266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe
Size 16.0MB
Sample260831-fd62bavdnb
SHA256 266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c
MD5 ea1fa6af9ee6ea5fdf1664e6018e5b1e
SHA1 d6e4f8e20ea05b946f3a266e279da3891ab6f6e0
SHA512 f3f4e04419db01824cb65f942a1731da11d8398b495f0667f857f78e51e81eafe84b66241d4b068ee6f92ce8a60dc636c25049a8242d8c7f51eb2c4e7bae5e97
SSDEEP 3072:894IqV+NwnQdyHcWOEffvI8udIGMqe8gs4nomeXE2z1mIu:Ab/NwnQdyHcW/w8OIGkno8R
TLSH
T11EF65B1B72A521F8E1778138C8921A02F776B83517A19BFF07A047762F236D09D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1336	powershell.exe
4992	powershell.exe
1252	powershell.exe
3520	powershell.exe
1252	powershell.exe
3520	powershell.exe
1336	powershell.exe
4992	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3520	powershell.exe
3520	powershell.exe
1336	powershell.exe
1336	powershell.exe
4992	powershell.exe
4992	powershell.exe
1252	powershell.exe
1252	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3520	4876	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	91
PID 4876 wrote to memory of 1336	4876	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	95
PID 4876 wrote to memory of 4992	4876	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	97
PID 4876 wrote to memory of 1252	4876	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	99

C:\Users\Admin\AppData\Local\Temp\266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe
"C:\Users\Admin\AppData\Local\Temp\266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\fNdsZr9MwD'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e38494ae18ed624e3332b291288535144239bdd0e9c3e7efa00b057add62e80d
MD5 923d3911acc90323e3b14db479904466
SHA1 9326553aab96c09c1f0c53c26ddc9fd6f200c737
SHA512 7729c06a247c1d2e467ff99c1ccfd0d8a668b81bb2e39859db15912471cd87b7a6b0736bc001e722a3ec20c32cb4e494d71161aa3f9302e0ab4322d41fa43c67
TLSH
T1D6218627F3DC8A21CC86123A109DAC10767683C7809ECF9F6BC4D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 89326943f21bc778de8a3656e737221942f7c1d810f60e5557bfcc4fec9e42e7
MD5 9b43473aaa66d05c0c0bc5ec705b53d4
SHA1 72e935b48a43bf2ad38f32efb2f40257038cb89b
SHA512 fd187a02f44979a68834f8292a34a133bc01e3e924e07cbcadbfba46e479967d55ad42adef2dd9b9d013314f01691277c9e602b7b4d8874b1fe45f82500c5c28
TLSH
T1E7218627B3DC8A21CC96163A109D9C10767683D7819EDF9F6BC0D614A0BF988CB21690
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 36699ef5e17473e07d473a60b5abbb08bc449416923deda8c2c27dc37d1d12cc
MD5 5e1db963ed15f4632e29ab4576e04509
SHA1 5ea6ff7b93aeeb06fdf2d15021f4af4a6801b1d2
SHA512 e7091f6ebcb7dda45609ad5a4967ba4c7afac5dad6076d60c5e6f7fb4b7ea1a00b5d027cc71c58dc1aa83d2398ca00dd35adf9479a94a60b4b1c4c017b1bc532
TLSH
T19A218627F3DC8A21CC86163A109D9C10767683C7819ECFAF6BC0D614A1BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5201djel.qbj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5201djel.qbj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1336-48-0x00000278A0120000-0x00000278A01D5000-memory.dmp

Download

memory/1336-32-0x000002789FCB0000-0x000002789FCC0000-memory.dmp

Download

memory/1336-31-0x000002789FCB0000-0x000002789FCC0000-memory.dmp

Download

memory/3520-18-0x000001726C1A0000-0x000001726C1BC000-memory.dmp

Download

memory/3520-21-0x000001726C1E0000-0x000001726C1FC000-memory.dmp

Download

memory/3520-23-0x000001726C5F0000-0x000001726C60A000-memory.dmp

Download

memory/3520-24-0x000001726C1D0000-0x000001726C1D8000-memory.dmp

Download

memory/3520-25-0x000001726C5D0000-0x000001726C5D6000-memory.dmp

Download

memory/3520-26-0x000001726C5E0000-0x000001726C5EA000-memory.dmp

Download

memory/3520-27-0x000001726C200000-0x000001726C210000-memory.dmp

Download

memory/3520-22-0x000001726C1C0000-0x000001726C1CA000-memory.dmp

Download

memory/3520-20-0x0000017254040000-0x000001725404A000-memory.dmp

Download

memory/3520-19-0x000001726C510000-0x000001726C5C5000-memory.dmp

Download

memory/3520-1-0x000001726C200000-0x000001726C210000-memory.dmp

Download

memory/3520-10-0x00007FF3FE960000-0x00007FF3FE970000-memory.dmp

Download

memory/3520-2-0x0000017253FD0000-0x0000017253FF2000-memory.dmp

Download

memory/3520-0-0x000001726C200000-0x000001726C210000-memory.dmp

Download

memory/4992-65-0x000001D7FCDC0000-0x000001D7FCE75000-memory.dmp

Download