c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe
Size 1.2MB
Sample260821-r267rssbkh
SHA256 c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928
MD5 00388f55fbdab2eaea1cce5590b8e18c
SHA1 70c5a7b7b7c5fe03bf94290cafd5642dce253592
SHA512 6929722cacec28e6fe61e1b1b55b77b3b2e8cd6013433f67d20dd45f68eab64965e104129b082402192c7eb420d0abb17d404a24f8c652e7c1e04d5eab5d5480
SSDEEP 384:wULYKWgplTc7YL2UlsVb4GxwxSCntlLS4jzVlos:rMZg1seGxwxlxzVCs
TLSH
T1E245C50A180A04D9E70AC63A80115526DB6DFF22D72425FF16A3B2265CF1BF78EF95DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1664	srvhost8D78r.exe
2456	srvhost8D78r.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcHost8D78 = "C:\\Users\\Admin\\AppData\\Local\\WinLogs\\srvhost8D78r.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcHost8D78 = "C:\\Users\\Admin\\AppData\\Local\\WinLogs\\srvhost8D78r.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcHost8D78 = "C:\\Users\\Admin\\AppData\\Local\\WinLogs\\srvhost8D78r.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4184	powershell.exe
4844	powershell.exe
2092	powershell.exe
3508	powershell.exe
4452	powershell.exe
5052	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5312	cmd.exe
4672	cmd.exe
5756	cmd.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3472	c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe
3472	c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe
3472	c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe
3472	c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe
3508	powershell.exe
3508	powershell.exe
4452	powershell.exe
4452	powershell.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
2456	srvhost8D78r.exe
2456	srvhost8D78r.exe
2456	srvhost8D78r.exe
2456	srvhost8D78r.exe
2456	srvhost8D78r.exe
2456	srvhost8D78r.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
2092	powershell.exe
2092	powershell.exe
2092	powershell.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe
1664	srvhost8D78r.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 5756	3472	c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe	90
PID 5756 wrote to memory of 3508	5756	cmd.exe	92
PID 5756 wrote to memory of 4452	5756	cmd.exe	94
PID 1664 wrote to memory of 5312	1664	srvhost8D78r.exe	97
PID 5312 wrote to memory of 5052	5312	cmd.exe	99
PID 5312 wrote to memory of 4184	5312	cmd.exe	100
PID 2456 wrote to memory of 4672	2456	srvhost8D78r.exe	104
PID 4672 wrote to memory of 4844	4672	cmd.exe	106
PID 4672 wrote to memory of 2092	4672	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe
"C:\Users\Admin\AppData\Local\Temp\c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s8D78.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\p2.ps1"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4452

C:\Users\Admin\AppData\Local\WinLogs\srvhost8D78r.exe
C:\Users\Admin\AppData\Local\WinLogs\srvhost8D78r.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s8D78.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\p2.ps1"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4184

C:\Users\Admin\AppData\Local\WinLogs\srvhost8D78r.exe
"C:\Users\Admin\AppData\Local\WinLogs\srvhost8D78r.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s8D78.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\p2.ps1"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 75b449253617188b7068c8b776e0dc2a6bba3fe648009a94525c2df203cefc5f
MD5 ad39b2871719eaab3d99b1ca7a51e80d
SHA1 720fae660ce94b37c804a14e94682999b5696961
SHA512 25a3e8b480599d9065fe7f62740ae0330fe5dabbb845914e8993849a6f3df905473c5f062d554b22e31148e970625d0b91fea5db6f5a40341c526500aec8bdb2
TLSH
T1E1215333F3CC8624C89A403A50CEAC1036B687DB419ECEABBB84D154A43F699DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8bb032aed4da054f8d4c7413b4b8b6bacb881885c833cd61def61a8a72c881d5
MD5 965b5305c66cc02b40331a6e8363e0db
SHA1 2c01c3c9daca379960150eae6a4e7abf5497b0fe
SHA512 3e0f2ddcda5febb9575b8eaa8c7221f28d88af9283b595b014f0c40b8fbf6e67f983cb66ce7621bc402edbffb26db00f7b00ffffd69cc3eba4d261538d1dcb36
TLSH
T1F3215333F3CC8624C89A403A50CEAC1036B687DB419ECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4bzk4wsy.sdk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4bzk4wsy.sdk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

p2.ps1

Path C:\Users\Admin\AppData\Local\Temp\p2.ps1
Size 259B
SHA256 69573cbe6eaabd021120f1d9ebdbed7effefafbe13a4728069135ea9f77e6cd4
MD5 7e1c8b9fd5201f5defc07f8a6a63ba24
SHA1 274a65e46bf81dd1e36d4d3ce80a0c34243f49a0
SHA512 df9590f61ae27a208c0c578872395fd4055d96d2a1c3d090047c1e74562eb098398655da49c51da49514e63e7d90a2cf11eb75be522217711c75c3d5cdb420a6
TLSH
T1B2D09772A367AE62E0A01013A88A2341C6350D4F30B99241B310B048653A12E9FFE2FF
MD5 SHA1 SHA512 TLSH

Submit Download

s8D78.bat

Path C:\Users\Admin\AppData\Local\Temp\s8D78.bat
Size 1KB
SHA256 348c66955377f68b4bb6cabeb2c2753c8ed8c159fac203169e1c4f9195669e4c
MD5 58349abcabf4dce5cf353be08989e31b
SHA1 a6df29d69b626ed305d04102636e852ddce5d0b6
SHA512 ba38b6c85d61b1000d1489e715997887e0555ae3e19642e388696e46d20da671e7faa5eff0c7e472dce81bd5b23cf89de8437fde391995155e697a408a8afe0c
TLSH
T14611FCBBB3219B71D8590C2CE59E0812083E4C0EE067DE9822161177D03B675C3FE6EE
MD5 SHA1 SHA512 TLSH

Submit Download

t.ps1

Path C:\Users\Admin\AppData\Local\Temp\t.ps1
Size 486B
SHA256 ce2455da96890cf6fa5cf820d3e1435391a334d0b4c8af1f0b777a6d15f3d54d
MD5 deebbda1ca4057ef673ac01eaf838c4d
SHA1 fd60394b7d05c9a1c81b27d006868159fd5fbce6
SHA512 1c87fcfc66b1b447168d75d10d8b847d849531298c0eeef07bd57a8e677e0c69282cc9c0ae091223f30ac685d16b027e339e55749f81b49a1d633d80056fac32
TLSH
T12FF09737FA349131C9976C6DC4A6619408291C19ECA7A60C221F8034D1BB42AE2DE809
MD5 SHA1 SHA512 TLSH

Submit Download

srvhost8D78r.exe

Path C:\Users\Admin\AppData\Local\WinLogs\srvhost8D78r.exe
Size 1.2MB
SHA256 c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928
MD5 00388f55fbdab2eaea1cce5590b8e18c
SHA1 70c5a7b7b7c5fe03bf94290cafd5642dce253592
SHA512 6929722cacec28e6fe61e1b1b55b77b3b2e8cd6013433f67d20dd45f68eab64965e104129b082402192c7eb420d0abb17d404a24f8c652e7c1e04d5eab5d5480
SSDEEP 384:wULYKWgplTc7YL2UlsVb4GxwxSCntlLS4jzVlos:rMZg1seGxwxlxzVCs
TLSH
T1E245C50A180A04D9E70AC63A80115526DB6DFF22D72425FF16A3B2265CF1BF78EF95DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-92-0x00000222037D0000-0x00000222039C2000-memory.dmp

Download

memory/1664-84-0x00000222037D0000-0x00000222039C2000-memory.dmp

Download

memory/1664-95-0x00000222037D0000-0x00000222039C2000-memory.dmp

Download

memory/1664-93-0x00000222037D0000-0x00000222039C2000-memory.dmp

Download

memory/1664-91-0x00000222037D0000-0x00000222039C2000-memory.dmp

Download

memory/1664-90-0x00000222037D0000-0x00000222039C2000-memory.dmp

Download

memory/3508-17-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-23-0x0000028B4B0D0000-0x0000028B4B0DA000-memory.dmp

Download

memory/3508-28-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-29-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-30-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-32-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-25-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-26-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-24-0x0000028B4B250000-0x0000028B4B26E000-memory.dmp

Download

memory/3508-27-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-22-0x0000028B4B010000-0x0000028B4B0C2000-memory.dmp

Download

memory/3508-8-0x00007FF804D7F000-0x00007FF804D80000-memory.dmp

Download

memory/3508-21-0x0000028B4AFF0000-0x0000028B4B00E000-memory.dmp

Download

memory/3508-16-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-15-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-14-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-13-0x0000028B4AA10000-0x0000028B4AA32000-memory.dmp

Download

memory/3508-10-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3508-9-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/5052-54-0x00000203DB580000-0x00000203DB632000-memory.dmp

Download