590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf

Analysis

user interaction
yes
max time kernel
50s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exm Premium.exe
Size 10.7MB
Sample260804-r9pyfsce65
SHA256 590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf
MD5 cac7debea1217a51c3720e9dfa08f1cc
SHA1 63dc63bde19edb5d6aaf668a6f5dedb0139e8f96
SHA512 cc7f1325c5747eb12f89f58ffa2d6a1beab06e812efe770a803192d10ea28589623030d918893344222c65babe3ba5d731fe55b650c453561594e7f2da4847d1
SSDEEP 98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkze3ykimB1PF2EEaO:VkUIEGaABtlN7L3ykim2
TLSH
T1C3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4048	Tea-hvh-user-agent.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1020	icacls.exe
728	icacls.exe
4352	icacls.exe
3752	icacls.exe
2288	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TeaHvhUserAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Tea hvh\\Agent\\Tea-hvh-user-agent.exe\" --runtime"	Exm Premium.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TeaHvhUserAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Tea hvh\\Agent\\Tea-hvh-user-agent.exe\" --runtime"	Tea-hvh-user-agent.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3428	powershell.exe
1932	powershell.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe.new	Tea-hvh-user-agent.exe
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe.new	Exm Premium.exe
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe.new	Exm Premium.exe
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe.new	Tea-hvh-user-agent.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4532	powershell.exe
1932	powershell.exe
536	powershell.exe
3428	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
400	sc.exe
4296	sc.exe
2344	sc.exe
644	sc.exe
3756	sc.exe
1660	sc.exe
4788	sc.exe
1692	sc.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Exm Premium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Exm Premium.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Exm Premium.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
536	powershell.exe
536	powershell.exe
3428	powershell.exe
3428	powershell.exe
4532	powershell.exe
4532	powershell.exe
1932	powershell.exe
1932	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	powershell.exe
Token: SeIncreaseQuotaPrivilege	536	powershell.exe
Token: SeSecurityPrivilege	536	powershell.exe
Token: SeTakeOwnershipPrivilege	536	powershell.exe
Token: SeLoadDriverPrivilege	536	powershell.exe
Token: SeSystemProfilePrivilege	536	powershell.exe
Token: SeSystemtimePrivilege	536	powershell.exe
Token: SeProfSingleProcessPrivilege	536	powershell.exe
Token: SeIncBasePriorityPrivilege	536	powershell.exe
Token: SeCreatePagefilePrivilege	536	powershell.exe
Token: SeBackupPrivilege	536	powershell.exe
Token: SeRestorePrivilege	536	powershell.exe
Token: SeShutdownPrivilege	536	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeSystemEnvironmentPrivilege	536	powershell.exe
Token: SeRemoteShutdownPrivilege	536	powershell.exe
Token: SeUndockPrivilege	536	powershell.exe
Token: SeManageVolumePrivilege	536	powershell.exe
Token: 33	536	powershell.exe
Token: 34	536	powershell.exe
Token: 35	536	powershell.exe
Token: 36	536	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe
Token: 36	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 536	3600	Exm Premium.exe	83
PID 3600 wrote to memory of 3428	3600	Exm Premium.exe	86
PID 3428 wrote to memory of 1020	3428	powershell.exe	89
PID 3428 wrote to memory of 2288	3428	powershell.exe	90
PID 3428 wrote to memory of 4296	3428	powershell.exe	91
PID 3428 wrote to memory of 400	3428	powershell.exe	92
PID 3428 wrote to memory of 1692	3428	powershell.exe	93
PID 3428 wrote to memory of 4788	3428	powershell.exe	94
PID 3600 wrote to memory of 728	3600	Exm Premium.exe	98
PID 4048 wrote to memory of 4532	4048	Tea-hvh-user-agent.exe	101
PID 4048 wrote to memory of 1932	4048	Tea-hvh-user-agent.exe	104
PID 1932 wrote to memory of 4352	1932	powershell.exe	106
PID 1932 wrote to memory of 3752	1932	powershell.exe	107
PID 1932 wrote to memory of 2344	1932	powershell.exe	109
PID 1932 wrote to memory of 644	1932	powershell.exe	111
PID 1932 wrote to memory of 3756	1932	powershell.exe	113
PID 1932 wrote to memory of 1660	1932	powershell.exe	114

C:\Users\Admin\AppData\Local\Temp\Exm Premium.exe
"C:\Users\Admin\AppData\Local\Temp\Exm Premium.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Stop-Service -Name 'TeaHvhAgentSupervisor' -Force -ErrorAction SilentlyContinue;Stop-ScheduledTask -TaskName 'Tea hvh Session Agent' -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop' $InstallDir='C:\Program Files\Tea hvh\Agent';$StateDir='C:\ProgramData\Tea hvh\Agent';$Supervisor='C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe';$Session='C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe';$DeviceID='C:\ProgramData\Tea hvh\Agent\device-id.txt';$Ready='C:\ProgramData\Tea hvh\Agent\runtime.ready' $ServiceName='TeaHvhAgentSupervisor';$TaskName='Tea hvh Session Agent';$LegacyTask='Fortnite Club Remote Agent' $ActiveUser=(Get-CimInstance Win32_ComputerSystem).UserName if([string]::IsNullOrWhiteSpace($ActiveUser)){throw 'No interactive Windows user is signed in.'} Stop-ScheduledTask -TaskName $LegacyTask -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $LegacyTask -Confirm:$false -ErrorAction SilentlyContinue Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue Remove-Item -Force $Ready -ErrorAction SilentlyContinue $LegacyIdentity=Join-Path $env:ProgramData 'FortniteClubRemote\device-id.txt' if((Test-Path $LegacyIdentity)-and-not(Test-Path $DeviceID)){Copy-Item -Force $LegacyIdentity $DeviceID} & icacls.exe $InstallDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'Users:(OI)(CI)RX' | Out-Null & icacls.exe $StateDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' (\"${ActiveUser}:(OI)(CI)M\") | Out-Null $Action=New-ScheduledTaskAction -Execute $Session -Argument '--runtime' -WorkingDirectory $InstallDir $Trigger=New-ScheduledTaskTrigger -AtLogOn -User $ActiveUser $Settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -StartWhenAvailable -MultipleInstances IgnoreNew $Principal=New-ScheduledTaskPrincipal -UserId $ActiveUser -LogonType Interactive -RunLevel Highest Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force | Out-Null $ServiceBinary=('\"{0}\" --service' -f $Supervisor) if(Get-Service -Name $ServiceName -ErrorAction SilentlyContinue){& sc.exe config $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem | Out-Null}else{& sc.exe create $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem DisplayName= 'Tea hvh Agent Protection' | Out-Null} & sc.exe description $ServiceName 'Protects and recovers the authorized Tea hvh session agent.' | Out-Null & sc.exe failure $ServiceName reset= 86400 actions= restart/5000/restart/15000/restart/30000 | Out-Null & sc.exe failureflag $ServiceName 1 | Out-Null Start-Service -Name $ServiceName Start-ScheduledTask -TaskName $TaskName "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F Users:(OI)(CI)RX
    3⤵
    - Modifies file permissions
    PID:1020
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\ProgramData\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F RPHJNYLJ\Admin:(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:2288
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create TeaHvhAgentSupervisor binPath= ""C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe" --service" start= auto obj= LocalSystem DisplayName= "Tea hvh Agent Protection"
    3⤵
    - Launches sc.exe
    PID:4296
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" description TeaHvhAgentSupervisor "Protects and recovers the authorized Tea hvh session agent."
    3⤵
    - Launches sc.exe
    PID:400
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure TeaHvhAgentSupervisor reset= 86400 actions= restart/5000/restart/15000/restart/30000
    3⤵
    - Launches sc.exe
    PID:1692
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failureflag TeaHvhAgentSupervisor 1
    3⤵
    - Launches sc.exe
    PID:4788
- C:\Windows\system32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Local\Tea hvh\Agent\device.credential" /inheritance:r /grant:r SYSTEM:F Administrators:F RPHJNYLJ\Admin:F
  2⤵
  - Modifies file permissions
  PID:728

C:\Users\Admin\AppData\Local\Tea hvh\Agent\Tea-hvh-user-agent.exe
"C:\Users\Admin\AppData\Local\Tea hvh\Agent\Tea-hvh-user-agent.exe" --runtime
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Stop-Service -Name 'TeaHvhAgentSupervisor' -Force -ErrorAction SilentlyContinue;Stop-ScheduledTask -TaskName 'Tea hvh Session Agent' -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop' $InstallDir='C:\Program Files\Tea hvh\Agent';$StateDir='C:\ProgramData\Tea hvh\Agent';$Supervisor='C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe';$Session='C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe';$DeviceID='C:\ProgramData\Tea hvh\Agent\device-id.txt';$Ready='C:\ProgramData\Tea hvh\Agent\runtime.ready' $ServiceName='TeaHvhAgentSupervisor';$TaskName='Tea hvh Session Agent';$LegacyTask='Fortnite Club Remote Agent' $ActiveUser=(Get-CimInstance Win32_ComputerSystem).UserName if([string]::IsNullOrWhiteSpace($ActiveUser)){throw 'No interactive Windows user is signed in.'} Stop-ScheduledTask -TaskName $LegacyTask -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $LegacyTask -Confirm:$false -ErrorAction SilentlyContinue Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue Remove-Item -Force $Ready -ErrorAction SilentlyContinue $LegacyIdentity=Join-Path $env:ProgramData 'FortniteClubRemote\device-id.txt' if((Test-Path $LegacyIdentity)-and-not(Test-Path $DeviceID)){Copy-Item -Force $LegacyIdentity $DeviceID} & icacls.exe $InstallDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'Users:(OI)(CI)RX' | Out-Null & icacls.exe $StateDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' (\"${ActiveUser}:(OI)(CI)M\") | Out-Null $Action=New-ScheduledTaskAction -Execute $Session -Argument '--runtime' -WorkingDirectory $InstallDir $Trigger=New-ScheduledTaskTrigger -AtLogOn -User $ActiveUser $Settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -StartWhenAvailable -MultipleInstances IgnoreNew $Principal=New-ScheduledTaskPrincipal -UserId $ActiveUser -LogonType Interactive -RunLevel Highest Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force | Out-Null $ServiceBinary=('\"{0}\" --service' -f $Supervisor) if(Get-Service -Name $ServiceName -ErrorAction SilentlyContinue){& sc.exe config $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem | Out-Null}else{& sc.exe create $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem DisplayName= 'Tea hvh Agent Protection' | Out-Null} & sc.exe description $ServiceName 'Protects and recovers the authorized Tea hvh session agent.' | Out-Null & sc.exe failure $ServiceName reset= 86400 actions= restart/5000/restart/15000/restart/30000 | Out-Null & sc.exe failureflag $ServiceName 1 | Out-Null Start-Service -Name $ServiceName Start-ScheduledTask -TaskName $TaskName "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F Users:(OI)(CI)RX
    3⤵
    - Modifies file permissions
    PID:4352
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\ProgramData\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F RPHJNYLJ\Admin:(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:3752
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create TeaHvhAgentSupervisor binPath= ""C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe" --service" start= auto obj= LocalSystem DisplayName= "Tea hvh Agent Protection"
    3⤵
    - Launches sc.exe
    PID:2344
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" description TeaHvhAgentSupervisor "Protects and recovers the authorized Tea hvh session agent."
    3⤵
    - Launches sc.exe
    PID:644
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure TeaHvhAgentSupervisor reset= 86400 actions= restart/5000/restart/15000/restart/30000
    3⤵
    - Launches sc.exe
    PID:3756
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failureflag TeaHvhAgentSupervisor 1
    3⤵
    - Launches sc.exe
    PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tea-hvh-session-agent.exe.new

Path C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe.new
Size 10.7MB
SHA256 590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf
MD5 cac7debea1217a51c3720e9dfa08f1cc
SHA1 63dc63bde19edb5d6aaf668a6f5dedb0139e8f96
SHA512 cc7f1325c5747eb12f89f58ffa2d6a1beab06e812efe770a803192d10ea28589623030d918893344222c65babe3ba5d731fe55b650c453561594e7f2da4847d1
SSDEEP 98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkze3ykimB1PF2EEaO:VkUIEGaABtlN7L3ykim2
TLSH
T1C3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 764d337504c9db6ccf621fa167cc08dc7e1545b10e08be6f8a17269d6509a696
MD5 c365a371b9081d3418228af6cea3546b
SHA1 735932fb6b32a24c2646f3621bd8a53500412989
SHA512 578621d964fce53441667cfb5d7d7f4df728bc1b7dbc0eae22f0d5ebd499b16d1c42f917fe2c5c2b9ee45b86a185a3d3602b4b0d0e1101dc1d5f303dc7468473
TLSH
T1EE71F0313375F1E4C8567F07292819C453BF4395EA94AF5CB298621EEA2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7f33fc647701f0d20596f8b23463ff9f3a3437b652f03d2e65546e6c7065401
MD5 7cb4860edd383d53e7874875e76d6d5e
SHA1 b5d4c79fa6a75577cc72d04d6766294a2e2ee474
SHA512 873b1f1c12a806eab6584f873bf71855c21f0e0a004a8c0919eefcdaa6c78d12044132aec93686e6da786149a86c577dadc7d24b2d37b0b841d1c0c45353279c
TLSH
T1B9218727B38D8921CCD9163A209D9C5176B282C7809FDF9F6FC0D211A5BF698CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4a3bd2fdd3ae2ccff0a6f04d056213e353442ad8ed8e1d1fb483272ff6190191
MD5 d850c338b1655c4f32bbe2aea22ac111
SHA1 a89681689272cdcea9dad5014142f58d69df397a
SHA512 76eb716c165c1fc12c86c303b2406740787965b10faa1c60f3d33c1f5d0c453402d14df208ac100e304e7337e440dfc16c192901c0ae0c1933c0b93de911164d
TLSH
T108318827B39C8561CCD5153A109C9C1172A782D7809ECF9F6FC0D221A57FAD8CB61140
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5d388e8024a0686052e6d654212250ede257dfe929fcfacec7d7adb61a465a52
MD5 04e4819ef7258b95bc0b694c8fe4ccb5
SHA1 fe123390c709a4b9f549af9b7c59b375be37e213
SHA512 0b6485126b0b94232716a2120e11c615a5965b0e6d6a588dba3b4236b7765148cdc24450c06324fc307d768531293c36b38bd19f07d9cbd035562c2b6a255959
TLSH
T105218727F38C8921CCD9163A109D9C5176B282C7809FDF9F6FC0D211A5BF698CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\agent.log
Size 347B
SHA256 83d230a7ed8af29eb5564ef7cd5cb0e5335b1413951894c371058ceb2ccb66dd
MD5 68ae3f04dff8440ff42f8541a96bb4fa
SHA1 3a2415825585b3c8fd282dbc377565cf22caff70
SHA512 a8ec4e9becf95f122285d4402923ef277f4eac5fa78026c4f7ab59dd87f31615a101df1859effc14f2f6dc01f4b779a91291d6c29abafda3776ca2fdd36c7a32
TLSH
T184E0869003D32C3F3BAF03A5B88D1796525073AA0EB02486DAAC4B042D37E931D5F194
MD5 SHA1 SHA512 TLSH

Submit Download

device.credential

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\device.credential
Size 65B
SHA256 51b08f174384888f0f931d921a56faac0c3697bd247db2ad485983aa648aa681
MD5 48dd676450c7bc308c5b4d58ec2d7137
SHA1 9c3571664fbd8df27f6ae888759acf6bd738cef4
SHA512 d7fb924a777cb2a5d4ee754a46a2da0345b5b0cb6accef7bf7ff6ecc397166998fe3d61dc7f43adcfaa7b4f0b48b59e38f0c549cf736cd41f8b04c4ee42f23a7
TLSH
T15DA0021B18DBA675D5161AF2575788D547957DB577A6C088046D74C2C00284801F802E
MD5 SHA1 SHA512 TLSH

Submit Download

identity.json

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\identity.json
Size 148B
SHA256 3138a2ce49eea6b9b78857a93ffe8322dc4552aeeb28b8c685c294ade596c765
MD5 d556a03dfe0ffa6436a00e0604dda500
SHA1 f9d5145c297a1a881f9c55a7e70267370da16330
SHA512 eec8f9987f7a6115b09e80606f5c79ea55abf6cca7d38947123040825dee73058e1d582e0855f2c6392a66268d443b116871ab1f73242d2045d9912ace74af40
TLSH
T1CDC02B1C550158F3437271E0047716A353FCC61B0504D2C60B4A00721B7F7F63302814
MD5 SHA1 SHA512 TLSH

Submit Download

last-error.txt

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\last-error.txt
Size 453B
SHA256 52640831c63d2039bce0e458d5632d40cd4f527d9352b50cfe512ebcc30014da
MD5 8de8cbf311fe345602e676210e4209e9
SHA1 250acc2ce6e1dc93a60fbeb53150b3f3b07aa3b2
SHA512 1d41d5af17cc897826cf328a6e4a747118b858fe12b4724d9366fa02a85f009547e50b056516d0705d73f2895df17e624b974db26f87e7cd907340cd7769a180
TLSH
T145F02B2DB4DF81FB4A6381060C970352569A81AD005E3656B3FDBB403BF286FD55154A
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.ready

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\runtime.ready
Size 29B
SHA256 bd588f6f4942260e56e816f71a20097e073760bdd09667f9c74157fa5df497f2
MD5 77b814a7892b591a5c77f99fa9040af3
SHA1 5fa05a5e2c9b7ea0c339b8da09993d57217064ba
SHA512 ca500dde103e026e324175c5803ca53ab078c4a2f3624f4c6973fc0f66665de75f714953eb5b0855e9ba23139a6e6c29adba1135bf4ac5e423de7b73fde43f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ouo4axnl.1m2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ouo4axnl.1m2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-1-0x0000027477750000-0x0000027477760000-memory.dmp

Download

memory/536-0-0x0000027477750000-0x0000027477760000-memory.dmp

Download

memory/536-2-0x0000027477090000-0x00000274770B2000-memory.dmp

Download

memory/536-13-0x0000027478110000-0x000002747825E000-memory.dmp

Download

memory/536-10-0x0000027477750000-0x0000027477760000-memory.dmp

Download

memory/3428-34-0x000002AF4E830000-0x000002AF4E854000-memory.dmp

Download

memory/3428-33-0x000002AF4E830000-0x000002AF4E85A000-memory.dmp

Download

memory/3428-24-0x000002AF35650000-0x000002AF35660000-memory.dmp

Download

memory/3428-23-0x000002AF35650000-0x000002AF35660000-memory.dmp

Download

memory/4048-92-0x00007FF727BF0000-0x00007FF7286FD000-memory.dmp

Download

memory/4048-95-0x00007FF727BF0000-0x00007FF7286FD000-memory.dmp

Download