b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
Size 13.7MB
Sample260712-gm5qaae17v
SHA256 b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5
MD5 5fa10ea66e86576a410e05a0dae50764
SHA1 2d1cd541435d3cb15358bfdfb05f3c18b3697338
SHA512 bbc278c3b656df065b61f01340ba2232d4c8e23fda9eef682bb1901f6bb121ef9d29c3613e3365af7df7ffb4d3279364a0519cd58b9c62ca77db33e69e0685b1
SSDEEP 393216:ugCDFogfq1bq4jjXMCHWUjX5cuI3/PGTAI:ufi1b33XMb8XOH/O7
TLSH
T146E633186AE011FFE673953CE9A2A986E6A5F4652731CA9F07D043B25F032D00D3DB97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6080	powershell.exe
4688	powershell.exe
4232	powershell.exe
2808	powershell.exe
4264	powershell.exe
1976	powershell.exe
1076	powershell.exe
120	powershell.exe
1864	powershell.exe
3672	powershell.exe
2008	powershell.exe
5444	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
1076	powershell.exe
1076	powershell.exe
6080	powershell.exe
6080	powershell.exe
120	powershell.exe
120	powershell.exe
4688	powershell.exe
4688	powershell.exe
1864	powershell.exe
1864	powershell.exe
3672	powershell.exe
3672	powershell.exe
4232	powershell.exe
4232	powershell.exe
2008	powershell.exe
2008	powershell.exe
2808	powershell.exe
2808	powershell.exe
5444	powershell.exe
5444	powershell.exe
4264	powershell.exe
4264	powershell.exe
1976	powershell.exe
1976	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeIncreaseQuotaPrivilege	1076	powershell.exe
Token: SeSecurityPrivilege	1076	powershell.exe
Token: SeTakeOwnershipPrivilege	1076	powershell.exe
Token: SeLoadDriverPrivilege	1076	powershell.exe
Token: SeSystemProfilePrivilege	1076	powershell.exe
Token: SeSystemtimePrivilege	1076	powershell.exe
Token: SeProfSingleProcessPrivilege	1076	powershell.exe
Token: SeIncBasePriorityPrivilege	1076	powershell.exe
Token: SeCreatePagefilePrivilege	1076	powershell.exe
Token: SeBackupPrivilege	1076	powershell.exe
Token: SeRestorePrivilege	1076	powershell.exe
Token: SeShutdownPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeSystemEnvironmentPrivilege	1076	powershell.exe
Token: SeRemoteShutdownPrivilege	1076	powershell.exe
Token: SeUndockPrivilege	1076	powershell.exe
Token: SeManageVolumePrivilege	1076	powershell.exe
Token: 33	1076	powershell.exe
Token: 34	1076	powershell.exe
Token: 35	1076	powershell.exe
Token: 36	1076	powershell.exe
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeIncreaseQuotaPrivilege	6080	powershell.exe
Token: SeSecurityPrivilege	6080	powershell.exe
Token: SeTakeOwnershipPrivilege	6080	powershell.exe
Token: SeLoadDriverPrivilege	6080	powershell.exe
Token: SeSystemProfilePrivilege	6080	powershell.exe
Token: SeSystemtimePrivilege	6080	powershell.exe
Token: SeProfSingleProcessPrivilege	6080	powershell.exe
Token: SeIncBasePriorityPrivilege	6080	powershell.exe
Token: SeCreatePagefilePrivilege	6080	powershell.exe
Token: SeBackupPrivilege	6080	powershell.exe
Token: SeRestorePrivilege	6080	powershell.exe
Token: SeShutdownPrivilege	6080	powershell.exe
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeSystemEnvironmentPrivilege	6080	powershell.exe
Token: SeRemoteShutdownPrivilege	6080	powershell.exe
Token: SeUndockPrivilege	6080	powershell.exe
Token: SeManageVolumePrivilege	6080	powershell.exe
Token: 33	6080	powershell.exe
Token: 34	6080	powershell.exe
Token: 35	6080	powershell.exe
Token: 36	6080	powershell.exe
Token: SeDebugPrivilege	120	powershell.exe
Token: SeIncreaseQuotaPrivilege	120	powershell.exe
Token: SeSecurityPrivilege	120	powershell.exe
Token: SeTakeOwnershipPrivilege	120	powershell.exe
Token: SeLoadDriverPrivilege	120	powershell.exe
Token: SeSystemProfilePrivilege	120	powershell.exe
Token: SeSystemtimePrivilege	120	powershell.exe
Token: SeProfSingleProcessPrivilege	120	powershell.exe
Token: SeIncBasePriorityPrivilege	120	powershell.exe
Token: SeCreatePagefilePrivilege	120	powershell.exe
Token: SeBackupPrivilege	120	powershell.exe
Token: SeRestorePrivilege	120	powershell.exe
Token: SeShutdownPrivilege	120	powershell.exe
Token: SeDebugPrivilege	120	powershell.exe
Token: SeSystemEnvironmentPrivilege	120	powershell.exe
Token: SeRemoteShutdownPrivilege	120	powershell.exe
Token: SeUndockPrivilege	120	powershell.exe
Token: SeManageVolumePrivilege	120	powershell.exe
Token: 33	120	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3944	4844	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	88
PID 3944 wrote to memory of 4192	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	89
PID 4192 wrote to memory of 1076	4192	cmd.exe	91
PID 3944 wrote to memory of 968	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	93
PID 968 wrote to memory of 6080	968	cmd.exe	95
PID 3944 wrote to memory of 5168	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	96
PID 5168 wrote to memory of 120	5168	cmd.exe	98
PID 3944 wrote to memory of 2976	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	99
PID 2976 wrote to memory of 4688	2976	cmd.exe	101
PID 3944 wrote to memory of 1808	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	102
PID 1808 wrote to memory of 1864	1808	cmd.exe	104
PID 3944 wrote to memory of 4772	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	105
PID 4772 wrote to memory of 3672	4772	cmd.exe	107
PID 3944 wrote to memory of 1956	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	108
PID 1956 wrote to memory of 4232	1956	cmd.exe	110
PID 3944 wrote to memory of 3988	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	111
PID 3988 wrote to memory of 2008	3988	cmd.exe	113
PID 3944 wrote to memory of 2380	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	114
PID 2380 wrote to memory of 2808	2380	cmd.exe	116
PID 3944 wrote to memory of 696	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	117
PID 696 wrote to memory of 5444	696	cmd.exe	119
PID 3944 wrote to memory of 3804	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	120
PID 3804 wrote to memory of 4264	3804	cmd.exe	122
PID 3944 wrote to memory of 5612	3944	_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe	123
PID 5612 wrote to memory of 1976	5612	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
"C:\Users\Admin\AppData\Local\Temp\_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe
  "C:\Users\Admin\AppData\Local\Temp\_b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact