6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b

Analysis

max time kernel
150s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
Size 13.6MB
Sample260710-egf4mad14x
SHA256 6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b
MD5 914f0b43128f5ede1083809ab35b144c
SHA1 daa33e089ca3b9adbbf5bf3b12153c6323cd01d2
SHA512 7a7aba461f0de616e9501fe09255958983bdd9df0a08c07e9dc2acb603adf2344e6f65d231ca58898cf308e32f538e0019059a524faea9c3c8e23276f4968aaa
SSDEEP 393216:Vmqgf2Ssw+WfafHFBJcpzDFCaQuZy4XMCHWUjX7cuI3/PGTAI:VPJS+VNHcWaQu84XMb8X4H/O7
TLSH
T16CE6332878D000EAEAB3413CEED191A9E869B8A50736DC9F97D4D2B57D531D04E3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6008	powershell.exe
5980	powershell.exe
240	powershell.exe
936	powershell.exe
1608	powershell.exe
2888	powershell.exe
3688	powershell.exe
5116	powershell.exe
4228	powershell.exe
364	powershell.exe
2664	powershell.exe
5960	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
4228	powershell.exe
4228	powershell.exe
364	powershell.exe
364	powershell.exe
2664	powershell.exe
2664	powershell.exe
5960	powershell.exe
5960	powershell.exe
936	powershell.exe
936	powershell.exe
6008	powershell.exe
6008	powershell.exe
5980	powershell.exe
5980	powershell.exe
1608	powershell.exe
1608	powershell.exe
2888	powershell.exe
2888	powershell.exe
3688	powershell.exe
3688	powershell.exe
5116	powershell.exe
5116	powershell.exe
240	powershell.exe
240	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	powershell.exe
Token: SeSecurityPrivilege	4228	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	powershell.exe
Token: SeLoadDriverPrivilege	4228	powershell.exe
Token: SeSystemProfilePrivilege	4228	powershell.exe
Token: SeSystemtimePrivilege	4228	powershell.exe
Token: SeProfSingleProcessPrivilege	4228	powershell.exe
Token: SeIncBasePriorityPrivilege	4228	powershell.exe
Token: SeCreatePagefilePrivilege	4228	powershell.exe
Token: SeBackupPrivilege	4228	powershell.exe
Token: SeRestorePrivilege	4228	powershell.exe
Token: SeShutdownPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeSystemEnvironmentPrivilege	4228	powershell.exe
Token: SeRemoteShutdownPrivilege	4228	powershell.exe
Token: SeUndockPrivilege	4228	powershell.exe
Token: SeManageVolumePrivilege	4228	powershell.exe
Token: 33	4228	powershell.exe
Token: 34	4228	powershell.exe
Token: 35	4228	powershell.exe
Token: 36	4228	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeIncreaseQuotaPrivilege	364	powershell.exe
Token: SeSecurityPrivilege	364	powershell.exe
Token: SeTakeOwnershipPrivilege	364	powershell.exe
Token: SeLoadDriverPrivilege	364	powershell.exe
Token: SeSystemProfilePrivilege	364	powershell.exe
Token: SeSystemtimePrivilege	364	powershell.exe
Token: SeProfSingleProcessPrivilege	364	powershell.exe
Token: SeIncBasePriorityPrivilege	364	powershell.exe
Token: SeCreatePagefilePrivilege	364	powershell.exe
Token: SeBackupPrivilege	364	powershell.exe
Token: SeRestorePrivilege	364	powershell.exe
Token: SeShutdownPrivilege	364	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeSystemEnvironmentPrivilege	364	powershell.exe
Token: SeRemoteShutdownPrivilege	364	powershell.exe
Token: SeUndockPrivilege	364	powershell.exe
Token: SeManageVolumePrivilege	364	powershell.exe
Token: 33	364	powershell.exe
Token: 34	364	powershell.exe
Token: 35	364	powershell.exe
Token: 36	364	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeIncreaseQuotaPrivilege	2664	powershell.exe
Token: SeSecurityPrivilege	2664	powershell.exe
Token: SeTakeOwnershipPrivilege	2664	powershell.exe
Token: SeLoadDriverPrivilege	2664	powershell.exe
Token: SeSystemProfilePrivilege	2664	powershell.exe
Token: SeSystemtimePrivilege	2664	powershell.exe
Token: SeProfSingleProcessPrivilege	2664	powershell.exe
Token: SeIncBasePriorityPrivilege	2664	powershell.exe
Token: SeCreatePagefilePrivilege	2664	powershell.exe
Token: SeBackupPrivilege	2664	powershell.exe
Token: SeRestorePrivilege	2664	powershell.exe
Token: SeShutdownPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeSystemEnvironmentPrivilege	2664	powershell.exe
Token: SeRemoteShutdownPrivilege	2664	powershell.exe
Token: SeUndockPrivilege	2664	powershell.exe
Token: SeManageVolumePrivilege	2664	powershell.exe
Token: 33	2664	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4920	2884	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	85
PID 4920 wrote to memory of 4672	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	86
PID 4672 wrote to memory of 4228	4672	cmd.exe	88
PID 4920 wrote to memory of 4984	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	90
PID 4984 wrote to memory of 364	4984	cmd.exe	92
PID 4920 wrote to memory of 1572	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	93
PID 1572 wrote to memory of 2664	1572	cmd.exe	95
PID 4920 wrote to memory of 4356	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	96
PID 4356 wrote to memory of 5960	4356	cmd.exe	98
PID 4920 wrote to memory of 2104	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	99
PID 2104 wrote to memory of 936	2104	cmd.exe	101
PID 4920 wrote to memory of 5588	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	102
PID 5588 wrote to memory of 6008	5588	cmd.exe	104
PID 4920 wrote to memory of 4828	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	105
PID 4828 wrote to memory of 5980	4828	cmd.exe	107
PID 4920 wrote to memory of 4668	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	108
PID 4668 wrote to memory of 1608	4668	cmd.exe	110
PID 4920 wrote to memory of 4024	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	111
PID 4024 wrote to memory of 2888	4024	cmd.exe	113
PID 4920 wrote to memory of 1188	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	114
PID 1188 wrote to memory of 3688	1188	cmd.exe	116
PID 4920 wrote to memory of 2728	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	117
PID 2728 wrote to memory of 5116	2728	cmd.exe	119
PID 4920 wrote to memory of 1464	4920	_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe	120
PID 1464 wrote to memory of 240	1464	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
"C:\Users\Admin\AppData\Local\Temp\_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe
  "C:\Users\Admin\AppData\Local\Temp\_6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact