27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093

Analysis

max time kernel
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
Size 13.6MB
Sample260729-zlagvsvxht
SHA256 27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093
MD5 63951c4114bb7b172c40a8d72f1571eb
SHA1 58ab34482258c4b7f1c8e1f7e5b71d93060117a0
SHA512 c0751eaeb19fc5dc908ca1f4cb61776b183a575c8ba54f3489fa7a5587a543bfe36dfb49d4cc80a682a9c0771b08b8e9fa0402ff9e6ae1fa6ec05ca86870e3a1
SSDEEP 393216:ZNPPdzcPizdFofXMCHWUjXGcuI3/PGTAI:ZxaPizdFSXMb8X7H/O7
TLSH
T1DFE6331858D022DFF6B7913CEDE251D2D8EA74F32772C6AB43B44661AE172D08D3E642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6024	powershell.exe
5272	powershell.exe
5996	powershell.exe
1812	powershell.exe
4864	powershell.exe
4388	powershell.exe
2156	powershell.exe
5456	powershell.exe
1696	powershell.exe
728	powershell.exe
4468	powershell.exe
5952	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5640	cmd.exe
2100	cmd.exe
3368	cmd.exe
5892	cmd.exe
2164	cmd.exe
4756	cmd.exe
4964	cmd.exe
5112	cmd.exe
2300	cmd.exe
5536	cmd.exe
5844	cmd.exe
4076	cmd.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
1812	powershell.exe
1812	powershell.exe
1696	powershell.exe
1696	powershell.exe
4864	powershell.exe
4864	powershell.exe
728	powershell.exe
728	powershell.exe
728	powershell.exe
4468	powershell.exe
4468	powershell.exe
5952	powershell.exe
5952	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeIncreaseQuotaPrivilege	1812	powershell.exe
Token: SeSecurityPrivilege	1812	powershell.exe
Token: SeTakeOwnershipPrivilege	1812	powershell.exe
Token: SeLoadDriverPrivilege	1812	powershell.exe
Token: SeSystemProfilePrivilege	1812	powershell.exe
Token: SeSystemtimePrivilege	1812	powershell.exe
Token: SeProfSingleProcessPrivilege	1812	powershell.exe
Token: SeIncBasePriorityPrivilege	1812	powershell.exe
Token: SeCreatePagefilePrivilege	1812	powershell.exe
Token: SeBackupPrivilege	1812	powershell.exe
Token: SeRestorePrivilege	1812	powershell.exe
Token: SeShutdownPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeSystemEnvironmentPrivilege	1812	powershell.exe
Token: SeRemoteShutdownPrivilege	1812	powershell.exe
Token: SeUndockPrivilege	1812	powershell.exe
Token: SeManageVolumePrivilege	1812	powershell.exe
Token: 33	1812	powershell.exe
Token: 34	1812	powershell.exe
Token: 35	1812	powershell.exe
Token: 36	1812	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeIncreaseQuotaPrivilege	1696	powershell.exe
Token: SeSecurityPrivilege	1696	powershell.exe
Token: SeTakeOwnershipPrivilege	1696	powershell.exe
Token: SeLoadDriverPrivilege	1696	powershell.exe
Token: SeSystemProfilePrivilege	1696	powershell.exe
Token: SeSystemtimePrivilege	1696	powershell.exe
Token: SeProfSingleProcessPrivilege	1696	powershell.exe
Token: SeIncBasePriorityPrivilege	1696	powershell.exe
Token: SeCreatePagefilePrivilege	1696	powershell.exe
Token: SeBackupPrivilege	1696	powershell.exe
Token: SeRestorePrivilege	1696	powershell.exe
Token: SeShutdownPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeSystemEnvironmentPrivilege	1696	powershell.exe
Token: SeRemoteShutdownPrivilege	1696	powershell.exe
Token: SeUndockPrivilege	1696	powershell.exe
Token: SeManageVolumePrivilege	1696	powershell.exe
Token: 33	1696	powershell.exe
Token: 34	1696	powershell.exe
Token: 35	1696	powershell.exe
Token: 36	1696	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeIncreaseQuotaPrivilege	4864	powershell.exe
Token: SeSecurityPrivilege	4864	powershell.exe
Token: SeTakeOwnershipPrivilege	4864	powershell.exe
Token: SeLoadDriverPrivilege	4864	powershell.exe
Token: SeSystemProfilePrivilege	4864	powershell.exe
Token: SeSystemtimePrivilege	4864	powershell.exe
Token: SeProfSingleProcessPrivilege	4864	powershell.exe
Token: SeIncBasePriorityPrivilege	4864	powershell.exe
Token: SeCreatePagefilePrivilege	4864	powershell.exe
Token: SeBackupPrivilege	4864	powershell.exe
Token: SeRestorePrivilege	4864	powershell.exe
Token: SeShutdownPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeSystemEnvironmentPrivilege	4864	powershell.exe
Token: SeRemoteShutdownPrivilege	4864	powershell.exe
Token: SeUndockPrivilege	4864	powershell.exe
Token: SeManageVolumePrivilege	4864	powershell.exe
Token: 33	4864	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1432	4900	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	89
PID 1432 wrote to memory of 2300	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	90
PID 2300 wrote to memory of 1812	2300	cmd.exe	92
PID 1432 wrote to memory of 5640	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	94
PID 5640 wrote to memory of 1696	5640	cmd.exe	96
PID 1432 wrote to memory of 2100	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	97
PID 2100 wrote to memory of 4864	2100	cmd.exe	99
PID 1432 wrote to memory of 3368	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	100
PID 3368 wrote to memory of 728	3368	cmd.exe	102
PID 1432 wrote to memory of 5892	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	103
PID 5892 wrote to memory of 4468	5892	cmd.exe	105
PID 1432 wrote to memory of 5536	1432	27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe	106
PID 5536 wrote to memory of 5952	5536	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
"C:\Users\Admin\AppData\Local\Temp\27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe
  "C:\Users\Admin\AppData\Local\Temp\27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    PID:2164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    PID:4756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    PID:4076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact