29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe
Size 593KB
Sample260822-wyncpsxfmh
SHA256 29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb
MD5 f5c7811863702bbbc0f8db136a4eac65
SHA1 383adff5ea52212bc4abcd63be78c23aa3a5e9d8
SHA512 0bd304f0121092881449e10d1ccb327e82d11d27f24eca45365db4a9c6796022dd5a6af9c24f2f0126149db38e61f7f7b044044fcc893efabef115bceb6717a4
SSDEEP 12288:SlQejBsScsAqMnQHfcDTq5Bp/ucWusgc2:SlQejBsqlcqWcWH
TLSH
T144D4830956614588D11BB4FE02352B5BEFA9BC024B069B9F3FB95A43DF0C1A4DBA73C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
920	powershell.exe
2820	powershell.exe

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2108-13-0x000001AD6C320000-0x000001AD6C344000-memory.dmp	ConfuserEx
behavioral2/memory/836-20-0x0000020F1B540000-0x0000020F1B564000-memory.dmp	ConfuserEx

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
920	powershell.exe
920	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	836	29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe
Token: SeDebugPrivilege	2108	29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4736	2108	29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe	90
PID 4736 wrote to memory of 920	4736	conhost.exe	91
PID 836 wrote to memory of 6440	836	29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe	94
PID 6440 wrote to memory of 2820	6440	conhost.exe	95

C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe
"C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SYSTEM32\conhost.exe
  conhost.exe --headless powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb' -Value 'C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe' -PropertyType String -Force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb' -Value 'C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe' -PropertyType String -Force"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:920

C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe
C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SYSTEM32\conhost.exe
  conhost.exe --headless powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb' -Value 'C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe' -PropertyType String -Force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb' -Value 'C:\Users\Admin\AppData\Local\Temp\29b02c48793a8ba9f4756661eff6274c0cee37e23b90f26c12b70103b04a97bb.exe' -PropertyType String -Force"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/836-20-0x0000020F1B540000-0x0000020F1B564000-memory.dmp

Download

memory/920-11-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-12-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-6-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-7-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-8-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-9-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-0-0x00007FFD8D84F000-0x00007FFD8D850000-memory.dmp

Download

memory/920-3-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/920-1-0x00000116F2A00000-0x00000116F2A22000-memory.dmp

Download

memory/920-2-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/2108-15-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/2108-14-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download

memory/2108-13-0x000001AD6C320000-0x000001AD6C344000-memory.dmp

Download

memory/2108-21-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp

Download