Analysis
- user interaction
yes - max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 23:30
General
- Target svchost.exe
- Size 2.9MB
- Sample260415-3g744set3y
- SHA256 2c47b1327b6313f066d17020a50449cee17fbd953a601f116e6d9db796f881b6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Delays execution with timeout.exe 2 IoCs
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_RhCkzJ6q06tjDok2Zj03VEQppUXlUW.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\svchost.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\svchost.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\svchost.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\svchost.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\svchost.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe.log
SearchHoverUnifiedTileModelCache.dat
~earchHoverUnifiedTileModelCache.tmp
__PSScriptPolicyTest_pwdgr4dj.cx2.ps1
svchost.exe
cleanup_RhCkzJ6q06tjDok2Zj03VEQppUXlUW.bat
memory/2272-64-0x000001AA8A4D0000-0x000001AA8A66A000-memory.dmp
memory/2920-62-0x000001F4FCE60000-0x000001F4FCFFA000-memory.dmp
memory/2920-63-0x000001F4FE160000-0x000001F4FE16C000-memory.dmp
memory/3436-31-0x00000144A4F10000-0x00000144A4FB3000-memory.dmp
memory/3448-32-0x000001BB6A230000-0x000001BB6A23A000-memory.dmp
memory/3448-43-0x000001BB6A3E0000-0x000001BB6A3EA000-memory.dmp
memory/3448-30-0x000001BB6A250000-0x000001BB6A26C000-memory.dmp
memory/3448-28-0x000001BB6A150000-0x000001BB6A203000-memory.dmp
memory/3448-14-0x000001BB69E90000-0x000001BB69EB2000-memory.dmp
memory/3448-33-0x000001BB6A400000-0x000001BB6A41A000-memory.dmp
memory/3448-27-0x000001BB6A130000-0x000001BB6A14C000-memory.dmp
memory/3448-41-0x000001BB6A240000-0x000001BB6A248000-memory.dmp
memory/3448-42-0x000001BB6A270000-0x000001BB6A276000-memory.dmp
memory/3448-29-0x000001BB6A220000-0x000001BB6A22A000-memory.dmp
memory/3448-46-0x000001BB68060000-0x000001BB6806C000-memory.dmp
memory/3448-47-0x000001BB69D60000-0x000001BB69D72000-memory.dmp
memory/3448-48-0x000001BB6A120000-0x000001BB6A128000-memory.dmp
memory/3672-0-0x0000028753490000-0x0000028753774000-memory.dmp
memory/3672-8-0x000002876DCB0000-0x000002876DE4A000-memory.dmp
memory/3672-1-0x000002876DF30000-0x000002876DF3A000-memory.dmp
memory/4860-9-0x0000024363940000-0x00000243639E3000-memory.dmp
memory/5084-61-0x000001B9F6360000-0x000001B9F64FA000-memory.dmp