b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe
Size 36.8MB
Sample260804-3pb2msad45
SHA256 b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854
MD5 0a537502a50dc17582ca318676f5e7f0
SHA1 3fe31d67c6c22ae20abc32237697fcb6f9bf122e
SHA512 f31d2188cc167ff0fe7b753241554773e089251f4f41b894557728bf0a82014554deb02c6c193074c185eead699efa0f7ed900e4f3deac94cba4cb31ee4b2e70
SSDEEP 196608:158HKYeP2mwIsj2ZIj2AaMEtOiP7M6ODCVzGlOPRM/wMK/zKthg32RQkaGiCdNUz:174j2+j23/OgRrMK/ehg32RDaG9dfui
TLSH
T189875C93F8922A90D4EEC274C272816BB7613C590B3823E75690F7601F3ABD4DAB7751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5444	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3428537695.tmp	b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5444	powershell.exe
5444	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeIncreaseQuotaPrivilege	5444	powershell.exe
Token: SeSecurityPrivilege	5444	powershell.exe
Token: SeTakeOwnershipPrivilege	5444	powershell.exe
Token: SeLoadDriverPrivilege	5444	powershell.exe
Token: SeSystemProfilePrivilege	5444	powershell.exe
Token: SeSystemtimePrivilege	5444	powershell.exe
Token: SeProfSingleProcessPrivilege	5444	powershell.exe
Token: SeIncBasePriorityPrivilege	5444	powershell.exe
Token: SeCreatePagefilePrivilege	5444	powershell.exe
Token: SeBackupPrivilege	5444	powershell.exe
Token: SeRestorePrivilege	5444	powershell.exe
Token: SeShutdownPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeSystemEnvironmentPrivilege	5444	powershell.exe
Token: SeRemoteShutdownPrivilege	5444	powershell.exe
Token: SeUndockPrivilege	5444	powershell.exe
Token: SeManageVolumePrivilege	5444	powershell.exe
Token: 33	5444	powershell.exe
Token: 34	5444	powershell.exe
Token: 35	5444	powershell.exe
Token: 36	5444	powershell.exe
Token: SeIncreaseQuotaPrivilege	5444	powershell.exe
Token: SeSecurityPrivilege	5444	powershell.exe
Token: SeTakeOwnershipPrivilege	5444	powershell.exe
Token: SeLoadDriverPrivilege	5444	powershell.exe
Token: SeSystemProfilePrivilege	5444	powershell.exe
Token: SeSystemtimePrivilege	5444	powershell.exe
Token: SeProfSingleProcessPrivilege	5444	powershell.exe
Token: SeIncBasePriorityPrivilege	5444	powershell.exe
Token: SeCreatePagefilePrivilege	5444	powershell.exe
Token: SeBackupPrivilege	5444	powershell.exe
Token: SeRestorePrivilege	5444	powershell.exe
Token: SeShutdownPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeSystemEnvironmentPrivilege	5444	powershell.exe
Token: SeRemoteShutdownPrivilege	5444	powershell.exe
Token: SeUndockPrivilege	5444	powershell.exe
Token: SeManageVolumePrivilege	5444	powershell.exe
Token: 33	5444	powershell.exe
Token: 34	5444	powershell.exe
Token: 35	5444	powershell.exe
Token: 36	5444	powershell.exe
Token: SeIncreaseQuotaPrivilege	5444	powershell.exe
Token: SeSecurityPrivilege	5444	powershell.exe
Token: SeTakeOwnershipPrivilege	5444	powershell.exe
Token: SeLoadDriverPrivilege	5444	powershell.exe
Token: SeSystemProfilePrivilege	5444	powershell.exe
Token: SeSystemtimePrivilege	5444	powershell.exe
Token: SeProfSingleProcessPrivilege	5444	powershell.exe
Token: SeIncBasePriorityPrivilege	5444	powershell.exe
Token: SeCreatePagefilePrivilege	5444	powershell.exe
Token: SeBackupPrivilege	5444	powershell.exe
Token: SeRestorePrivilege	5444	powershell.exe
Token: SeShutdownPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeSystemEnvironmentPrivilege	5444	powershell.exe
Token: SeRemoteShutdownPrivilege	5444	powershell.exe
Token: SeUndockPrivilege	5444	powershell.exe
Token: SeManageVolumePrivilege	5444	powershell.exe
Token: 33	5444	powershell.exe
Token: 34	5444	powershell.exe
Token: 35	5444	powershell.exe
Token: 36	5444	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 5444	704	b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe	86

C:\Users\Admin\AppData\Local\Temp\b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe
"C:\Users\Admin\AppData\Local\Temp\b4647c8851c316988984a6c6d534f103a0cd65e5f165f8aaaa9da8b0a7f28854.exe"
1⤵
- Creates a file in the Startup directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svchost_e3c6bd17' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_lkpob5k1.xpn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lkpob5k1.xpn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-16-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/704-19-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/704-20-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/704-22-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/704-25-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/704-26-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/704-28-0x00007FF7C3F80000-0x00007FF7C84C2000-memory.dmp

Download

memory/5444-4-0x0000015BF0F40000-0x0000015BF0F50000-memory.dmp

Download

memory/5444-5-0x0000015BF0F40000-0x0000015BF0F50000-memory.dmp

Download

memory/5444-11-0x0000015BF0F10000-0x0000015BF0F32000-memory.dmp

Download