c051af563dbbcf504cb783fda30143faca1796b412b7fc248f9a8e39c07f4dd4

Analysis

user interaction
yes
max time kernel
112s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/09/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Full_App_Setup_v9.8.4.exe
Size 42.2MB
Sample260908-s8za6stset
SHA256 c051af563dbbcf504cb783fda30143faca1796b412b7fc248f9a8e39c07f4dd4
MD5 5a7ead90545a120a0c47c0495115b05d
SHA1 5448acc19b951a24b252c89e27f87f62ca2572ea
SHA512 0472ea21a7b406eb2548ab1ccec34972abfe29b31444c1da92ae27c756a2a801d5b1e7102530189506e6d2946865868ef37ec8a8ec515ee2b0f63b7dc2a3a112
SSDEEP 3072:/BBNk8oVP6kLBQ7cfOu2CAiruotCHCvWUMivLFBUBG0W+IqJIJa61H/xOgNw:K6khfhruotxWUMc0GXIJMa61/Ma
TLSH
T187A78D1B735344FECA17807486AF9372E531F81213709A6F2B65DF326E61D604F9EA28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3024	powershell.exe
3676	powershell.exe
4124	powershell.exe
1716	powershell.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Full_App_Setup_v9.8.4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Full_App_Setup_v9.8.4.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3024	powershell.exe
3024	powershell.exe
3676	powershell.exe
3676	powershell.exe
4124	powershell.exe
4124	powershell.exe
1716	powershell.exe
1716	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3024	1852	Full_App_Setup_v9.8.4.exe	80
PID 1852 wrote to memory of 3676	1852	Full_App_Setup_v9.8.4.exe	82
PID 1852 wrote to memory of 4124	1852	Full_App_Setup_v9.8.4.exe	84
PID 1852 wrote to memory of 1716	1852	Full_App_Setup_v9.8.4.exe	86

C:\Users\Admin\AppData\Local\Temp\Full_App_Setup_v9.8.4.exe
"C:\Users\Admin\AppData\Local\Temp\Full_App_Setup_v9.8.4.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Helper.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Stablewin.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'Windows Helper.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'Stablewin.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5a01c3c86e94f5413b36c4d6d471febd3008abe69c4602ab5c857a5a1f90d6a5
MD5 4d412d84cb235425f061ca4e0c5e87ce
SHA1 d783e23804f6289c65e8758f9f72dcd6643b64ef
SHA512 9a5b1f86a1a9e9634f08137f2b2b6f7d76279034d120b3d0a570b255d2cb5a9ffacf4081e85518d8a320330ebd6b6875b304e1b26ccd1625bf129340178f96c8
TLSH
T16221AB33B79CC134C8D9117A108DAD01B2B5C3C7449ECE8B7BC4C518A5BF899DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b18e115cf62a61ce8a83a0ac1721e30cb2f8508eecc39816c3d41db55e74c48b
MD5 01caa2df541c3bce8aa0f78657eb77f4
SHA1 866b0643aa2d77e63ee2c3e2604099d9baa35cb2
SHA512 dbd40348579d435b57f812a1f30755392460507d97724ced37993081f2e955c491f580a44d1c685178bead32dd8eda486f31439efb0f76c7a187c6bba3620ef3
TLSH
T1F2218933B79CC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DF645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bh4lxt2a.wi5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bh4lxt2a.wi5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1852-89-0x00007FF6579B0000-0x00007FF6579F4000-memory.dmp

Download

memory/1852-74-0x00007FF6579B0000-0x00007FF6579F4000-memory.dmp

Download

memory/3024-23-0x00000259D2120000-0x00000259D2128000-memory.dmp

Download

memory/3024-18-0x00000259D23A0000-0x00000259D2453000-memory.dmp

Download

memory/3024-20-0x00000259D2130000-0x00000259D214C000-memory.dmp

Download

memory/3024-21-0x00000259D2110000-0x00000259D211A000-memory.dmp

Download

memory/3024-22-0x00000259D2170000-0x00000259D218A000-memory.dmp

Download

memory/3024-0-0x00000259CF3F0000-0x00000259CF400000-memory.dmp

Download

memory/3024-24-0x00000259D2150000-0x00000259D2156000-memory.dmp

Download

memory/3024-25-0x00000259D2160000-0x00000259D216A000-memory.dmp

Download

memory/3024-26-0x00000259CF3F0000-0x00000259CF400000-memory.dmp

Download

memory/3024-19-0x00000259CF3E0000-0x00000259CF3EA000-memory.dmp

Download

memory/3024-1-0x00000259CF3F0000-0x00000259CF400000-memory.dmp

Download

memory/3024-2-0x00000259CF360000-0x00000259CF382000-memory.dmp

Download

memory/3024-17-0x00000259D20F0000-0x00000259D210C000-memory.dmp

Download

memory/3024-16-0x00007FF412640000-0x00007FF412650000-memory.dmp

Download

memory/3024-9-0x00000259CF3F0000-0x00000259CF400000-memory.dmp

Download

memory/3676-30-0x000001ECA59A0000-0x000001ECA59B0000-memory.dmp

Download

memory/3676-31-0x000001ECA59A0000-0x000001ECA59B0000-memory.dmp

Download