Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
internal loader.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
internal loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
internal loader.exe
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
internal loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target internal loader.exe
- Size 286KB
- Sample260925-ppalxsssat
- SHA256 22dbc8f7ccbef08998b6db7e191656d897042dee58ead6ff01f72daed4886f2b
- MD5 a666fd752d55084b7858bd158d7a4923
- SHA1 a2e1f431f722b44115a795abc516ea60c599a8ff
- SHA512 9bf5e35d522f4dd3b4428bf541a1106ddccd9edbabb31ed3a409ac1e2d980f137f05109257b8a446f91a432d741c02001d13a81128398e2b58306692011c7980
- SSDEEP 6144:BM/EtifHIKe9n10F1izEJtrUbn5S1Z5swA3udyK7JR:i/EtifHIKe910F1rvZ5swwkyKl
- TLSH T1D3546C2AB6950179D297C0BCCD838807FB7338464B91E7DF27955AF52F635E05A3E202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4232 powershell.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 4512 internal loader.exe 4512 internal loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4232 powershell.exe 4232 powershell.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe 4512 internal loader.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4232 powershell.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4232 4512 internal loader.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\internal loader.exe"C:\Users\Admin\AppData\Local\Temp\internal loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_poiqv14l.n25.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH