5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705

Analysis

max time kernel
39s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
Size 13.6MB
Sample260804-yywp7axvds
SHA256 5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705
MD5 1ce46fad92380ed788416c722264a876
SHA1 f7536add9afb7556f00588b84217dc5131916fb7
SHA512 77dbc31d06901d05ca69441d4e9cd59c7cb674a099b93902a6fcd06d4fbe87b29a4ac3a9c38db55a0ebb62204dd81ba011040d69b21eb1f33bde98b72b414f6c
SSDEEP 393216:/GmPOyOyTOP7Z5wMptYkOC/r7XMCHWUjecuI3/PGTAI:/GOOyWxpOkxj7XMb8TH/O7
TLSH
T197E6331CB6C002ADF7735078ADE15499E779F4B227B1C9DF42A846A3BD235F00A3D626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
844	powershell.exe
3020	powershell.exe
4396	powershell.exe
5112	powershell.exe
5016	powershell.exe
3932	powershell.exe
4488	powershell.exe
5000	powershell.exe
2300	powershell.exe
1928	powershell.exe
820	powershell.exe
3560	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1536	cmd.exe
3608	cmd.exe
2316	cmd.exe
3492	cmd.exe
3788	cmd.exe
3792	cmd.exe
3968	cmd.exe
2676	cmd.exe
1048	cmd.exe
3248	cmd.exe
2200	cmd.exe
4756	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
5000	powershell.exe
5000	powershell.exe
2300	powershell.exe
2300	powershell.exe
3020	powershell.exe
3020	powershell.exe
1928	powershell.exe
1928	powershell.exe
4396	powershell.exe
4396	powershell.exe
5112	powershell.exe
5112	powershell.exe
5016	powershell.exe
5016	powershell.exe
820	powershell.exe
820	powershell.exe
3932	powershell.exe
3932	powershell.exe
3560	powershell.exe
3560	powershell.exe
4488	powershell.exe
4488	powershell.exe
844	powershell.exe
844	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 344	3828	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	86
PID 344 wrote to memory of 3492	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	87
PID 3492 wrote to memory of 5000	3492	cmd.exe	89
PID 344 wrote to memory of 2200	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	90
PID 2200 wrote to memory of 2300	2200	cmd.exe	92
PID 344 wrote to memory of 3788	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	93
PID 3788 wrote to memory of 3020	3788	cmd.exe	95
PID 344 wrote to memory of 3792	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	96
PID 3792 wrote to memory of 1928	3792	cmd.exe	98
PID 344 wrote to memory of 3968	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	99
PID 3968 wrote to memory of 4396	3968	cmd.exe	101
PID 344 wrote to memory of 2676	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	102
PID 2676 wrote to memory of 5112	2676	cmd.exe	104
PID 344 wrote to memory of 1048	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	105
PID 1048 wrote to memory of 5016	1048	cmd.exe	107
PID 344 wrote to memory of 3248	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	108
PID 3248 wrote to memory of 820	3248	cmd.exe	110
PID 344 wrote to memory of 4756	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	111
PID 4756 wrote to memory of 3932	4756	cmd.exe	113
PID 344 wrote to memory of 1536	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	114
PID 1536 wrote to memory of 3560	1536	cmd.exe	116
PID 344 wrote to memory of 3608	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	117
PID 3608 wrote to memory of 4488	3608	cmd.exe	119
PID 344 wrote to memory of 2316	344	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	120
PID 2316 wrote to memory of 844	2316	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
"C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
  "C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\folimug'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\folimug'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...