13e271ccd7f31a0553fcaf51ef771f3407d5753cb87e08da53a8321e041d4e7f

Analysis

max time kernel
300s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Documents.PDF .exe
Size 7.0MB
Sample260815-dc52hsysd1
SHA256 13e271ccd7f31a0553fcaf51ef771f3407d5753cb87e08da53a8321e041d4e7f
MD5 ea6d40b7de2d14368b7e325d279ff1d3
SHA1 3d69487821de49e53ea0f0a2eed119eecff0b50a
SHA512 0a84a2faea0dcfab14d6e9c33ffb3d0ef47791e6a70eb6aef3e13c442dc801c2cfeae3b97516d6c5d9dc93c711fa6ffa726de3e44098dadc828a3d62a872ee15
SSDEEP 98304:hzknz/NQTrHcsTDB1REocxS3mC7BvPwH7k/RsC:h+LNHs/ny1SWYYQt
TLSH
T10C767C07EC6954E9D1AED13089769163BB717C881B2123D72B50F6387FB6BE0ADB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe
2044	powershell.exe
4984	powershell.exe
4716	powershell.exe
2744	powershell.exe
1728	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2320	Documents.PDF .exe
2320	Documents.PDF .exe
2320	Documents.PDF .exe
2320	Documents.PDF .exe
1728	powershell.exe
2044	powershell.exe
4716	powershell.exe
4984	powershell.exe
2744	powershell.exe
2744	powershell.exe
2448	powershell.exe
4716	powershell.exe
2044	powershell.exe
1728	powershell.exe
2448	powershell.exe
4984	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4716	2320	Documents.PDF .exe	86
PID 2320 wrote to memory of 2744	2320	Documents.PDF .exe	87
PID 2320 wrote to memory of 1728	2320	Documents.PDF .exe	88
PID 2320 wrote to memory of 2448	2320	Documents.PDF .exe	89
PID 2320 wrote to memory of 2044	2320	Documents.PDF .exe	90
PID 2320 wrote to memory of 4984	2320	Documents.PDF .exe	91

C:\Users\Admin\AppData\Local\Temp\Documents.PDF .exe
"C:\Users\Admin\AppData\Local\Temp\Documents.PDF .exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7ac9e52f11de3f117d7a7f1bda793dd60756b764e4f0217ff87c66a20bf96d16
MD5 fb7fc2c643e952a1d3241b5fac8ef241
SHA1 4310dc08d34678c0a48c7cacb94f313f9fdd3720
SHA512 8ceb0a588e3b3cabf9edf80dbfbc24b1f3fb2f379e3cf9262c6ba762ab1d5b89d4f394a67c2756f58e7bd879ab94e232e41bd7d8c611fcfcca976fb3188f3099
TLSH
T189112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CBA12A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 4211b5503de68413f5605cbeec4a49fb46fbec44c58df95be892f0dc308a39cf
MD5 a15743cd087226baafa094c9aed07dc4
SHA1 2124cf2ac13da80b2e3cd37d3eab477261771423
SHA512 301e82e45c3e190bdbc1316cda1cd735434c5aa873a57322e807c7cf4c23e006e11a7347ebb0f8afed181d3a4d860202cbd6fc721b9970296c7a4b1a367805a7
TLSH
T11E112223F38C8920CC96163A509DAC6172B586CB81AEDF9F7FC0C210A5BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cbf20404c609c0792de4320ac3fa1806269cf5d97420565e3f43d409a11a2808
MD5 842369b08704bbddf9de4d90016e58dd
SHA1 8bc3da656c08abbc14c58201e65b0dc823964bea
SHA512 8f6cc3419f04b1cb4e6c7986ad9fb8a43fb380fee263937e223d8a5269aec918c2c8cd362ee708de0ded3a533f4cd43624d606f45b37e128bec52ada30c43b42
TLSH
T1BD112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sgxlnu51.no1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sgxlnu51.no1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1728-60-0x0000021318000000-0x000002131814E000-memory.dmp

Download

memory/2044-9-0x000001B94B7C0000-0x000001B94B7E2000-memory.dmp

Download

memory/2044-57-0x000001B965B00000-0x000001B965C4E000-memory.dmp

Download

memory/2448-63-0x0000025534B10000-0x0000025534C5E000-memory.dmp

Download

memory/2744-0-0x0000018DFD510000-0x0000018DFD520000-memory.dmp

Download

memory/2744-47-0x0000018DFF9D0000-0x0000018DFFB1E000-memory.dmp

Download

memory/2744-1-0x0000018DFD510000-0x0000018DFD520000-memory.dmp

Download

memory/4716-51-0x00000213EC350000-0x00000213EC49E000-memory.dmp

Download

memory/4984-56-0x000001C77BF80000-0x000001C77C0CE000-memory.dmp

Download