cfb87c19ef010e692dee542c653aeaae08f318273bf4f59a30e70d8c404cc296

Resubmissions

07/08/2026, 16:34

260807-t3jh7ssvby7

07/08/2026, 16:16

260807-tq3rbagq9y7

07/08/2026, 16:07

260807-tksddsgg297

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tea.exe
Size 7.0MB
Sample260807-tksddsgg29
SHA256 cfb87c19ef010e692dee542c653aeaae08f318273bf4f59a30e70d8c404cc296
MD5 13a0f31e9b3cb9aab597810481e1f4d0
SHA1 c6646eb2c19f1016184c856952a3db7bb5cf3910
SHA512 c9ca2187bdd5dd45044f2923ceb9d74fbec273cf264ff0f31d15661275fbd4892f9c4836d2276fa55b23a01767b113d5804313132c9cccc08c8276d909c8f309
SSDEEP 49152:+p6zrwe2HqNyQNqM7Pn7xMm8Hn4h75Qp6krsIEs7c6rWMtmUX1/V/g3Cz5a5agK/:+pAn4oQjpnvrOx3CeaF0umvBh8huTtE
TLSH
T1FA763907ECA554E9C0BE813189739562BB717C495B3123D32B50F6382F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4388	tea.exe
3752	tea.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4592	powershell.exe
4452	powershell.exe
4212	powershell.exe
1624	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4592	powershell.exe
4592	powershell.exe
4452	powershell.exe
4452	powershell.exe
4212	powershell.exe
4212	powershell.exe
1624	powershell.exe
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4620	2876	tea.exe	89
PID 2876 wrote to memory of 4388	2876	tea.exe	92
PID 4388 wrote to memory of 4592	4388	tea.exe	93
PID 4388 wrote to memory of 4452	4388	tea.exe	96
PID 4388 wrote to memory of 4212	4388	tea.exe	98
PID 4388 wrote to memory of 1624	4388	tea.exe	100
PID 4388 wrote to memory of 4480	4388	tea.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tea.exe
"C:\Users\Admin\AppData\Local\Temp\tea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\tea_task.xml /TN tea /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4620
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tea.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tea.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- - C:\Windows\system32\cmd.exe
    cmd /C ""
    3⤵
    - Executes a command shell one-liner
    PID:4480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tea.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tea.exe"
1⤵
- Executes dropped EXE
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ev1y54em.hsj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ev1y54em.hsj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tea_task.xml

Path C:\Users\Admin\AppData\Local\Temp\tea_task.xml
Size 1KB
SHA256 ab77c503cbe86048006168bfc7c815bf21cf47d547d7c783294aa376fdb2ab33
MD5 1a7d86e090baad9029c430b680019b9e
SHA1 507abf61f84b69f05a1c7ccd0a6418bb66478de0
SHA512 16a64ae0a8700216e9a17570c583fa0d95f23aea91ed9a2c127c84f36b988580429de8e793ee1d2b6a57dc68fa73946c4c6284de3526f0d07a74bb57b402a2b1
TLSH
T1BD2165905C14F21F7156573ACB921383373E6BA50AB14038DCCC4DBC748A1C6710397B
MD5 SHA1 SHA512 TLSH

Submit Download

tea.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tea.exe
Size 7.0MB
SHA256 cfb87c19ef010e692dee542c653aeaae08f318273bf4f59a30e70d8c404cc296
MD5 13a0f31e9b3cb9aab597810481e1f4d0
SHA1 c6646eb2c19f1016184c856952a3db7bb5cf3910
SHA512 c9ca2187bdd5dd45044f2923ceb9d74fbec273cf264ff0f31d15661275fbd4892f9c4836d2276fa55b23a01767b113d5804313132c9cccc08c8276d909c8f309
SSDEEP 49152:+p6zrwe2HqNyQNqM7Pn7xMm8Hn4h75Qp6krsIEs7c6rWMtmUX1/V/g3Cz5a5agK/:+pAn4oQjpnvrOx3CeaF0umvBh8huTtE
TLSH
T1FA763907ECA554E9C0BE813189739562BB717C495B3123D32B50F6382F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4592-8-0x000001BB32590000-0x000001BB325B2000-memory.dmp

Download