21d550ec0dd8f06a54e48e6e9e9064664f0a2feb48d0cdc0076b638f82e80bbb

Analysis

user interaction
yes
max time kernel
899s
max time network
895s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
penis.exe
Size 7.1MB
Sample260813-x2eqeaem6t
SHA256 21d550ec0dd8f06a54e48e6e9e9064664f0a2feb48d0cdc0076b638f82e80bbb
MD5 febdad761863f8104f94a072c07e9094
SHA1 da33251aabfcbfee2a10af17dfa6988ef86f6906
SHA512 98d76c31e8f6be19770e249941c08cc30db51ba21cbde60830f8aa16d191c607a2e46267c9d48b9bb55fd9e2748723a9703fb11cc33f0da4fde50313af119a97
SSDEEP 49152:bkEjD/SnvEcI8C9CTXeD3K8Wh6otmRmE0b1GbC4LJVGapoTMUVNnLJVSqNtrmabu:bksjWA53P8am/Nt9atLaumvBh8huTOE
TLSH
T17F763947ECA514E9C0BDD1358963A622BF617C495B3123D32B90F2382F7ABE0AD79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4084	penis.exe
2292	penis.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5664	powershell.exe
3348	powershell.exe
4252	powershell.exe
5756	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5664	powershell.exe
5664	powershell.exe
3348	powershell.exe
3348	powershell.exe
4252	powershell.exe
4252	powershell.exe
5756	powershell.exe
5756	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5664	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	5756	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5152	4636	penis.exe	89
PID 4636 wrote to memory of 4084	4636	penis.exe	92
PID 2292 wrote to memory of 5664	2292	penis.exe	93
PID 2292 wrote to memory of 3348	2292	penis.exe	96
PID 2292 wrote to memory of 4252	2292	penis.exe	98
PID 2292 wrote to memory of 5756	2292	penis.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\penis.exe
"C:\Users\Admin\AppData\Local\Temp\penis.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\penis_task.xml /TN penis /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5152
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\penis.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\penis.exe
  2⤵
  - Executes dropped EXE
  PID:4084

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\penis.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\penis.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4004

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bca2b536c0d09e3deb4742239de09097e01cd7d51b06f5c4f245018a3c477c43
MD5 719ccebde13533e6a4bbd6581c6f90ac
SHA1 18e46bc0f44116653af85e06081b3cf285e40726
SHA512 4f0ccc98ebbd7d381707d8d16a92cb7be2ca2d4754dd8aaf3c0ed97ae6dc986d308c86b1bda29d89b6067cc2621f418a5b38427b0b9f6fa0628243212eddb5fd
TLSH
T1D3119733B3CC8324C89A403650CEAC1036B587DB80CECE6BBB84D148A83F599CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5566dfb134a39a555707f2b038ea493a1fd2b32fafa19ad48befcaf5f74c1895
MD5 9b3448f31ccdd1ea52e0882ab95db7ee
SHA1 6c306c9617769481fc49373e5970d1b218ba2b15
SHA512 064d8789908b4a5704c5304a37b3209b898b616f0bfd2536cc7b61a7fb7830b3f54c16428b5431e8c5c96721daf3d383ddfa3af288c707c2b777c599b47c3332
TLSH
T146115733B3CC8724C89A403650CEAC1136B597DB90DEDF6B7B84D149A83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bieow20p.cqp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bieow20p.cqp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

penis_task.xml

Path C:\Users\Admin\AppData\Local\Temp\penis_task.xml
Size 1KB
SHA256 7f1a6076099c69c86fceb72a4dee400be49d52145248c99ffaa10baea45d2918
MD5 10dc8b850d065a60b39d323cb9afcdf4
SHA1 c8d0f280eabdfcbb07a05b71d2c852becad9090f
SHA512 d9007ff8cf313609a6ad59725b209909dcb2be57bedb855b4872b650c60608b47804cfe24771506075374d97e680a5d9d49378f416f6913e19a0b1c93b548168
TLSH
T18F2135905C10F61F7556573ACB921783373E5B650AB14138D8CC4DBC748A1CA711397B
MD5 SHA1 SHA512 TLSH

Submit Download

penis.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\penis.exe
Size 7.1MB
SHA256 21d550ec0dd8f06a54e48e6e9e9064664f0a2feb48d0cdc0076b638f82e80bbb
MD5 febdad761863f8104f94a072c07e9094
SHA1 da33251aabfcbfee2a10af17dfa6988ef86f6906
SHA512 98d76c31e8f6be19770e249941c08cc30db51ba21cbde60830f8aa16d191c607a2e46267c9d48b9bb55fd9e2748723a9703fb11cc33f0da4fde50313af119a97
SSDEEP 49152:bkEjD/SnvEcI8C9CTXeD3K8Wh6otmRmE0b1GbC4LJVGapoTMUVNnLJVSqNtrmabu:bksjWA53P8am/Nt9atLaumvBh8huTOE
TLSH
T17F763947ECA514E9C0BDD1358963A622BF617C495B3123D32B90F2382F7ABE0AD79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3348-17-0x000001EDEFA50000-0x000001EDEFB40000-memory.dmp

Download

memory/4252-22-0x00000205703D0000-0x00000205704C0000-memory.dmp

Download

memory/5664-10-0x00000203588F0000-0x0000020358912000-memory.dmp

Download

memory/5664-12-0x0000020370C30000-0x0000020370D20000-memory.dmp

Download

memory/5756-27-0x000002C7DB0D0000-0x000002C7DB1C0000-memory.dmp

Download