886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
Size 13.6MB
Sample260712-ccrnfses4t
SHA256 886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54
MD5 d8156051e4f18c42cc2c459e1ad0172f
SHA1 8e385c455f796264c8ffad0c35e32b244fa1556c
SHA512 1d60e6d7f0c0a5f372a155981d53908c5eeffb5982938c2c976c547042908d948c89e14cf88d92d6152436a2884b6f8e62612d17365347ffea3ab83cda6faf89
SSDEEP 393216:Oe04wr8F+CN9kdZsobN1XMCHWUjXHcuI3/PGTAI:OhYFhNmTXMb8X8H/O7
TLSH
T1C3E63358F6E023EDE6A38138DEF285A4E56174B50732C8DB177C8A55AE272D00E3E753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe
4268	powershell.exe
4112	powershell.exe
4144	powershell.exe
4896	powershell.exe
4468	powershell.exe
2592	powershell.exe
3740	powershell.exe
2516	powershell.exe
5032	powershell.exe
2632	powershell.exe
3944	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
2780	powershell.exe
2780	powershell.exe
4268	powershell.exe
4268	powershell.exe
3740	powershell.exe
3740	powershell.exe
4112	powershell.exe
4112	powershell.exe
2516	powershell.exe
2516	powershell.exe
4144	powershell.exe
4144	powershell.exe
4896	powershell.exe
4896	powershell.exe
4468	powershell.exe
4468	powershell.exe
2592	powershell.exe
2592	powershell.exe
5032	powershell.exe
5032	powershell.exe
2632	powershell.exe
2632	powershell.exe
3944	powershell.exe
3944	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2780	powershell.exe
Token: SeSecurityPrivilege	2780	powershell.exe
Token: SeTakeOwnershipPrivilege	2780	powershell.exe
Token: SeLoadDriverPrivilege	2780	powershell.exe
Token: SeSystemProfilePrivilege	2780	powershell.exe
Token: SeSystemtimePrivilege	2780	powershell.exe
Token: SeProfSingleProcessPrivilege	2780	powershell.exe
Token: SeIncBasePriorityPrivilege	2780	powershell.exe
Token: SeCreatePagefilePrivilege	2780	powershell.exe
Token: SeBackupPrivilege	2780	powershell.exe
Token: SeRestorePrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeSystemEnvironmentPrivilege	2780	powershell.exe
Token: SeRemoteShutdownPrivilege	2780	powershell.exe
Token: SeUndockPrivilege	2780	powershell.exe
Token: SeManageVolumePrivilege	2780	powershell.exe
Token: 33	2780	powershell.exe
Token: 34	2780	powershell.exe
Token: 35	2780	powershell.exe
Token: 36	2780	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeIncreaseQuotaPrivilege	4268	powershell.exe
Token: SeSecurityPrivilege	4268	powershell.exe
Token: SeTakeOwnershipPrivilege	4268	powershell.exe
Token: SeLoadDriverPrivilege	4268	powershell.exe
Token: SeSystemProfilePrivilege	4268	powershell.exe
Token: SeSystemtimePrivilege	4268	powershell.exe
Token: SeProfSingleProcessPrivilege	4268	powershell.exe
Token: SeIncBasePriorityPrivilege	4268	powershell.exe
Token: SeCreatePagefilePrivilege	4268	powershell.exe
Token: SeBackupPrivilege	4268	powershell.exe
Token: SeRestorePrivilege	4268	powershell.exe
Token: SeShutdownPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeSystemEnvironmentPrivilege	4268	powershell.exe
Token: SeRemoteShutdownPrivilege	4268	powershell.exe
Token: SeUndockPrivilege	4268	powershell.exe
Token: SeManageVolumePrivilege	4268	powershell.exe
Token: 33	4268	powershell.exe
Token: 34	4268	powershell.exe
Token: 35	4268	powershell.exe
Token: 36	4268	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeIncreaseQuotaPrivilege	3740	powershell.exe
Token: SeSecurityPrivilege	3740	powershell.exe
Token: SeTakeOwnershipPrivilege	3740	powershell.exe
Token: SeLoadDriverPrivilege	3740	powershell.exe
Token: SeSystemProfilePrivilege	3740	powershell.exe
Token: SeSystemtimePrivilege	3740	powershell.exe
Token: SeProfSingleProcessPrivilege	3740	powershell.exe
Token: SeIncBasePriorityPrivilege	3740	powershell.exe
Token: SeCreatePagefilePrivilege	3740	powershell.exe
Token: SeBackupPrivilege	3740	powershell.exe
Token: SeRestorePrivilege	3740	powershell.exe
Token: SeShutdownPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeSystemEnvironmentPrivilege	3740	powershell.exe
Token: SeRemoteShutdownPrivilege	3740	powershell.exe
Token: SeUndockPrivilege	3740	powershell.exe
Token: SeManageVolumePrivilege	3740	powershell.exe
Token: 33	3740	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5776	5108	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	87
PID 5776 wrote to memory of 5444	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	88
PID 5444 wrote to memory of 2780	5444	cmd.exe	90
PID 5776 wrote to memory of 4312	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	92
PID 4312 wrote to memory of 4268	4312	cmd.exe	94
PID 5776 wrote to memory of 6108	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	95
PID 6108 wrote to memory of 3740	6108	cmd.exe	97
PID 5776 wrote to memory of 5980	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	98
PID 5980 wrote to memory of 4112	5980	cmd.exe	100
PID 5776 wrote to memory of 2180	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	101
PID 2180 wrote to memory of 2516	2180	cmd.exe	103
PID 5776 wrote to memory of 5816	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	104
PID 5816 wrote to memory of 4144	5816	cmd.exe	106
PID 5776 wrote to memory of 4132	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	107
PID 4132 wrote to memory of 4896	4132	cmd.exe	109
PID 5776 wrote to memory of 972	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	110
PID 972 wrote to memory of 4468	972	cmd.exe	112
PID 5776 wrote to memory of 1304	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	113
PID 1304 wrote to memory of 2592	1304	cmd.exe	115
PID 5776 wrote to memory of 2564	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	116
PID 2564 wrote to memory of 5032	2564	cmd.exe	118
PID 5776 wrote to memory of 4788	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	119
PID 4788 wrote to memory of 2632	4788	cmd.exe	121
PID 5776 wrote to memory of 4400	5776	_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe	122
PID 4400 wrote to memory of 3944	4400	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
"C:\Users\Admin\AppData\Local\Temp\_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe
  "C:\Users\Admin\AppData\Local\Temp\_886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact