Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 17:14
General
- Target 43d07375e536c94f430ca1088755b1807d1774936892220b62decfd5ca656c0c.exe
- Size 3.3MB
- Sample260425-vsdewaew9t
- SHA256 43d07375e536c94f430ca1088755b1807d1774936892220b62decfd5ca656c0c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43d07375e536c94f430ca1088755b1807d1774936892220b62decfd5ca656c0c.exe"C:\Users\Admin\AppData\Local\Temp\43d07375e536c94f430ca1088755b1807d1774936892220b62decfd5ca656c0c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Byp2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -No2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass erence -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfil2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_oki3ep43.0xt.ps1
memory/776-92-0x0000023011510000-0x000002301156D000-memory.dmp
memory/776-93-0x0000023011620000-0x000002301162C000-memory.dmp
memory/776-94-0x0000023029BB0000-0x0000023029BC2000-memory.dmp
memory/788-97-0x0000013429720000-0x000001342977D000-memory.dmp
memory/788-167-0x0000013429720000-0x000001342977D000-memory.dmp
memory/788-166-0x00007FF74E470000-0x00007FF74E77B000-memory.dmp
memory/788-0-0x00007FF74E470000-0x00007FF74E77B000-memory.dmp
memory/788-95-0x00007FF74E470000-0x00007FF74E77B000-memory.dmp
memory/1548-83-0x000001886B8E0000-0x000001886B8EC000-memory.dmp
memory/1548-82-0x000001886B820000-0x000001886B87D000-memory.dmp
memory/1548-84-0x000001886BD40000-0x000001886BD52000-memory.dmp
memory/1596-89-0x00000203AF580000-0x00000203AF5DD000-memory.dmp
memory/1596-91-0x00000203B1310000-0x00000203B1322000-memory.dmp
memory/1596-90-0x00000203B1260000-0x00000203B126C000-memory.dmp
memory/1732-36-0x0000027E535F0000-0x0000027E535FA000-memory.dmp
memory/1732-71-0x0000027E53610000-0x0000027E53618000-memory.dmp
memory/1732-29-0x0000027E53530000-0x0000027E535E3000-memory.dmp
memory/1732-76-0x0000027E39480000-0x0000027E394DD000-memory.dmp
memory/1732-78-0x0000027E3B230000-0x0000027E3B242000-memory.dmp
memory/1732-77-0x0000027E3AD00000-0x0000027E3AD0C000-memory.dmp
memory/1732-73-0x0000027E53650000-0x0000027E5365A000-memory.dmp
memory/1732-72-0x0000027E53640000-0x0000027E53646000-memory.dmp
memory/1732-28-0x0000027E53510000-0x0000027E5352C000-memory.dmp
memory/1732-9-0x0000027E3ACE0000-0x0000027E3ACF0000-memory.dmp
memory/1732-8-0x0000027E53470000-0x0000027E53492000-memory.dmp
memory/1732-44-0x0000027E53620000-0x0000027E5363C000-memory.dmp
memory/1732-70-0x0000027E53660000-0x0000027E5367A000-memory.dmp
memory/1732-69-0x0000027E53600000-0x0000027E5360A000-memory.dmp
memory/1732-1-0x0000027E3ACE0000-0x0000027E3ACF0000-memory.dmp
memory/3352-98-0x000001C36EA50000-0x000001C36EAAD000-memory.dmp
memory/3352-99-0x000001C36CF40000-0x000001C36CF4C000-memory.dmp
memory/3352-100-0x000001C36EAD0000-0x000001C36EAE2000-memory.dmp
memory/3352-37-0x000001C36F310000-0x000001C36F356000-memory.dmp
memory/4040-102-0x0000021795C10000-0x0000021795C1C000-memory.dmp
memory/4040-103-0x00000217AE1F0000-0x00000217AE202000-memory.dmp
memory/4040-101-0x0000021795F80000-0x0000021795FDD000-memory.dmp