5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705

Analysis

max time kernel
17s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
Size 13.6MB
Sample260804-yywp7axvds
SHA256 5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705
MD5 1ce46fad92380ed788416c722264a876
SHA1 f7536add9afb7556f00588b84217dc5131916fb7
SHA512 77dbc31d06901d05ca69441d4e9cd59c7cb674a099b93902a6fcd06d4fbe87b29a4ac3a9c38db55a0ebb62204dd81ba011040d69b21eb1f33bde98b72b414f6c
SSDEEP 393216:/GmPOyOyTOP7Z5wMptYkOC/r7XMCHWUjecuI3/PGTAI:/GOOyWxpOkxj7XMb8TH/O7
TLSH
T197E6331CB6C002ADF7735078ADE15499E779F4B227B1C9DF42A846A3BD235F00A3D626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
1200	powershell.exe
4948	powershell.exe
2728	powershell.exe
5868	powershell.exe
4716	powershell.exe
1456	powershell.exe
1684	powershell.exe
1008	powershell.exe
2384	powershell.exe
5408	powershell.exe
2892	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1040	cmd.exe
3704	cmd.exe
5824	cmd.exe
5592	cmd.exe
2108	cmd.exe
1712	cmd.exe
5576	cmd.exe
5936	cmd.exe
5488	cmd.exe
3148	cmd.exe
3948	cmd.exe
4284	cmd.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
1456	powershell.exe
1456	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1200	powershell.exe
1200	powershell.exe
1200	powershell.exe
1008	powershell.exe
1008	powershell.exe
1008	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeIncreaseQuotaPrivilege	1456	powershell.exe
Token: SeSecurityPrivilege	1456	powershell.exe
Token: SeTakeOwnershipPrivilege	1456	powershell.exe
Token: SeLoadDriverPrivilege	1456	powershell.exe
Token: SeSystemProfilePrivilege	1456	powershell.exe
Token: SeSystemtimePrivilege	1456	powershell.exe
Token: SeProfSingleProcessPrivilege	1456	powershell.exe
Token: SeIncBasePriorityPrivilege	1456	powershell.exe
Token: SeCreatePagefilePrivilege	1456	powershell.exe
Token: SeBackupPrivilege	1456	powershell.exe
Token: SeRestorePrivilege	1456	powershell.exe
Token: SeShutdownPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeSystemEnvironmentPrivilege	1456	powershell.exe
Token: SeRemoteShutdownPrivilege	1456	powershell.exe
Token: SeUndockPrivilege	1456	powershell.exe
Token: SeManageVolumePrivilege	1456	powershell.exe
Token: 33	1456	powershell.exe
Token: 34	1456	powershell.exe
Token: 35	1456	powershell.exe
Token: 36	1456	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeIncreaseQuotaPrivilege	1684	powershell.exe
Token: SeSecurityPrivilege	1684	powershell.exe
Token: SeTakeOwnershipPrivilege	1684	powershell.exe
Token: SeLoadDriverPrivilege	1684	powershell.exe
Token: SeSystemProfilePrivilege	1684	powershell.exe
Token: SeSystemtimePrivilege	1684	powershell.exe
Token: SeProfSingleProcessPrivilege	1684	powershell.exe
Token: SeIncBasePriorityPrivilege	1684	powershell.exe
Token: SeCreatePagefilePrivilege	1684	powershell.exe
Token: SeBackupPrivilege	1684	powershell.exe
Token: SeRestorePrivilege	1684	powershell.exe
Token: SeShutdownPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeSystemEnvironmentPrivilege	1684	powershell.exe
Token: SeRemoteShutdownPrivilege	1684	powershell.exe
Token: SeUndockPrivilege	1684	powershell.exe
Token: SeManageVolumePrivilege	1684	powershell.exe
Token: 33	1684	powershell.exe
Token: 34	1684	powershell.exe
Token: 35	1684	powershell.exe
Token: 36	1684	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4884	3784	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	89
PID 4884 wrote to memory of 1040	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	90
PID 1040 wrote to memory of 1456	1040	cmd.exe	92
PID 4884 wrote to memory of 1712	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	94
PID 1712 wrote to memory of 1684	1712	cmd.exe	96
PID 4884 wrote to memory of 5576	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	97
PID 5576 wrote to memory of 1200	5576	cmd.exe	99
PID 4884 wrote to memory of 5936	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	100
PID 5936 wrote to memory of 1008	5936	cmd.exe	102
PID 4884 wrote to memory of 3704	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	103
PID 3704 wrote to memory of 4948	3704	cmd.exe	105
PID 4884 wrote to memory of 5488	4884	5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe	106
PID 5488 wrote to memory of 2384	5488	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
"C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe
  "C:\Users\Admin\AppData\Local\Temp\5892541e8901d5ea993dc7fe55726e90556e84e92f8cb10dbb10cf6d1e3d4705.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\folimug'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\folimug'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    PID:5824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    PID:5592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    PID:2108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    PID:3148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:3948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:4284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact