9c5c959be476ade0959e4c5f059674881b5d0d617ab983f27b646545a7b9211a

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hollyshit.exe
Size 632KB
Sample260720-re9pdaev9x
SHA256 9c5c959be476ade0959e4c5f059674881b5d0d617ab983f27b646545a7b9211a
MD5 577db975b4bf1ea371fb4f8f15a47adc
SHA1 debd5811423258fc9e91207892c85f933d3631e0
SHA512 749ed469ed6625fae28eeb00979ed7a45a99c74fc42fed2c348f67de8ee781626a30002f7d193cf3b5ad63bfa8ee39b6a147894c0e81610623888070138b4061
SSDEEP 6144:Vd71qilR2ZQqZX0bYoYHVzB/wL6AIHC9UcZZha6FCt5PXP0USGIs:VdxqilR2Nkb+1I7aAwXPrx
TLSH
T1E6D4184AF753A17CD52BC1718BAB6633B932B81C41357D7F5A148B7A3EA1E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1212	powershell.exe
1212	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3464	CredentialMgrMonitor.exe
4560	CredentialMgrMonitor.exe
4820	CredentialMgrMonitor.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4140	cmd.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4140	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5532	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4140	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6008	cmd.exe
5940	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1212	powershell.exe
1212	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3464	1180	hollyshit.exe	89
PID 3464 wrote to memory of 4560	3464	CredentialMgrMonitor.exe	90
PID 3464 wrote to memory of 6008	3464	CredentialMgrMonitor.exe	91
PID 6008 wrote to memory of 4196	6008	cmd.exe	93
PID 3464 wrote to memory of 4140	3464	CredentialMgrMonitor.exe	94
PID 4140 wrote to memory of 5056	4140	cmd.exe	96
PID 4140 wrote to memory of 1212	4140	cmd.exe	97
PID 3464 wrote to memory of 5940	3464	CredentialMgrMonitor.exe	99
PID 5940 wrote to memory of 476	5940	cmd.exe	101
PID 5940 wrote to memory of 4864	5940	cmd.exe	102
PID 3464 wrote to memory of 5532	3464	CredentialMgrMonitor.exe	103
PID 5532 wrote to memory of 6044	5532	cmd.exe	105
PID 5532 wrote to memory of 5500	5532	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5500	attrib.exe

C:\Users\Admin\AppData\Local\Temp\hollyshit.exe
"C:\Users\Admin\AppData\Local\Temp\hollyshit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe" --r
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe" --wd 3464
    3⤵
    - Executes dropped EXE
    PID:4560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && Üwõ‰É²³¬¨_˜D^®§Í1/pÿø»>’±r>'Ã\rfS‘ž`<ç¢sðRM_xœ¿ZbÂœ ÓÄ@8Œîo1ŒŠn‰'ð~ørÇss·]L™^ß€ÿƒÁïÂG’vdÌöº€J"D³ªßD®£%TâÚ+ rŠLC ë R÷”¦xÖ u/)Õ“{î5XpªccË$ï$ÙÐÖÄÓÂ³c3'ÇÃ{ŒÊÕº¯
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4196
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "CredentialMgrMonitor" /tr "\"C:\Users\Admin\AppData\Roaming\CredentialMgrMonitor.exe\"" /ru ""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:476
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "CredentialMgrMonitor" /tr "\"C:\Users\Admin\AppData\Roaming\CredentialMgrMonitor.exe\"" /ru ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4864
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:6044
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe"
      4⤵
      Views/modifies file attributes
      PID:5500

C:\Users\Admin\AppData\Roaming\CredentialMgrMonitor.exe
"C:\Users\Admin\AppData\Roaming\CredentialMgrMonitor.exe"
1⤵
- Executes dropped EXE
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CredentialMgrMonitor.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\CredentialMgrMonitor.exe
Size 632KB
SHA256 9c5c959be476ade0959e4c5f059674881b5d0d617ab983f27b646545a7b9211a
MD5 577db975b4bf1ea371fb4f8f15a47adc
SHA1 debd5811423258fc9e91207892c85f933d3631e0
SHA512 749ed469ed6625fae28eeb00979ed7a45a99c74fc42fed2c348f67de8ee781626a30002f7d193cf3b5ad63bfa8ee39b6a147894c0e81610623888070138b4061
SSDEEP 6144:Vd71qilR2ZQqZX0bYoYHVzB/wL6AIHC9UcZZha6FCt5PXP0USGIs:VdxqilR2Nkb+1I7aAwXPrx
TLSH
T1E6D4184AF753A17CD52BC1718BAB6633B932B81C41357D7F5A148B7A3EA1E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-2-0x00007FF746BC0000-0x00007FF746C7B000-memory.dmp

Download

memory/1212-5-0x000002C5A02E0000-0x000002C5A0302000-memory.dmp

Download

memory/1212-8-0x000002C5A05A0000-0x000002C5A05BE000-memory.dmp

Download

memory/1212-9-0x000002C5A05C0000-0x000002C5A0672000-memory.dmp

Download

memory/1212-10-0x000002C5A0390000-0x000002C5A039A000-memory.dmp

Download

memory/3464-14-0x00007FF73BD80000-0x00007FF73BE3B000-memory.dmp

Download

memory/3464-16-0x00007FF73BD80000-0x00007FF73BE3B000-memory.dmp

Download

memory/4560-15-0x00007FF73BD80000-0x00007FF73BE3B000-memory.dmp

Download

memory/4820-13-0x00007FF6826D0000-0x00007FF68278B000-memory.dmp

Download