exe
5116	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	01_default.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeIncreaseQuotaPrivilege	1400	powershell.exe
Token: SeSecurityPrivilege	1400	powershell.exe
Token: SeTakeOwnershipPrivilege	1400	powershell.exe
Token: SeLoadDriverPrivilege	1400	powershell.exe
Token: SeSystemProfilePrivilege	1400	powershell.exe
Token: SeSystemtimePrivilege	1400	powershell.exe
Token: SeProfSingleProcessPrivilege	1400	powershell.exe
Token: SeIncBasePriorityPrivilege	1400	powershell.exe
Token: SeCreatePagefilePrivilege	1400	powershell.exe
Token: SeBackupPrivilege	1400	powershell.exe
Token: SeRestorePrivilege	1400	powershell.exe
Token: SeShutdownPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeSystemEnvironmentPrivilege	1400	powershell.exe
Token: SeRemoteShutdownPrivilege	1400	powershell.exe
Token: SeUndockPrivilege	1400	powershell.exe
Token: SeManageVolumePrivilege	1400	powershell.exe
Token: 33	1400	powershell.exe
Token: 34	1400	powershell.exe
Token: 35	1400	powershell.exe
Token: 36	1400	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeIncreaseQuotaPrivilege	3396	powershell.exe
Token: SeSecurityPrivilege	3396	powershell.exe
Token: SeTakeOwnershipPrivilege	3396	powershell.exe
Token: SeLoadDriverPrivilege	3396	powershell.exe
Token: SeSystemProfilePrivilege	3396	powershell.exe
Token: SeSystemtimePrivilege	3396	powershell.exe
Token: SeProfSingleProcessPrivilege	3396	powershell.exe
Token: SeIncBasePriorityPrivilege	3396	powershell.exe
Token: SeCreatePagefilePrivilege	3396	powershell.exe
Token: SeBackupPrivilege	3396	powershell.exe
Token: SeRestorePrivilege	3396	powershell.exe
Token: SeShutdownPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeSystemEnvironmentPrivilege	3396	powershell.exe
Token: SeRemoteShutdownPrivilege	3396	powershell.exe
Token: SeUndockPrivilege	3396	powershell.exe
Token: SeManageVolumePrivilege	3396	powershell.exe
Token: 33	3396	powershell.exe
Token: 34	3396	powershell.exe
Token: 35	3396	powershell.exe
Token: 36	3396	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	3348	powershell.exe
Token: SeSecurityPrivilege	3348	powershell.exe
Token: SeTakeOwnershipPrivilege	3348	powershell.exe
Token: SeLoadDriverPrivilege	3348	powershell.exe
Token: SeSystemProfilePrivilege	3348	powershell.exe
Token: SeSystemtimePrivilege	3348	powershell.exe
Token: SeProfSingleProcessPrivilege	3348	powershell.exe
Token: SeIncBasePriorityPrivilege	3348	powershell.exe
Token: SeCreatePagefilePrivilege	3348	powershell.exe
Token: SeBackupPrivilege	3348	powershell.exe
Token: SeRestorePrivilege	3348	powershell.exe
Token: SeShutdownPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeSystemEnvironmentPrivilege	3348	powershell.exe
Token: SeRemoteShutdownPrivilege	3348	powershell.exe
Token: SeUndockPrivilege	3348	powershell.exe
Token: SeManageVolumePrivilege	3348	powershell.exe
Token: 33	3348	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4248	4840	01_default.exe	88
PID 4248 wrote to memory of 1240	4248	01_default.exe	89
PID 1240 wrote to memory of 1400	1240	cmd.exe	91
PID 4248 wrote to memory of 912	4248	01_default.exe	93
PID 912 wrote to memory of 3396	912	cmd.exe	95
PID 4248 wrote to memory of 1084	4248	01_default.exe	96
PID 1084 wrote to memory of 3348	1084	cmd.exe	98
PID 4248 wrote to memory of 4060	4248	01_default.exe	99
PID 4060 wrote to memory of 2292	4060	cmd.exe	101
PID 4248 wrote to memory of 4104	4248	01_default.exe	102
PID 4104 wrote to memory of 1396	4104	cmd.exe	104
PID 4248 wrote to memory of 1536	4248	01_default.exe	105
PID 1536 wrote to memory of 5572	1536	cmd.exe	107
PID 4248 wrote to memory of 5820	4248	01_default.exe	108
PID 5820 wrote to memory of 1412	5820	cmd.exe	110
PID 4248 wrote to memory of 5836	4248	01_default.exe	111
PID 5836 wrote to memory of 1504	5836	cmd.exe	113
PID 4248 wrote to memory of 4032	4248	01_default.exe	114
PID 4032 wrote to memory of 3872	4032	cmd.exe	116
PID 4248 wrote to memory of 6116	4248	01_default.exe	117
PID 6116 wrote to memory of 4504	6116	cmd.exe	119
PID 4248 wrote to memory of 4700	4248	01_default.exe	120
PID 4700 wrote to memory of 5336	4700	cmd.exe	122
PID 4248 wrote to memory of 4808	4248	01_default.exe	123
PID 4808 wrote to memory of 2992	4808	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\01_default.exe
"C:\Users\Admin\AppData\Local\Temp\01_default.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\01_default.exe
  "C:\Users\Admin\AppData\Local\Temp\01_default.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rekigema'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:5628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact