590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf

Analysis

max time kernel
58s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exm Premium.exe
Size 10.7MB
Sample260804-r9pyfsce65
SHA256 590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf
MD5 cac7debea1217a51c3720e9dfa08f1cc
SHA1 63dc63bde19edb5d6aaf668a6f5dedb0139e8f96
SHA512 cc7f1325c5747eb12f89f58ffa2d6a1beab06e812efe770a803192d10ea28589623030d918893344222c65babe3ba5d731fe55b650c453561594e7f2da4847d1
SSDEEP 98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkze3ykimB1PF2EEaO:VkUIEGaABtlN7L3ykim2
TLSH
T1C3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5796	Tea-hvh-user-agent.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
892	icacls.exe
4752	icacls.exe
1060	icacls.exe
5756	icacls.exe
5248	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\TeaHvhUserAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Tea hvh\\Agent\\Tea-hvh-user-agent.exe\" --runtime"	Exm Premium.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\TeaHvhUserAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Tea hvh\\Agent\\Tea-hvh-user-agent.exe\" --runtime"	Tea-hvh-user-agent.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1880	powershell.exe
3760	powershell.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe.new	Exm Premium.exe
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe.new	Exm Premium.exe
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe.new	Tea-hvh-user-agent.exe
File opened for modification	C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe.new	Tea-hvh-user-agent.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5656	powershell.exe
1880	powershell.exe
1744	powershell.exe
3760	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1660	sc.exe
4832	sc.exe
5732	sc.exe
1324	sc.exe
1592	sc.exe
4340	sc.exe
1212	sc.exe
3272	sc.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Exm Premium.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Exm Premium.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Exm Premium.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5656	powershell.exe
5656	powershell.exe
1880	powershell.exe
1880	powershell.exe
1744	powershell.exe
1744	powershell.exe
1744	powershell.exe
3760	powershell.exe
3760	powershell.exe
3760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeIncreaseQuotaPrivilege	5656	powershell.exe
Token: SeSecurityPrivilege	5656	powershell.exe
Token: SeTakeOwnershipPrivilege	5656	powershell.exe
Token: SeLoadDriverPrivilege	5656	powershell.exe
Token: SeSystemProfilePrivilege	5656	powershell.exe
Token: SeSystemtimePrivilege	5656	powershell.exe
Token: SeProfSingleProcessPrivilege	5656	powershell.exe
Token: SeIncBasePriorityPrivilege	5656	powershell.exe
Token: SeCreatePagefilePrivilege	5656	powershell.exe
Token: SeBackupPrivilege	5656	powershell.exe
Token: SeRestorePrivilege	5656	powershell.exe
Token: SeShutdownPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeSystemEnvironmentPrivilege	5656	powershell.exe
Token: SeRemoteShutdownPrivilege	5656	powershell.exe
Token: SeUndockPrivilege	5656	powershell.exe
Token: SeManageVolumePrivilege	5656	powershell.exe
Token: 33	5656	powershell.exe
Token: 34	5656	powershell.exe
Token: 35	5656	powershell.exe
Token: 36	5656	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeIncreaseQuotaPrivilege	1880	powershell.exe
Token: SeSecurityPrivilege	1880	powershell.exe
Token: SeTakeOwnershipPrivilege	1880	powershell.exe
Token: SeLoadDriverPrivilege	1880	powershell.exe
Token: SeSystemProfilePrivilege	1880	powershell.exe
Token: SeSystemtimePrivilege	1880	powershell.exe
Token: SeProfSingleProcessPrivilege	1880	powershell.exe
Token: SeIncBasePriorityPrivilege	1880	powershell.exe
Token: SeCreatePagefilePrivilege	1880	powershell.exe
Token: SeBackupPrivilege	1880	powershell.exe
Token: SeRestorePrivilege	1880	powershell.exe
Token: SeShutdownPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeSystemEnvironmentPrivilege	1880	powershell.exe
Token: SeRemoteShutdownPrivilege	1880	powershell.exe
Token: SeUndockPrivilege	1880	powershell.exe
Token: SeManageVolumePrivilege	1880	powershell.exe
Token: 33	1880	powershell.exe
Token: 34	1880	powershell.exe
Token: 35	1880	powershell.exe
Token: 36	1880	powershell.exe
Token: SeIncreaseQuotaPrivilege	1880	powershell.exe
Token: SeSecurityPrivilege	1880	powershell.exe
Token: SeTakeOwnershipPrivilege	1880	powershell.exe
Token: SeLoadDriverPrivilege	1880	powershell.exe
Token: SeSystemProfilePrivilege	1880	powershell.exe
Token: SeSystemtimePrivilege	1880	powershell.exe
Token: SeProfSingleProcessPrivilege	1880	powershell.exe
Token: SeIncBasePriorityPrivilege	1880	powershell.exe
Token: SeCreatePagefilePrivilege	1880	powershell.exe
Token: SeBackupPrivilege	1880	powershell.exe
Token: SeRestorePrivilege	1880	powershell.exe
Token: SeShutdownPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeSystemEnvironmentPrivilege	1880	powershell.exe
Token: SeRemoteShutdownPrivilege	1880	powershell.exe
Token: SeUndockPrivilege	1880	powershell.exe
Token: SeManageVolumePrivilege	1880	powershell.exe
Token: 33	1880	powershell.exe
Token: 34	1880	powershell.exe
Token: 35	1880	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 5656	4700	Exm Premium.exe	89
PID 4700 wrote to memory of 1880	4700	Exm Premium.exe	92
PID 1880 wrote to memory of 892	1880	powershell.exe	94
PID 1880 wrote to memory of 4752	1880	powershell.exe	95
PID 1880 wrote to memory of 5732	1880	powershell.exe	96
PID 1880 wrote to memory of 4340	1880	powershell.exe	97
PID 1880 wrote to memory of 1592	1880	powershell.exe	98
PID 1880 wrote to memory of 1324	1880	powershell.exe	99
PID 4700 wrote to memory of 1060	4700	Exm Premium.exe	100
PID 5796 wrote to memory of 1744	5796	Tea-hvh-user-agent.exe	104
PID 5796 wrote to memory of 3760	5796	Tea-hvh-user-agent.exe	107
PID 3760 wrote to memory of 5756	3760	powershell.exe	109
PID 3760 wrote to memory of 5248	3760	powershell.exe	110
PID 3760 wrote to memory of 1212	3760	powershell.exe	111
PID 3760 wrote to memory of 3272	3760	powershell.exe	112
PID 3760 wrote to memory of 1660	3760	powershell.exe	113
PID 3760 wrote to memory of 4832	3760	powershell.exe	114

C:\Users\Admin\AppData\Local\Temp\Exm Premium.exe
"C:\Users\Admin\AppData\Local\Temp\Exm Premium.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Stop-Service -Name 'TeaHvhAgentSupervisor' -Force -ErrorAction SilentlyContinue;Stop-ScheduledTask -TaskName 'Tea hvh Session Agent' -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop' $InstallDir='C:\Program Files\Tea hvh\Agent';$StateDir='C:\ProgramData\Tea hvh\Agent';$Supervisor='C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe';$Session='C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe';$DeviceID='C:\ProgramData\Tea hvh\Agent\device-id.txt';$Ready='C:\ProgramData\Tea hvh\Agent\runtime.ready' $ServiceName='TeaHvhAgentSupervisor';$TaskName='Tea hvh Session Agent';$LegacyTask='Fortnite Club Remote Agent' $ActiveUser=(Get-CimInstance Win32_ComputerSystem).UserName if([string]::IsNullOrWhiteSpace($ActiveUser)){throw 'No interactive Windows user is signed in.'} Stop-ScheduledTask -TaskName $LegacyTask -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $LegacyTask -Confirm:$false -ErrorAction SilentlyContinue Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue Remove-Item -Force $Ready -ErrorAction SilentlyContinue $LegacyIdentity=Join-Path $env:ProgramData 'FortniteClubRemote\device-id.txt' if((Test-Path $LegacyIdentity)-and-not(Test-Path $DeviceID)){Copy-Item -Force $LegacyIdentity $DeviceID} & icacls.exe $InstallDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'Users:(OI)(CI)RX' | Out-Null & icacls.exe $StateDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' (\"${ActiveUser}:(OI)(CI)M\") | Out-Null $Action=New-ScheduledTaskAction -Execute $Session -Argument '--runtime' -WorkingDirectory $InstallDir $Trigger=New-ScheduledTaskTrigger -AtLogOn -User $ActiveUser $Settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -StartWhenAvailable -MultipleInstances IgnoreNew $Principal=New-ScheduledTaskPrincipal -UserId $ActiveUser -LogonType Interactive -RunLevel Highest Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force | Out-Null $ServiceBinary=('\"{0}\" --service' -f $Supervisor) if(Get-Service -Name $ServiceName -ErrorAction SilentlyContinue){& sc.exe config $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem | Out-Null}else{& sc.exe create $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem DisplayName= 'Tea hvh Agent Protection' | Out-Null} & sc.exe description $ServiceName 'Protects and recovers the authorized Tea hvh session agent.' | Out-Null & sc.exe failure $ServiceName reset= 86400 actions= restart/5000/restart/15000/restart/30000 | Out-Null & sc.exe failureflag $ServiceName 1 | Out-Null Start-Service -Name $ServiceName Start-ScheduledTask -TaskName $TaskName "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F Users:(OI)(CI)RX
    3⤵
    - Modifies file permissions
    PID:892
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\ProgramData\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F OAGGWFQT\Admin:(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4752
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create TeaHvhAgentSupervisor binPath= ""C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe" --service" start= auto obj= LocalSystem DisplayName= "Tea hvh Agent Protection"
    3⤵
    - Launches sc.exe
    PID:5732
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" description TeaHvhAgentSupervisor "Protects and recovers the authorized Tea hvh session agent."
    3⤵
    - Launches sc.exe
    PID:4340
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure TeaHvhAgentSupervisor reset= 86400 actions= restart/5000/restart/15000/restart/30000
    3⤵
    - Launches sc.exe
    PID:1592
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failureflag TeaHvhAgentSupervisor 1
    3⤵
    - Launches sc.exe
    PID:1324
- C:\Windows\system32\icacls.exe
  icacls.exe "C:\Users\Admin\AppData\Local\Tea hvh\Agent\device.credential" /inheritance:r /grant:r SYSTEM:F Administrators:F OAGGWFQT\Admin:F
  2⤵
  - Modifies file permissions
  PID:1060

C:\Users\Admin\AppData\Local\Tea hvh\Agent\Tea-hvh-user-agent.exe
"C:\Users\Admin\AppData\Local\Tea hvh\Agent\Tea-hvh-user-agent.exe" --runtime
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Stop-Service -Name 'TeaHvhAgentSupervisor' -Force -ErrorAction SilentlyContinue;Stop-ScheduledTask -TaskName 'Tea hvh Session Agent' -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop' $InstallDir='C:\Program Files\Tea hvh\Agent';$StateDir='C:\ProgramData\Tea hvh\Agent';$Supervisor='C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe';$Session='C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe';$DeviceID='C:\ProgramData\Tea hvh\Agent\device-id.txt';$Ready='C:\ProgramData\Tea hvh\Agent\runtime.ready' $ServiceName='TeaHvhAgentSupervisor';$TaskName='Tea hvh Session Agent';$LegacyTask='Fortnite Club Remote Agent' $ActiveUser=(Get-CimInstance Win32_ComputerSystem).UserName if([string]::IsNullOrWhiteSpace($ActiveUser)){throw 'No interactive Windows user is signed in.'} Stop-ScheduledTask -TaskName $LegacyTask -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $LegacyTask -Confirm:$false -ErrorAction SilentlyContinue Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue Remove-Item -Force $Ready -ErrorAction SilentlyContinue $LegacyIdentity=Join-Path $env:ProgramData 'FortniteClubRemote\device-id.txt' if((Test-Path $LegacyIdentity)-and-not(Test-Path $DeviceID)){Copy-Item -Force $LegacyIdentity $DeviceID} & icacls.exe $InstallDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'Users:(OI)(CI)RX' | Out-Null & icacls.exe $StateDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' (\"${ActiveUser}:(OI)(CI)M\") | Out-Null $Action=New-ScheduledTaskAction -Execute $Session -Argument '--runtime' -WorkingDirectory $InstallDir $Trigger=New-ScheduledTaskTrigger -AtLogOn -User $ActiveUser $Settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -StartWhenAvailable -MultipleInstances IgnoreNew $Principal=New-ScheduledTaskPrincipal -UserId $ActiveUser -LogonType Interactive -RunLevel Highest Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force | Out-Null $ServiceBinary=('\"{0}\" --service' -f $Supervisor) if(Get-Service -Name $ServiceName -ErrorAction SilentlyContinue){& sc.exe config $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem | Out-Null}else{& sc.exe create $ServiceName binPath= $ServiceBinary start= auto obj= LocalSystem DisplayName= 'Tea hvh Agent Protection' | Out-Null} & sc.exe description $ServiceName 'Protects and recovers the authorized Tea hvh session agent.' | Out-Null & sc.exe failure $ServiceName reset= 86400 actions= restart/5000/restart/15000/restart/30000 | Out-Null & sc.exe failureflag $ServiceName 1 | Out-Null Start-Service -Name $ServiceName Start-ScheduledTask -TaskName $TaskName "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F Users:(OI)(CI)RX
    3⤵
    - Modifies file permissions
    PID:5756
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\ProgramData\Tea hvh\Agent" /inheritance:r /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F OAGGWFQT\Admin:(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:5248
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create TeaHvhAgentSupervisor binPath= ""C:\Program Files\Tea hvh\Agent\Tea-hvh-supervisor.exe" --service" start= auto obj= LocalSystem DisplayName= "Tea hvh Agent Protection"
    3⤵
    - Launches sc.exe
    PID:1212
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" description TeaHvhAgentSupervisor "Protects and recovers the authorized Tea hvh session agent."
    3⤵
    - Launches sc.exe
    PID:3272
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure TeaHvhAgentSupervisor reset= 86400 actions= restart/5000/restart/15000/restart/30000
    3⤵
    - Launches sc.exe
    PID:1660
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failureflag TeaHvhAgentSupervisor 1
    3⤵
    - Launches sc.exe
    PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tea-hvh-session-agent.exe.new

Path C:\Program Files\Tea hvh\Agent\Tea-hvh-session-agent.exe.new
Size 10.7MB
SHA256 590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf
MD5 cac7debea1217a51c3720e9dfa08f1cc
SHA1 63dc63bde19edb5d6aaf668a6f5dedb0139e8f96
SHA512 cc7f1325c5747eb12f89f58ffa2d6a1beab06e812efe770a803192d10ea28589623030d918893344222c65babe3ba5d731fe55b650c453561594e7f2da4847d1
SSDEEP 98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkze3ykimB1PF2EEaO:VkUIEGaABtlN7L3ykim2
TLSH
T1C3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 35a053d342be344a4e5b81c0154966f6c6f7af55fa84936b0325f1aa32980655
MD5 34c83f88aa581ba243c2cb6a5232a15f
SHA1 aa6a0d420f674159b0fc528c911007e03ce95adb
SHA512 30b58a2740f8b3d5fdda0041b154a0395576e509dd4eeef5b6b8b951a2fe95ca6aeca4f2bad3c3a0c013c8ad468068a848525568814941b2535b465bc494835a
TLSH
T1C8216737B3DC8624C899013610DEAC1036B687DB819E8FABAB84E555A53F698DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8a47c61c01c9a0af7c92a510c0967f09c3e507e4c66c1f766c062f8cb31be191
MD5 564de00e4e623b40c33dcf91d9bb6c74
SHA1 aeb13a2e49154eb230c52282edc4cfd3af056bde
SHA512 7bebb8e67ab70e9fbfd10bf6d01b77680ad51b1a17a5b165840248c1e82d193a8cdb870ad18b95d2fe7f15f74cd58370ac7300464225cc17bcb4274cca122a01
TLSH
T1A4216737B3CC8624C899013610CEAC1036BA87DB409E9FABAB84E155A52F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 317e2d7ef5524979ad97c5fe3f5e1253899609dfebadfada84e76de63e0b6cff
MD5 0226222e39f5cd26b4761f5f68475eef
SHA1 b4885742fd40347e0648844efdc187a548066f12
SHA512 c65a1c33378644b96ac4406597bd4b1e27758e7b813e8ebd9ed10839c5169a797928aeaa564e31f99a110d21d7dcc9e5020176ca2bb74aa75f306764bfba62f6
TLSH
T1DB318637F3DC8220C89D413A10DDAC1036BAC7DB80DEDF9B6B80E255A52F698DEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\agent.log
Size 347B
SHA256 0de2aa00a056acb4bc15c540606c81b92536840906017919b414914125248b57
MD5 5f31e2cda6525bea9690fdcea2200e3b
SHA1 c72a4c415079a63acb04155ba7b3b737b9c6bb32
SHA512 2c6960d58b5d3af3b65267b536b15031d823b8b5523ba346a4ed1c42dbcc10de7acc4d0352d076c1a6b3e55f97b56fd426ceac5027afe5869f770bf64a286d97
TLSH
T147E0869007132C7F3FAB53A5BD8D27595250725B0B603886DAAD4B442C37E571D6F054
MD5 SHA1 SHA512 TLSH

Submit Download

device.credential

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\device.credential
Size 65B
SHA256 71c2e55e0e45f261df62350334fcb22ee04f2ceeda3004b63e2b5af8865d8990
MD5 17250aec169954e2f6451e799819def2
SHA1 e278900f882d4814d9128397780b8a42736d09fe
SHA512 e1c3d2aead1da6c9930f0052eec186b78efda7925067d3f79e5b01076f1b1415dd7bf6ba79435a0ea3267cac8f36289cab723b1ced907f20cc6c8833ffa6cc4c
TLSH
T130A0023B7C23A6E5868AA5624A792F90408E1903E8508C9D00AE755416FDFAC603C17A
MD5 SHA1 SHA512 TLSH

Submit Download

identity.json

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\identity.json
Size 148B
SHA256 39b183526960b166434d11c7064dfb8573dbfe445c4bff6428c35ef46f60b1a8
MD5 2444878e3fb7b94c26e30d292347fc29
SHA1 d0b3b354ecc5f786b28cd5522523f53f82c5c878
SHA512 0dc6a2973db0a595d32426bfef003f5bcfdf3fdb80f8ff8b14d45a4f79a15542804f59a7f8078a332375480e5e659ca984fbc7637900ff8d25951e64a01004ed
TLSH
T110C02B8E341D7CE0CC20A2148D3A8DD147374021370C91E1134EC730429FF2F21151D3
MD5 SHA1 SHA512 TLSH

Submit Download

last-error.txt

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\last-error.txt
Size 453B
SHA256 52640831c63d2039bce0e458d5632d40cd4f527d9352b50cfe512ebcc30014da
MD5 8de8cbf311fe345602e676210e4209e9
SHA1 250acc2ce6e1dc93a60fbeb53150b3f3b07aa3b2
SHA512 1d41d5af17cc897826cf328a6e4a747118b858fe12b4724d9366fa02a85f009547e50b056516d0705d73f2895df17e624b974db26f87e7cd907340cd7769a180
TLSH
T145F02B2DB4DF81FB4A6381060C970352569A81AD005E3656B3FDBB403BF286FD55154A
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.ready

Path C:\Users\Admin\AppData\Local\Tea hvh\Agent\runtime.ready
Size 29B
SHA256 0dc8d5969c5cb7e9741def529d2154eced85b3b66362498827f4cc04d9cf2b7c
MD5 0087a2a373c1bbdafffb014ccb4c9ed0
SHA1 8ec9f805274782ef5982fe190b652541523fb782
SHA512 d315ea72bce7a7e8eaef28e6e796a93d5b2efdd71ffd38c5f106a16c4d712e06ff05e745e7e50c14a6c535bfb8886de7d42dc29f715057a37b4821b23c9a7294
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_idz1kups.52e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idz1kups.52e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1744-89-0x0000020ECC8B0000-0x0000020ECC9A0000-memory.dmp

Download

memory/1880-58-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-53-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-66-0x00000229C0740000-0x00000229C0830000-memory.dmp

Download

memory/1880-67-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-59-0x00000229C02B0000-0x00000229C02DA000-memory.dmp

Download

memory/1880-60-0x00000229C02B0000-0x00000229C02D4000-memory.dmp

Download

memory/1880-57-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-56-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-55-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-54-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-52-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-49-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-48-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-47-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-46-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-45-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-39-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-40-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/1880-43-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3760-108-0x00000282F4440000-0x00000282F4530000-memory.dmp

Download

memory/5656-19-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-4-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-30-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-29-0x0000016EF1C80000-0x0000016EF1D70000-memory.dmp

Download

memory/5656-16-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-26-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-24-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-25-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-23-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-22-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-21-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-0-0x00007FFC1D85F000-0x00007FFC1D860000-memory.dmp

Download

memory/5656-15-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-20-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-27-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-18-0x0000016EF1CA0000-0x0000016EF1CBE000-memory.dmp

Download

memory/5656-17-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-11-0x0000016EF1730000-0x0000016EF174E000-memory.dmp

Download

memory/5656-12-0x0000016EF1AC0000-0x0000016EF1B72000-memory.dmp

Download

memory/5656-8-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-7-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-13-0x0000016EF1750000-0x0000016EF175A000-memory.dmp

Download

memory/5656-6-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-14-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5656-5-0x0000016EF1690000-0x0000016EF16B2000-memory.dmp

Download

memory/5656-1-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5796-120-0x00007FF6A8A80000-0x00007FF6A958D000-memory.dmp

Download

memory/5796-122-0x00007FF6A8A80000-0x00007FF6A958D000-memory.dmp

Download