576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe
Size 280KB
Sample260719-3hb33aax21
SHA256 576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034
MD5 cdd36302f250e0e62ead5f8762399e29
SHA1 837df7cb51409563dc98c09fa37e83d8d0c644b7
SHA512 6eb489d34e19c2f780366b86e20f039b0405b996c33822ab3a8d1adb1f870873f781bc4c43a6f2cbfe7fe1a20513849518678483212c3c139f8947cc0a9e68a5
SSDEEP 3072:PQHQkD2Z6SKcCue851rWQxIUjhRFNqpmfMaI9k2y3PhxxXpyNcltGZfHaMqNJg5k:4Q6SKq551KQ5j9NqUfzIwrUNcfg5ed
TLSH
T1C9546C56B3A40CF8EDA7923CC8564906EB72BC164761D7CF03A446572F272E0AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4052	powershell.exe
2268	powershell.exe
1204	powershell.exe

Executes a command shell one-liner 1 TTPs 19 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4568	cmd.exe
4176	cmd.exe
1880	cmd.exe
1840	cmd.exe
4592	cmd.exe
1684	cmd.exe
4820	cmd.exe
1672	cmd.exe
4728	cmd.exe
4788	cmd.exe
724	cmd.exe
4440	cmd.exe
4920	cmd.exe
5044	cmd.exe
4088	cmd.exe
4600	cmd.exe
1372	cmd.exe
4192	cmd.exe
1864	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4052	powershell.exe
4052	powershell.exe
2268	powershell.exe
2268	powershell.exe
1204	powershell.exe
1204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 5044	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	86
PID 4460 wrote to memory of 4176	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	87
PID 4460 wrote to memory of 4788	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	88
PID 4460 wrote to memory of 1880	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	89
PID 4460 wrote to memory of 4088	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	90
PID 4460 wrote to memory of 724	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	91
PID 4460 wrote to memory of 1840	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	92
PID 4460 wrote to memory of 4820	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	93
PID 4460 wrote to memory of 1672	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	94
PID 4460 wrote to memory of 4440	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	95
PID 4460 wrote to memory of 4592	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	96
PID 4460 wrote to memory of 4920	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	97
PID 4460 wrote to memory of 4728	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	98
PID 4460 wrote to memory of 4568	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	99
PID 4460 wrote to memory of 4600	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	100
PID 4460 wrote to memory of 1372	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	101
PID 4460 wrote to memory of 4192	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	103
PID 4192 wrote to memory of 4052	4192	cmd.exe	104
PID 4460 wrote to memory of 1864	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	105
PID 1864 wrote to memory of 2268	1864	cmd.exe	106
PID 4460 wrote to memory of 1684	4460	576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe	107
PID 1684 wrote to memory of 1204	1684	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe
"C:\Users\Admin\AppData\Local\Temp\576aef961e36febb3e9ba905e8175f99d778d0f60c870cd5df2401749b6ae034.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\DCOPF'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\DCOPF'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5f2b6782f01575ba7a1e68e3d46995679700b506293536afdb7b43cdd80628ed
MD5 e3196c875759f12b19de76e7989c1ade
SHA1 2a9c952b123b87c988caf9bf64fc5fd777b5c876
SHA512 5493bb1c8af856285f9ba79aa8a58763861bbaf2f4abac7248761cc5bce77f9e132bf108f4e13b2ff95042647e5384e74167ed4301f8d59e308bbce1f93eb5d6
TLSH
T13A112227F78C8920CC96163A509DAC5172B586CB91AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 6a98fa5e6c5b77722f2bd8c855fd14d6bf545fc35b292252d1dc136b89ed2fee
MD5 75d224e238a397659d8e5cf458a41143
SHA1 d182d16283d3d864a2e328b677551428c29ad6df
SHA512 3477f3b4182ffdccc817de4242c8fcba706c193a0de5170cd023f8df3d330487d7e372556524b5a0fe1df56de40923700f3f8368eadf6601970e347cbcf078cc
TLSH
T177112223F38C8920CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CBA1194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_odcs0ft0.qll.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odcs0ft0.qll.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4052-7-0x00000223DC1B0000-0x00000223DC1D2000-memory.dmp

Download