266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe
Size 16.0MB
Sample260831-fd62bavdnb
SHA256 266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c
MD5 ea1fa6af9ee6ea5fdf1664e6018e5b1e
SHA1 d6e4f8e20ea05b946f3a266e279da3891ab6f6e0
SHA512 f3f4e04419db01824cb65f942a1731da11d8398b495f0667f857f78e51e81eafe84b66241d4b068ee6f92ce8a60dc636c25049a8242d8c7f51eb2c4e7bae5e97
SSDEEP 3072:894IqV+NwnQdyHcWOEffvI8udIGMqe8gs4nomeXE2z1mIu:Ab/NwnQdyHcW/w8OIGkno8R
TLSH
T11EF65B1B72A521F8E1778138C8921A02F776B83517A19BFF07A047762F236D09D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
552	powershell.exe
1064	powershell.exe
4272	powershell.exe
5356	powershell.exe
5356	powershell.exe
552	powershell.exe
1064	powershell.exe
4272	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
552	powershell.exe
552	powershell.exe
552	powershell.exe
1064	powershell.exe
1064	powershell.exe
4272	powershell.exe
4272	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeIncreaseQuotaPrivilege	5356	powershell.exe
Token: SeSecurityPrivilege	5356	powershell.exe
Token: SeTakeOwnershipPrivilege	5356	powershell.exe
Token: SeLoadDriverPrivilege	5356	powershell.exe
Token: SeSystemProfilePrivilege	5356	powershell.exe
Token: SeSystemtimePrivilege	5356	powershell.exe
Token: SeProfSingleProcessPrivilege	5356	powershell.exe
Token: SeIncBasePriorityPrivilege	5356	powershell.exe
Token: SeCreatePagefilePrivilege	5356	powershell.exe
Token: SeBackupPrivilege	5356	powershell.exe
Token: SeRestorePrivilege	5356	powershell.exe
Token: SeShutdownPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeSystemEnvironmentPrivilege	5356	powershell.exe
Token: SeRemoteShutdownPrivilege	5356	powershell.exe
Token: SeUndockPrivilege	5356	powershell.exe
Token: SeManageVolumePrivilege	5356	powershell.exe
Token: 33	5356	powershell.exe
Token: 34	5356	powershell.exe
Token: 35	5356	powershell.exe
Token: 36	5356	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeIncreaseQuotaPrivilege	552	powershell.exe
Token: SeSecurityPrivilege	552	powershell.exe
Token: SeTakeOwnershipPrivilege	552	powershell.exe
Token: SeLoadDriverPrivilege	552	powershell.exe
Token: SeSystemProfilePrivilege	552	powershell.exe
Token: SeSystemtimePrivilege	552	powershell.exe
Token: SeProfSingleProcessPrivilege	552	powershell.exe
Token: SeIncBasePriorityPrivilege	552	powershell.exe
Token: SeCreatePagefilePrivilege	552	powershell.exe
Token: SeBackupPrivilege	552	powershell.exe
Token: SeRestorePrivilege	552	powershell.exe
Token: SeShutdownPrivilege	552	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeSystemEnvironmentPrivilege	552	powershell.exe
Token: SeRemoteShutdownPrivilege	552	powershell.exe
Token: SeUndockPrivilege	552	powershell.exe
Token: SeManageVolumePrivilege	552	powershell.exe
Token: 33	552	powershell.exe
Token: 34	552	powershell.exe
Token: 35	552	powershell.exe
Token: 36	552	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeIncreaseQuotaPrivilege	1064	powershell.exe
Token: SeSecurityPrivilege	1064	powershell.exe
Token: SeTakeOwnershipPrivilege	1064	powershell.exe
Token: SeLoadDriverPrivilege	1064	powershell.exe
Token: SeSystemProfilePrivilege	1064	powershell.exe
Token: SeSystemtimePrivilege	1064	powershell.exe
Token: SeProfSingleProcessPrivilege	1064	powershell.exe
Token: SeIncBasePriorityPrivilege	1064	powershell.exe
Token: SeCreatePagefilePrivilege	1064	powershell.exe
Token: SeBackupPrivilege	1064	powershell.exe
Token: SeRestorePrivilege	1064	powershell.exe
Token: SeShutdownPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeSystemEnvironmentPrivilege	1064	powershell.exe
Token: SeRemoteShutdownPrivilege	1064	powershell.exe
Token: SeUndockPrivilege	1064	powershell.exe
Token: SeManageVolumePrivilege	1064	powershell.exe
Token: 33	1064	powershell.exe
Token: 34	1064	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5356	4512	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	89
PID 4512 wrote to memory of 552	4512	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	92
PID 4512 wrote to memory of 1064	4512	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	95
PID 4512 wrote to memory of 4272	4512	266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe	97

C:\Users\Admin\AppData\Local\Temp\266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe
"C:\Users\Admin\AppData\Local\Temp\266f6e9f2549af2849ca867871923f1b4b6752247949e095f3b4b6777cafed4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\4tnAgw2lHe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0cf9821d2a3cc042a99d1df6cd5f22d947a6e489f4aa1e889187eae2274aed0b
MD5 fd13d11940e1cc8f4bf9bb817e6e8362
SHA1 bceb8d24cd3315f33d87445407458f47656ba065
SHA512 e9c4e8cbddc48952d229973117c5e7ce24f039bb626ad14b5a7abdc6b010219bf2d353ad16d576ef1b88d47024cb0d1fa2c4d01f61b4e1d1b23d65c7e6a45fdd
TLSH
T16B219833B3CC8614C89A003A10CDAC0036B6CBCB40DECE5B7B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9250044356fa6984548a9a533f981bc309124d9c2c91d17289bf7fc58fd77399
MD5 f012081afdf1db4c9963359e8da41813
SHA1 8b013c7c5f9956b48fc3ece96524a2d98e0a5280
SHA512 148f2ad208000ae7825d8a2d04eb0d6a09d2576187f9fad32d388bf898fd2b996cf48f64c4cdc1ffaa9c9b0b3cddb1007e2e23018d80b31412bd5dcff272bad0
TLSH
T180216833F3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_frbfcqu3.psf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frbfcqu3.psf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-37-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-34-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-39-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-38-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-26-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-36-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-35-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-40-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-33-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-32-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-30-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-41-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-45-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/552-27-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-14-0x000002764F0D0000-0x000002764F182000-memory.dmp

Download

memory/5356-13-0x000002764F0B0000-0x000002764F0CE000-memory.dmp

Download

memory/5356-25-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-22-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-21-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-20-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-19-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-18-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-17-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-16-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-15-0x000002764F190000-0x000002764F19A000-memory.dmp

Download

memory/5356-23-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-0-0x00007FFC0F00F000-0x00007FFC0F010000-memory.dmp

Download

memory/5356-10-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-9-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-8-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-7-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-6-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-5-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download

memory/5356-3-0x0000027636D20000-0x0000027636D42000-memory.dmp

Download

memory/5356-4-0x00007FFC0EE80000-0x00007FFC0F824000-memory.dmp

Download