028cc0e3700079cd286acf5febe4ae9aa0dab011c709b31aef23f47f057997ac

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shadow.exe
Size 1.4MB
Sample260930-per38at1dw
SHA256 028cc0e3700079cd286acf5febe4ae9aa0dab011c709b31aef23f47f057997ac
MD5 d08e685c626becfdf7ba2e272ba763c9
SHA1 6e337d8e9fb0b4eedf21e0b23a9b2b41e1e1ad1f
SHA512 41dc50e5582256640c173b6683d6c6b04ecadfd4eafc451a37b06d3c66c39b41e10aea5b3950a7a0063cf9243ba388a15db34818475986ba09b99411367087eb
SSDEEP 24576:Qu5eEZZ5dPMjMxxynNpINOtjZZewwSKsiunMxNj79nl+9uS3cXrCK:dYEZZ5dUjeiNSsjqwwRun+ZtEt3v
TLSH
T1E165D056F2B501F4C56FC17CCAD3950BFA723888032096EB17E496691FA36E06B7F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5276	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 1 IoCs

pid	Process
5880	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Shadow.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Shadow.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5276	powershell.exe
5276	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4764	Shadow.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeIncreaseQuotaPrivilege	5276	powershell.exe
Token: SeSecurityPrivilege	5276	powershell.exe
Token: SeTakeOwnershipPrivilege	5276	powershell.exe
Token: SeLoadDriverPrivilege	5276	powershell.exe
Token: SeSystemProfilePrivilege	5276	powershell.exe
Token: SeSystemtimePrivilege	5276	powershell.exe
Token: SeProfSingleProcessPrivilege	5276	powershell.exe
Token: SeIncBasePriorityPrivilege	5276	powershell.exe
Token: SeCreatePagefilePrivilege	5276	powershell.exe
Token: SeBackupPrivilege	5276	powershell.exe
Token: SeRestorePrivilege	5276	powershell.exe
Token: SeShutdownPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeSystemEnvironmentPrivilege	5276	powershell.exe
Token: SeRemoteShutdownPrivilege	5276	powershell.exe
Token: SeUndockPrivilege	5276	powershell.exe
Token: SeManageVolumePrivilege	5276	powershell.exe
Token: 33	5276	powershell.exe
Token: 34	5276	powershell.exe
Token: 35	5276	powershell.exe
Token: 36	5276	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	Shadow.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 5880	4764	Shadow.exe	89
PID 5880 wrote to memory of 5276	5880	RuntimeBroker.exe	90

C:\Users\Admin\AppData\Local\Temp\Shadow.exe
"C:\Users\Admin\AppData\Local\Temp\Shadow.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
Size 201KB
SHA256 1ff77f44aeb2c780fc1a9a802c30f47b1e1dcfb1095330df1047f15ad1b2b2b2
MD5 88aec7c70284502a8c048a0bc385cc8a
SHA1 79fb4c8f677c29a73dcd6430be927ea8a4e2c560
SHA512 4aaaa6f807ed4f19968fda4af1f7fbfc03ac30ba103915f90c8fbe42ef70c38ce3dad5b6c2e4c2b0d4b2b9bdc8bcbd40dbcc0914b43c4cf94eddc3a3167a917f
SSDEEP 3072:ipzE0LTZKtrUQo/n50V1n+K1U3WskhAciwEyK7v:gzEJtrUbn5S1Z5swA3wEyK7
TLSH
T158146B29BA4501B5D5D7C0B8CE83C907FBB238894761D7DF13E15BB90E63AE4AA3E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5276-4-0x00007FF902EFF000-0x00007FF902F00000-memory.dmp

Download

memory/5276-5-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-8-0x0000021975090000-0x00000219750B2000-memory.dmp

Download

memory/5276-9-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-12-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-16-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-20-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-26-0x0000021975160000-0x000002197517E000-memory.dmp

Download

memory/5276-27-0x0000021975430000-0x00000219754E2000-memory.dmp

Download

memory/5276-28-0x0000021975150000-0x000002197515A000-memory.dmp

Download

memory/5276-29-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-30-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-31-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-32-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-33-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-34-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-35-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/5276-37-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download