ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47

Analysis

max time kernel
298s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UnkLowKD23027677005.exe
Size 382KB
Sample261027-jd44hada32
SHA256 ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47
MD5 32b03da03c2fec73d028114276a897da
SHA1 2473216fee29bcc660694c32f0a6378295b1e896
SHA512 5539b28f8d0679b992d744c70872d933fc11caa069b6d8388734487de43bf5464505e2c11f2281c53394c76ed1fdb4e09c4462a4e6e25d534c1ecc3a43853c00
SSDEEP 6144:IfGoU5G8+K848hEBbS81wfDM5rMOMT+pcBrk:ek5G8N847bS8v5rMOMT/rk
TLSH
T1DB847C5AF7A404F5D0AB8239C9638506E7727C9A0770DB8F23A4476B2F272E05D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2992	powershell.exe
4980	powershell.exe
3968	powershell.exe
3620	powershell.exe
2904	powershell.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1868	UnkLowKD23027677005.exe
1868	UnkLowKD23027677005.exe
1868	UnkLowKD23027677005.exe
3968	powershell.exe
3968	powershell.exe
3620	powershell.exe
3620	powershell.exe
2904	powershell.exe
2904	powershell.exe
2992	powershell.exe
2992	powershell.exe
4980	powershell.exe
4980	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3304	1868	UnkLowKD23027677005.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\UnkLowKD23027677005.exe
  "C:\Users\Admin\AppData\Local\Temp\UnkLowKD23027677005.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4
MD5 b7e1db446e63a2aae76cd85440a08856
SHA1 c900cc81335dd3ca6337e21f5bcde80f8e8a88f3
SHA512 dd63e28017eec632868489e469dd2ba54f20a3024be44550b729a0384bd55c5aa78171f7416612cd5174047afc544e21678ca164359962312b1d853c9bff04ea
TLSH
T1A2112263F3CD8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d05dfa2b9a8094d3a442b6e8cc282d9c9edecddbaac2bf48060ba5cb0b14fe5f
MD5 3d3d2738158b18c134cd69b28399df6e
SHA1 aab4393b57dfbeb346ac481c58361e5ed01ef2e3
SHA512 45e091b8684a4ab61c5799f2d116e4d2abf4239ca57ba4e70aa2274e3dd5d42e6a52db72e1a405368bc2b41306eafdb99252f8cd217877be36797c885973c615
TLSH
T165116223F38C89A0CC861639409CAC1172B686CB81AFDFDF3FC0C210E5AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
MD5 dd1d0b083fedf44b482a028fb70b96e8
SHA1 dc9c027937c9f6d52268a1504cbae42a39c8d36a
SHA512 96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973
TLSH
T11E112223F78C8920CC961539509DAC5172B586CB81AFDE9F7FC0C210E1BF584CBA21D4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 b716e0860cc27dd1035a125f44833c5999f4a0429635df6d97634f041b25effa
MD5 3737c3eb5510d74c3d6ea770e9ff4ffb
SHA1 88148610a4f00560b06bc8607794d85f15bf3b64
SHA512 db4db804933ab50bf56130a939040e33a57e4ec056c9e0c598bcae86bbaf093e2a22fd4ec8801f6b029985170f17859a931e63f28a7abb4f91780da2a33e1ebc
TLSH
T17C112227F38C8920CC961639509DAC5172B586CB91AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fl2543o2.hae.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fl2543o2.hae.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1868-0-0x0000019343B10000-0x0000019343B11000-memory.dmp

Download

memory/2904-34-0x000001D94D5F0000-0x000001D94D80C000-memory.dmp

Download

memory/3620-15-0x000001DD6EF00000-0x000001DD6EF10000-memory.dmp

Download

memory/3620-14-0x000001DD6EF00000-0x000001DD6EF10000-memory.dmp

Download

memory/3968-10-0x000002424E150000-0x000002424E172000-memory.dmp

Download

memory/3968-1-0x0000024235180000-0x0000024235190000-memory.dmp

Download

memory/3968-2-0x0000024235180000-0x0000024235190000-memory.dmp

Download