b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
Size 13.6MB
Sample260712-jsrrqaf17v
SHA256 b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96
MD5 6e39b63340c5e76f2019ee1271eea160
SHA1 8cdafa38342dc6dfda52ca3f09d2e7bf292cf712
SHA512 578354acb7f5409dc5f9dcb6e86ac760440ab3652a51c1a48069ae14eb6460ea6278a3ff12bf929945a3f1036634a8d96bea098838f4f9e5fca4b51e09e575ca
SSDEEP 393216:p0TTZ1yIvEC0EIW/WRbm7XMCHWUjXkcuI3/PGTAI:p6Z1yIv9fYS7XMb8XxH/O7
TLSH
T197E63309AAE401FEFAB3013CEDE3265AD55978B28771C4CF47F88AE66D132D10938657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2500	powershell.exe
4200	powershell.exe
5508	powershell.exe
4600	powershell.exe
992	powershell.exe
3844	powershell.exe
4184	powershell.exe
256	powershell.exe
3444	powershell.exe
3544	powershell.exe
2020	powershell.exe
4624	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
3444	powershell.exe
3444	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
992	powershell.exe
992	powershell.exe
992	powershell.exe
3844	powershell.exe
3844	powershell.exe
3544	powershell.exe
3544	powershell.exe
2020	powershell.exe
2020	powershell.exe
4184	powershell.exe
4184	powershell.exe
4624	powershell.exe
4624	powershell.exe
2500	powershell.exe
2500	powershell.exe
4200	powershell.exe
4200	powershell.exe
256	powershell.exe
256	powershell.exe
5508	powershell.exe
5508	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeIncreaseQuotaPrivilege	3444	powershell.exe
Token: SeSecurityPrivilege	3444	powershell.exe
Token: SeTakeOwnershipPrivilege	3444	powershell.exe
Token: SeLoadDriverPrivilege	3444	powershell.exe
Token: SeSystemProfilePrivilege	3444	powershell.exe
Token: SeSystemtimePrivilege	3444	powershell.exe
Token: SeProfSingleProcessPrivilege	3444	powershell.exe
Token: SeIncBasePriorityPrivilege	3444	powershell.exe
Token: SeCreatePagefilePrivilege	3444	powershell.exe
Token: SeBackupPrivilege	3444	powershell.exe
Token: SeRestorePrivilege	3444	powershell.exe
Token: SeShutdownPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeSystemEnvironmentPrivilege	3444	powershell.exe
Token: SeRemoteShutdownPrivilege	3444	powershell.exe
Token: SeUndockPrivilege	3444	powershell.exe
Token: SeManageVolumePrivilege	3444	powershell.exe
Token: 33	3444	powershell.exe
Token: 34	3444	powershell.exe
Token: 35	3444	powershell.exe
Token: 36	3444	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeIncreaseQuotaPrivilege	992	powershell.exe
Token: SeSecurityPrivilege	992	powershell.exe
Token: SeTakeOwnershipPrivilege	992	powershell.exe
Token: SeLoadDriverPrivilege	992	powershell.exe
Token: SeSystemProfilePrivilege	992	powershell.exe
Token: SeSystemtimePrivilege	992	powershell.exe
Token: SeProfSingleProcessPrivilege	992	powershell.exe
Token: SeIncBasePriorityPrivilege	992	powershell.exe
Token: SeCreatePagefilePrivilege	992	powershell.exe
Token: SeBackupPrivilege	992	powershell.exe
Token: SeRestorePrivilege	992	powershell.exe
Token: SeShutdownPrivilege	992	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeSystemEnvironmentPrivilege	992	powershell.exe
Token: SeRemoteShutdownPrivilege	992	powershell.exe
Token: SeUndockPrivilege	992	powershell.exe
Token: SeManageVolumePrivilege	992	powershell.exe
Token: 33	992	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 5384	3104	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	88
PID 5384 wrote to memory of 3176	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	89
PID 3176 wrote to memory of 3444	3176	cmd.exe	91
PID 5384 wrote to memory of 4576	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	93
PID 4576 wrote to memory of 4600	4576	cmd.exe	95
PID 5384 wrote to memory of 5880	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	96
PID 5880 wrote to memory of 992	5880	cmd.exe	98
PID 5384 wrote to memory of 2200	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	99
PID 2200 wrote to memory of 3844	2200	cmd.exe	101
PID 5384 wrote to memory of 3692	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	102
PID 3692 wrote to memory of 3544	3692	cmd.exe	104
PID 5384 wrote to memory of 3664	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	105
PID 3664 wrote to memory of 2020	3664	cmd.exe	107
PID 5384 wrote to memory of 6088	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	108
PID 6088 wrote to memory of 4184	6088	cmd.exe	110
PID 5384 wrote to memory of 3936	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	111
PID 3936 wrote to memory of 4624	3936	cmd.exe	113
PID 5384 wrote to memory of 5712	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	114
PID 5712 wrote to memory of 2500	5712	cmd.exe	116
PID 5384 wrote to memory of 976	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	117
PID 976 wrote to memory of 4200	976	cmd.exe	119
PID 5384 wrote to memory of 2320	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	120
PID 2320 wrote to memory of 256	2320	cmd.exe	122
PID 5384 wrote to memory of 1856	5384	_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe	123
PID 1856 wrote to memory of 5508	1856	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
"C:\Users\Admin\AppData\Local\Temp\_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe
  "C:\Users\Admin\AppData\Local\Temp\_b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact