658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c

Analysis

max time kernel
178s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe
Size 7.3MB
Sample260730-mrpgraga67
SHA256 658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c
MD5 a394ea6b9705c1ec1de81ce6ebfb8220
SHA1 e85235732e2c4711fd691062a1fa2df7cfaea495
SHA512 e3e4da49095a33a54072cb5eb8eaf8a2e291b22ee0c3f90f5e4333708fb92386b068ab4a4614e527982c2ad9d78c17f6989b947aebc5bba2f17a35ff4c5d5a32
SSDEEP 98304:lzknz/NQTrHcsTDB1aEoK4/ulTO9rLZIzetd:l+LNHs/nHd4yyB1IKH
TLSH
T144767D07EC6914E9D1AED13189769163BB717C881B2123D72B50F6387FB6BE0ADB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe
6000	powershell.exe
5188	powershell.exe
3004	powershell.exe
3696	powershell.exe
4940	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe
4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe
4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe
4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe
2100	powershell.exe
2100	powershell.exe
6000	powershell.exe
6000	powershell.exe
3696	powershell.exe
3696	powershell.exe
4940	powershell.exe
4940	powershell.exe
5188	powershell.exe
5188	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
2100	powershell.exe
6000	powershell.exe
4940	powershell.exe
3696	powershell.exe
5188	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	5188	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeIncreaseQuotaPrivilege	6000	powershell.exe
Token: SeSecurityPrivilege	6000	powershell.exe
Token: SeTakeOwnershipPrivilege	6000	powershell.exe
Token: SeLoadDriverPrivilege	6000	powershell.exe
Token: SeSystemProfilePrivilege	6000	powershell.exe
Token: SeSystemtimePrivilege	6000	powershell.exe
Token: SeProfSingleProcessPrivilege	6000	powershell.exe
Token: SeIncBasePriorityPrivilege	6000	powershell.exe
Token: SeCreatePagefilePrivilege	6000	powershell.exe
Token: SeBackupPrivilege	6000	powershell.exe
Token: SeRestorePrivilege	6000	powershell.exe
Token: SeShutdownPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeSystemEnvironmentPrivilege	6000	powershell.exe
Token: SeRemoteShutdownPrivilege	6000	powershell.exe
Token: SeUndockPrivilege	6000	powershell.exe
Token: SeManageVolumePrivilege	6000	powershell.exe
Token: 33	6000	powershell.exe
Token: 34	6000	powershell.exe
Token: 35	6000	powershell.exe
Token: 36	6000	powershell.exe
Token: SeIncreaseQuotaPrivilege	2100	powershell.exe
Token: SeSecurityPrivilege	2100	powershell.exe
Token: SeTakeOwnershipPrivilege	2100	powershell.exe
Token: SeLoadDriverPrivilege	2100	powershell.exe
Token: SeSystemProfilePrivilege	2100	powershell.exe
Token: SeSystemtimePrivilege	2100	powershell.exe
Token: SeProfSingleProcessPrivilege	2100	powershell.exe
Token: SeIncBasePriorityPrivilege	2100	powershell.exe
Token: SeCreatePagefilePrivilege	2100	powershell.exe
Token: SeBackupPrivilege	2100	powershell.exe
Token: SeRestorePrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeSystemEnvironmentPrivilege	2100	powershell.exe
Token: SeRemoteShutdownPrivilege	2100	powershell.exe
Token: SeUndockPrivilege	2100	powershell.exe
Token: SeManageVolumePrivilege	2100	powershell.exe
Token: 33	2100	powershell.exe
Token: 34	2100	powershell.exe
Token: 35	2100	powershell.exe
Token: 36	2100	powershell.exe
Token: SeIncreaseQuotaPrivilege	3004	powershell.exe
Token: SeSecurityPrivilege	3004	powershell.exe
Token: SeTakeOwnershipPrivilege	3004	powershell.exe
Token: SeLoadDriverPrivilege	3004	powershell.exe
Token: SeSystemProfilePrivilege	3004	powershell.exe
Token: SeSystemtimePrivilege	3004	powershell.exe
Token: SeProfSingleProcessPrivilege	3004	powershell.exe
Token: SeIncBasePriorityPrivilege	3004	powershell.exe
Token: SeCreatePagefilePrivilege	3004	powershell.exe
Token: SeBackupPrivilege	3004	powershell.exe
Token: SeRestorePrivilege	3004	powershell.exe
Token: SeShutdownPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeSystemEnvironmentPrivilege	3004	powershell.exe
Token: SeRemoteShutdownPrivilege	3004	powershell.exe
Token: SeUndockPrivilege	3004	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2100	4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe	90
PID 4248 wrote to memory of 6000	4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe	92
PID 4248 wrote to memory of 5188	4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe	93
PID 4248 wrote to memory of 3004	4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe	95
PID 4248 wrote to memory of 4940	4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe	97
PID 4248 wrote to memory of 3696	4248	658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe	98

C:\Users\Admin\AppData\Local\Temp\658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe
"C:\Users\Admin\AppData\Local\Temp\658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0lbmi0go.xyv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0lbmi0go.xyv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2100-13-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-19-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-9-0x0000021EEDB00000-0x0000021EEDB22000-memory.dmp

Download

memory/2100-3-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-12-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-0-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp

Download

memory/2100-16-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-4-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-22-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-23-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-50-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-1-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2100-2-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3004-26-0x000001F3472B0000-0x000001F3472CE000-memory.dmp

Download

memory/6000-34-0x00000175DE360000-0x00000175DE36A000-memory.dmp

Download

memory/6000-29-0x00000175DE5E0000-0x00000175DE692000-memory.dmp

Download