ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe
Size 6.8MB
Sample261006-x972xsty2k
SHA256 ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297
MD5 fc080ccf18f040a2aeae0fab8833de43
SHA1 c690ed216677eac60112705f9a9ffe304340c29e
SHA512 bb6979520465364a99c816e1e282be08bf0099d551821cc33e65603c0ab2be99523fe31362aa87190872b89a5a0e074a053afccea3e0e79322be0688bdc618b7
SSDEEP 98304:5dNskRIBoioVGspvl9hcLMwOmO+7LQhaQyrYS04TTj3ZpMTmy0A6sft:50kRIBoioVGqyL027sBSfX/I6
TLSH
T1576623BE2188331CC00EC5B09137BC8AB1F6561D4BD8D9AEF5EBBAC07B978519506F46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4328	powershell.exe
5980	powershell.exe
1596	powershell.exe
5628	powershell.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe
5028	cmd.exe
3896	cmd.exe
4988	cmd.exe
5200	cmd.exe
3288	cmd.exe
1084	cmd.exe
3084	cmd.exe
3880	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe
4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe
1596	powershell.exe
1596	powershell.exe
5628	powershell.exe
5628	powershell.exe
4328	powershell.exe
4328	powershell.exe
5980	powershell.exe
5980	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4572	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	91
PID 4572 wrote to memory of 1596	4572	cmd.exe	92
PID 4068 wrote to memory of 5200	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	93
PID 5200 wrote to memory of 5628	5200	cmd.exe	94
PID 4068 wrote to memory of 5028	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	95
PID 5028 wrote to memory of 4328	5028	cmd.exe	96
PID 4068 wrote to memory of 3288	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	98
PID 3288 wrote to memory of 6068	3288	cmd.exe	99
PID 6068 wrote to memory of 5816	6068	net.exe	100
PID 4068 wrote to memory of 1084	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	101
PID 1084 wrote to memory of 724	1084	cmd.exe	102
PID 4068 wrote to memory of 3896	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	103
PID 3896 wrote to memory of 5176	3896	cmd.exe	104
PID 4068 wrote to memory of 3084	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	105
PID 3084 wrote to memory of 3668	3084	cmd.exe	106
PID 4068 wrote to memory of 4988	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	107
PID 4988 wrote to memory of 5980	4988	cmd.exe	108
PID 4068 wrote to memory of 3880	4068	ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe	109
PID 3880 wrote to memory of 5988	3880	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe
"C:\Users\Admin\AppData\Local\Temp\ead33d3c82a6743720918196c236058079262a5b28e18637d73a9fe28eeaf297.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (powershell -NoProfile -Command "(Get-WindowsFeature -Name AD-Domain-Services).InstallState") 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WindowsFeature -Name AD-Domain-Services).InstallState"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (powershell -NoProfile -Command "(Get-WindowsFeature -Name ADCS-Cert-Authority).InstallState") 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WindowsFeature -Name ADCS-Cert-Authority).InstallState"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (powershell -NoProfile -Command "(Get-WmiObject Win32_ComputerSystem).Domain") 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (net user student /domain) 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\system32\net.exe
    net user student /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user student /domain
      4⤵
      PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (certutil -CATemplates) 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\certutil.exe
    certutil -CATemplates
    3⤵
    PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (certutil -CATemplates) 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\certutil.exe
    certutil -CATemplates
    3⤵
    PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (certutil -v -template ESC1-Vulnerable) 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\system32\certutil.exe
    certutil -v -template ESC1-Vulnerable
    3⤵
    PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (powershell -NoProfile -Command "Get-ExecutionPolicy -Scope LocalMachine") 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ExecutionPolicy -Scope LocalMachine"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c (certutil -view -restrict "Disposition=20" -out "RequesterName,CertificateTemplate" csv) 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\certutil.exe
    certutil -view -restrict "Disposition=20" -out "RequesterName,CertificateTemplate" csv
    3⤵
    PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f3cd87bfe780b86d5f25f64511ad3e6d0d776721465319d32f176353c735813f
MD5 05f5c49cbd5136858ec0656eca2b9599
SHA1 a5f0a141e440ae9fb44d2f6f31afbd80c51462c8
SHA512 b6782dac2a7cb49fe21879eeaeac1efcd7e128fb74936e662e90e747cdd6a7cf57325efea4a42602f48130e2d682a93707b7d4df6404fcf91277427ea1078e06
TLSH
T1A8215037B3DC8714C899413610CDEC1536B6C7D7819ECE677784D554A43F199CE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4107223f0414767576501196e5d070317bd3067bb3e4010e3f428a5c20a6e390
MD5 d0f8962ff09e3da28ed0a252ecc0d572
SHA1 29e753e79b4f465441b2a113d065d2d9abe4aaa4
SHA512 f12f41d59131e4e9a573ffdf8241d9bcd4f276ac741df32e871715ea28f01c1a606b307931164eb9a8514a3d7a867a3ea99a5adb42ae73fe6f5b975282328288
TLSH
T156215937B3DC8714DC9A417A10CEED1036B6CBDB809ECE5BBB84D548B42F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d33722103885566c7a7fe292b1a23faba29496c07e2f706373f9b043adb07e6
MD5 e2b44e239b97b4231c3ce0a41893464d
SHA1 7358ec3bdfd9ce0621be44fd5845af57b1054390
SHA512 a3e994fd43ace973ccf3312c25ea780983b9c75459b7822a2f951dd50f1a2a91d4a8915a9f54c20d163458cb4a2ebabcd354aee613a6b50a272b5065de2a7a18
TLSH
T179115733F3CC8624C89A403650CEAC1136B587DB91DEDE6BBB84D158B43F599CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_siyn5fdb.qrj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_siyn5fdb.qrj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1596-20-0x000002CDF7A70000-0x000002CDF7A7A000-memory.dmp

Download

memory/1596-23-0x000002CDF7F40000-0x000002CDF7F5C000-memory.dmp

Download

memory/1596-13-0x000002CDF7A80000-0x000002CDF7AA2000-memory.dmp

Download

memory/1596-14-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp

Download

memory/1596-15-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp

Download

memory/1596-9-0x00007FFD5178F000-0x00007FFD51790000-memory.dmp

Download

memory/1596-19-0x000002CDF7CD0000-0x000002CDF7D82000-memory.dmp

Download

memory/1596-18-0x000002CDF7CB0000-0x000002CDF7CCE000-memory.dmp

Download

memory/1596-30-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp

Download

memory/1596-21-0x000002CDF7F00000-0x000002CDF7F1E000-memory.dmp

Download

memory/1596-22-0x000002CDF7EE0000-0x000002CDF7EEA000-memory.dmp

Download

memory/1596-12-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp

Download

memory/1596-24-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp

Download

memory/1596-26-0x000002CDF7F20000-0x000002CDF7F26000-memory.dmp

Download

memory/1596-27-0x000002CDF7F30000-0x000002CDF7F3A000-memory.dmp

Download

memory/1596-25-0x000002CDF7EF0000-0x000002CDF7EF8000-memory.dmp

Download

memory/1596-29-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp

Download

memory/4068-0-0x00007FF7584FC000-0x00007FF7588FE000-memory.dmp

Download

memory/4068-8-0x00007FF7583E0000-0x00007FF758FC5000-memory.dmp

Download

memory/4068-7-0x00007FF7583E0000-0x00007FF758FC5000-memory.dmp

Download

memory/4068-1-0x00007FFD74490000-0x00007FFD74492000-memory.dmp

Download

memory/4068-48-0x00007FF7584FC000-0x00007FF7588FE000-memory.dmp

Download

memory/5980-46-0x000001C054320000-0x000001C0543D2000-memory.dmp

Download