76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226

Analysis

max time kernel
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
Size 13.7MB
Sample260730-246n5aha47
SHA256 76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226
MD5 c3752c08eb40761569cc7c4a90485320
SHA1 dae4a62d13b6f7f6d91151e5d6ec2a3803dcad42
SHA512 cceabebc1077dfda15bd450b4aa80e7ec2552967e86cb187ff3d09bd74e56e669d7ff32b4963564250ffe19288ced2bc11f6028628263340570bf7326f4a74b1
SSDEEP 393216:s97ZSvWf/1DA1Obgb+2rtmXMCHWUjXGcuI3/PGTAI:sLSvWf/aJrtmXMb8X7H/O7
TLSH
T16EE6331476E052FEDA73413DE9F1A2A6D06174720B72CBCF478887A1BEA72D0893D647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2408	powershell.exe
3912	powershell.exe
2056	powershell.exe
5092	powershell.exe
3372	powershell.exe
3156	powershell.exe
5708	powershell.exe
6140	powershell.exe
3928	powershell.exe
5228	powershell.exe
4416	powershell.exe
4456	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe
940	cmd.exe
1288	cmd.exe
5600	cmd.exe
4284	cmd.exe
2936	cmd.exe
1180	cmd.exe
4932	cmd.exe
2372	cmd.exe
2820	cmd.exe
5408	cmd.exe
2596	cmd.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
2408	powershell.exe
2408	powershell.exe
3912	powershell.exe
3912	powershell.exe
5708	powershell.exe
5708	powershell.exe
6140	powershell.exe
6140	powershell.exe
2056	powershell.exe
2056	powershell.exe
5092	powershell.exe
5092	powershell.exe
3372	powershell.exe
3372	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeIncreaseQuotaPrivilege	2408	powershell.exe
Token: SeSecurityPrivilege	2408	powershell.exe
Token: SeTakeOwnershipPrivilege	2408	powershell.exe
Token: SeLoadDriverPrivilege	2408	powershell.exe
Token: SeSystemProfilePrivilege	2408	powershell.exe
Token: SeSystemtimePrivilege	2408	powershell.exe
Token: SeProfSingleProcessPrivilege	2408	powershell.exe
Token: SeIncBasePriorityPrivilege	2408	powershell.exe
Token: SeCreatePagefilePrivilege	2408	powershell.exe
Token: SeBackupPrivilege	2408	powershell.exe
Token: SeRestorePrivilege	2408	powershell.exe
Token: SeShutdownPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeSystemEnvironmentPrivilege	2408	powershell.exe
Token: SeRemoteShutdownPrivilege	2408	powershell.exe
Token: SeUndockPrivilege	2408	powershell.exe
Token: SeManageVolumePrivilege	2408	powershell.exe
Token: 33	2408	powershell.exe
Token: 34	2408	powershell.exe
Token: 35	2408	powershell.exe
Token: 36	2408	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeIncreaseQuotaPrivilege	3912	powershell.exe
Token: SeSecurityPrivilege	3912	powershell.exe
Token: SeTakeOwnershipPrivilege	3912	powershell.exe
Token: SeLoadDriverPrivilege	3912	powershell.exe
Token: SeSystemProfilePrivilege	3912	powershell.exe
Token: SeSystemtimePrivilege	3912	powershell.exe
Token: SeProfSingleProcessPrivilege	3912	powershell.exe
Token: SeIncBasePriorityPrivilege	3912	powershell.exe
Token: SeCreatePagefilePrivilege	3912	powershell.exe
Token: SeBackupPrivilege	3912	powershell.exe
Token: SeRestorePrivilege	3912	powershell.exe
Token: SeShutdownPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeSystemEnvironmentPrivilege	3912	powershell.exe
Token: SeRemoteShutdownPrivilege	3912	powershell.exe
Token: SeUndockPrivilege	3912	powershell.exe
Token: SeManageVolumePrivilege	3912	powershell.exe
Token: 33	3912	powershell.exe
Token: 34	3912	powershell.exe
Token: 35	3912	powershell.exe
Token: 36	3912	powershell.exe
Token: SeDebugPrivilege	5708	powershell.exe
Token: SeIncreaseQuotaPrivilege	5708	powershell.exe
Token: SeSecurityPrivilege	5708	powershell.exe
Token: SeTakeOwnershipPrivilege	5708	powershell.exe
Token: SeLoadDriverPrivilege	5708	powershell.exe
Token: SeSystemProfilePrivilege	5708	powershell.exe
Token: SeSystemtimePrivilege	5708	powershell.exe
Token: SeProfSingleProcessPrivilege	5708	powershell.exe
Token: SeIncBasePriorityPrivilege	5708	powershell.exe
Token: SeCreatePagefilePrivilege	5708	powershell.exe
Token: SeBackupPrivilege	5708	powershell.exe
Token: SeRestorePrivilege	5708	powershell.exe
Token: SeShutdownPrivilege	5708	powershell.exe
Token: SeDebugPrivilege	5708	powershell.exe
Token: SeSystemEnvironmentPrivilege	5708	powershell.exe
Token: SeRemoteShutdownPrivilege	5708	powershell.exe
Token: SeUndockPrivilege	5708	powershell.exe
Token: SeManageVolumePrivilege	5708	powershell.exe
Token: 33	5708	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5508 wrote to memory of 4448	5508	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	89
PID 4448 wrote to memory of 4932	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	90
PID 4932 wrote to memory of 2408	4932	cmd.exe	92
PID 4448 wrote to memory of 5600	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	94
PID 5600 wrote to memory of 3912	5600	cmd.exe	96
PID 4448 wrote to memory of 2372	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	97
PID 2372 wrote to memory of 5708	2372	cmd.exe	99
PID 4448 wrote to memory of 2820	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	100
PID 2820 wrote to memory of 6140	2820	cmd.exe	102
PID 4448 wrote to memory of 4284	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	103
PID 4284 wrote to memory of 2056	4284	cmd.exe	105
PID 4448 wrote to memory of 5408	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	106
PID 5408 wrote to memory of 5092	5408	cmd.exe	108
PID 4448 wrote to memory of 2596	4448	76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe	109
PID 2596 wrote to memory of 3372	2596	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
"C:\Users\Admin\AppData\Local\Temp\76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Users\Admin\AppData\Local\Temp\76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe
  "C:\Users\Admin\AppData\Local\Temp\76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    PID:2936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    PID:700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:1180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:1288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact