d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
Size 13.6MB
Sample260710-ymst6aax2y
SHA256 d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de
MD5 c6a22bc6d1025589aed446466980d1ad
SHA1 85a6bb9ba170d55b36a3cf476343ec0dfed06269
SHA512 743a5404998f924847e15fa1d1b0dd33833e6641c83250dae6c7f221792087e0a52db1a8bca97bbf7adddee174ce4e605a48d15e8d1df74131c0ab8139396230
SSDEEP 393216:XUXl1D0+WYh39h/rhUy3/u+XMCHWUjX/cuI3/PGTAI:Xa5WYJ/rCy32+XMb8XUH/O7
TLSH
T12DE6330863F041FFFA67403C9EA16966D7A978274B31C68F5BE41269BC072E09C3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1296	powershell.exe
3304	powershell.exe
5816	powershell.exe
4808	powershell.exe
3124	powershell.exe
4964	powershell.exe
1576	powershell.exe
4616	powershell.exe
3160	powershell.exe
6008	powershell.exe
5308	powershell.exe
2748	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
3124	powershell.exe
3124	powershell.exe
4964	powershell.exe
4964	powershell.exe
1576	powershell.exe
1576	powershell.exe
4616	powershell.exe
4616	powershell.exe
1296	powershell.exe
1296	powershell.exe
3160	powershell.exe
3160	powershell.exe
3304	powershell.exe
3304	powershell.exe
6008	powershell.exe
6008	powershell.exe
5816	powershell.exe
5816	powershell.exe
5308	powershell.exe
5308	powershell.exe
4808	powershell.exe
4808	powershell.exe
2748	powershell.exe
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeIncreaseQuotaPrivilege	3124	powershell.exe
Token: SeSecurityPrivilege	3124	powershell.exe
Token: SeTakeOwnershipPrivilege	3124	powershell.exe
Token: SeLoadDriverPrivilege	3124	powershell.exe
Token: SeSystemProfilePrivilege	3124	powershell.exe
Token: SeSystemtimePrivilege	3124	powershell.exe
Token: SeProfSingleProcessPrivilege	3124	powershell.exe
Token: SeIncBasePriorityPrivilege	3124	powershell.exe
Token: SeCreatePagefilePrivilege	3124	powershell.exe
Token: SeBackupPrivilege	3124	powershell.exe
Token: SeRestorePrivilege	3124	powershell.exe
Token: SeShutdownPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeSystemEnvironmentPrivilege	3124	powershell.exe
Token: SeRemoteShutdownPrivilege	3124	powershell.exe
Token: SeUndockPrivilege	3124	powershell.exe
Token: SeManageVolumePrivilege	3124	powershell.exe
Token: 33	3124	powershell.exe
Token: 34	3124	powershell.exe
Token: 35	3124	powershell.exe
Token: 36	3124	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeIncreaseQuotaPrivilege	4964	powershell.exe
Token: SeSecurityPrivilege	4964	powershell.exe
Token: SeTakeOwnershipPrivilege	4964	powershell.exe
Token: SeLoadDriverPrivilege	4964	powershell.exe
Token: SeSystemProfilePrivilege	4964	powershell.exe
Token: SeSystemtimePrivilege	4964	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	powershell.exe
Token: SeIncBasePriorityPrivilege	4964	powershell.exe
Token: SeCreatePagefilePrivilege	4964	powershell.exe
Token: SeBackupPrivilege	4964	powershell.exe
Token: SeRestorePrivilege	4964	powershell.exe
Token: SeShutdownPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeSystemEnvironmentPrivilege	4964	powershell.exe
Token: SeRemoteShutdownPrivilege	4964	powershell.exe
Token: SeUndockPrivilege	4964	powershell.exe
Token: SeManageVolumePrivilege	4964	powershell.exe
Token: 33	4964	powershell.exe
Token: 34	4964	powershell.exe
Token: 35	4964	powershell.exe
Token: 36	4964	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 5844	5940	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	87
PID 5844 wrote to memory of 4488	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	88
PID 4488 wrote to memory of 3124	4488	cmd.exe	90
PID 5844 wrote to memory of 5732	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	92
PID 5732 wrote to memory of 4964	5732	cmd.exe	94
PID 5844 wrote to memory of 1228	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	95
PID 1228 wrote to memory of 1576	1228	cmd.exe	97
PID 5844 wrote to memory of 5396	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	98
PID 5396 wrote to memory of 4616	5396	cmd.exe	100
PID 5844 wrote to memory of 1060	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	101
PID 1060 wrote to memory of 1296	1060	cmd.exe	103
PID 5844 wrote to memory of 1368	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	104
PID 1368 wrote to memory of 3160	1368	cmd.exe	106
PID 5844 wrote to memory of 1504	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	107
PID 1504 wrote to memory of 3304	1504	cmd.exe	109
PID 5844 wrote to memory of 2732	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	110
PID 2732 wrote to memory of 6008	2732	cmd.exe	112
PID 5844 wrote to memory of 2384	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	113
PID 2384 wrote to memory of 5816	2384	cmd.exe	115
PID 5844 wrote to memory of 3792	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	116
PID 3792 wrote to memory of 5308	3792	cmd.exe	118
PID 5844 wrote to memory of 4072	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	119
PID 4072 wrote to memory of 4808	4072	cmd.exe	121
PID 5844 wrote to memory of 4292	5844	_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe	122
PID 4292 wrote to memory of 2748	4292	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
"C:\Users\Admin\AppData\Local\Temp\_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Users\Admin\AppData\Local\Temp\_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe
  "C:\Users\Admin\AppData\Local\Temp\_d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact