9c8b32d0222ad5e686a00a393bde88476ec005ef06ce4315a18f8738287e49ae

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 11.6MB
Sample260830-l868fssclb
SHA256 9c8b32d0222ad5e686a00a393bde88476ec005ef06ce4315a18f8738287e49ae
MD5 68cd9bd4fc5d28a1f10af6b9a4e8544a
SHA1 d63b0fc549b0070267884169c9591cbc7e349775
SHA512 2b8d0b17e5bec22a075554a3b3ea931ab716a00e5f9f83284532f94739180b45c8186bb8b49bbb7efdd3b5fd5a3e94a8de10d7b735d14530af3ef22f861e6748
SSDEEP 196608:IuydQ9uLiFuc8FeC+HhrfOQRin96tCYreMahY/vEsCkenWI2WR2DVayWvlNxFEm:1ydQbNCyhjm6tC+HE2e7O2lNxFE
TLSH
T1B6C63347B1D69E1ACEF53BB348E6D23407BD2C8BA963D59767DCB9973C0235D6880202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe
1140	powershell.exe
3348	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4752	jz.exe
2040	jz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\jz = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$j1dtwx=[System.Environment]::TickCount;$lj5f5k=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$mbx43t=7854;$co5uyw=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGp6LmV4ZQ==')));$23jnaw=$env:COMPUTERNAME;& $lj5f5k -FilePath $co5uyw\""	file.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4184-5-0x000001FA40450000-0x000001FA40464000-memory.dmp	SmartAssembly
behavioral2/memory/4752-42-0x0000015BC6A50000-0x0000015BC6A64000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4184 set thread context of 4084	4184	file.exe	94
PID 4752 set thread context of 2040	4752	jz.exe	99

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4084-35-0x0000000140000000-0x00000001440A7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4184	file.exe
2348	powershell.exe
3348	powershell.exe
3348	powershell.exe
3348	powershell.exe
2348	powershell.exe
2348	powershell.exe
4184	file.exe
4184	file.exe
4752	jz.exe
1140	powershell.exe
1140	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	file.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe
Token: SeIncBasePriorityPrivilege	2348	powershell.exe
Token: SeCreatePagefilePrivilege	2348	powershell.exe
Token: SeBackupPrivilege	2348	powershell.exe
Token: SeRestorePrivilege	2348	powershell.exe
Token: SeShutdownPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeSystemEnvironmentPrivilege	2348	powershell.exe
Token: SeRemoteShutdownPrivilege	2348	powershell.exe
Token: SeUndockPrivilege	2348	powershell.exe
Token: SeManageVolumePrivilege	2348	powershell.exe
Token: 33	2348	powershell.exe
Token: 34	2348	powershell.exe
Token: 35	2348	powershell.exe
Token: 36	2348	powershell.exe
Token: SeDebugPrivilege	4752	jz.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeIncreaseQuotaPrivilege	1140	powershell.exe
Token: SeSecurityPrivilege	1140	powershell.exe
Token: SeTakeOwnershipPrivilege	1140	powershell.exe
Token: SeLoadDriverPrivilege	1140	powershell.exe
Token: SeSystemProfilePrivilege	1140	powershell.exe
Token: SeSystemtimePrivilege	1140	powershell.exe
Token: SeProfSingleProcessPrivilege	1140	powershell.exe
Token: SeIncBasePriorityPrivilege	1140	powershell.exe
Token: SeCreatePagefilePrivilege	1140	powershell.exe
Token: SeBackupPrivilege	1140	powershell.exe
Token: SeRestorePrivilege	1140	powershell.exe
Token: SeShutdownPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeSystemEnvironmentPrivilege	1140	powershell.exe
Token: SeRemoteShutdownPrivilege	1140	powershell.exe
Token: SeUndockPrivilege	1140	powershell.exe
Token: SeManageVolumePrivilege	1140	powershell.exe
Token: 33	1140	powershell.exe
Token: 34	1140	powershell.exe
Token: 35	1140	powershell.exe
Token: 36	1140	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 2348	4184	file.exe	89
PID 4184 wrote to memory of 4084	4184	file.exe	94
PID 4184 wrote to memory of 4084	4184	file.exe	94
PID 4184 wrote to memory of 4084	4184	file.exe	94
PID 4184 wrote to memory of 4084	4184	file.exe	94
PID 3348 wrote to memory of 4752	3348	powershell.exe	95
PID 4752 wrote to memory of 1140	4752	jz.exe	97
PID 4752 wrote to memory of 2040	4752	jz.exe	99
PID 4752 wrote to memory of 2040	4752	jz.exe	99
PID 4752 wrote to memory of 2040	4752	jz.exe	99
PID 4752 wrote to memory of 2040	4752	jz.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\file.exe
  C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  PID:4084

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$j1dtwx=[System.Environment]::TickCount;$lj5f5k=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$mbx43t=7854;$co5uyw=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGp6LmV4ZQ==')));$23jnaw=$env:COMPUTERNAME;& $lj5f5k -FilePath $co5uyw"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Roaming\jz.exe
  "C:\Users\Admin\AppData\Roaming\jz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jz.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Users\Admin\AppData\Roaming\jz.exe
    C:\Users\Admin\AppData\Roaming\jz.exe
    3⤵
    - Executes dropped EXE
    PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0feef18a904b499358e28214dbc7e2acd65bf66e6c724554aa86e8e9febb3a59
MD5 ab866cad490a2fca87e0a6d03a7ab4f2
SHA1 f362b88d5a09b68a585e2d6e0e500e3d93554097
SHA512 711e3cd65c96c8a66ac234f621ab1f7f0d1562636612e4fc2395b2cf2d405e43a96bd94d610bfdc0a1b439fbb30e295d6371f0721c0454906628f332b40af498
TLSH
T1BA216833F3DD8614C89A413A10DDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qq3h4ghg.mnr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qq3h4ghg.mnr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jz.exe

Path C:\Users\Admin\AppData\Roaming\jz.exe
Size 11.6MB
SHA256 9c8b32d0222ad5e686a00a393bde88476ec005ef06ce4315a18f8738287e49ae
MD5 68cd9bd4fc5d28a1f10af6b9a4e8544a
SHA1 d63b0fc549b0070267884169c9591cbc7e349775
SHA512 2b8d0b17e5bec22a075554a3b3ea931ab716a00e5f9f83284532f94739180b45c8186bb8b49bbb7efdd3b5fd5a3e94a8de10d7b735d14530af3ef22f861e6748
SSDEEP 196608:IuydQ9uLiFuc8FeC+HhrfOQRin96tCYreMahY/vEsCkenWI2WR2DVayWvlNxFEm:1ydQbNCyhjm6tC+HE2e7O2lNxFE
TLSH
T1B6C63347B1D69E1ACEF53BB348E6D23407BD2C8BA963D59767DCB9973C0235D6880202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-48-0x000001A076B20000-0x000001A076BD2000-memory.dmp

Download

memory/2348-32-0x000001E97CD00000-0x000001E97CD1E000-memory.dmp

Download

memory/2348-23-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-41-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-34-0x000001E97CAE0000-0x000001E97CAEA000-memory.dmp

Download

memory/2348-33-0x000001E97CD20000-0x000001E97CDD2000-memory.dmp

Download

memory/2348-28-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-27-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-11-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-12-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-15-0x000001E97CA20000-0x000001E97CA42000-memory.dmp

Download

memory/2348-16-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-17-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-18-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-19-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-20-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-21-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-22-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/2348-26-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4084-35-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/4184-29-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-36-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-5-0x000001FA40450000-0x000001FA40464000-memory.dmp

Download

memory/4184-8-0x00007FFE519BF000-0x00007FFE519C0000-memory.dmp

Download

memory/4184-0-0x00007FFE519BF000-0x00007FFE519C0000-memory.dmp

Download

memory/4184-7-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-4-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-9-0x000001FA5F370000-0x000001FA5FEC4000-memory.dmp

Download

memory/4184-10-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-3-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-2-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-6-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp

Download

memory/4184-1-0x000001FA3F320000-0x000001FA3FEC0000-memory.dmp

Download

memory/4752-42-0x0000015BC6A50000-0x0000015BC6A64000-memory.dmp

Download