8946434a04d8795fe954c16ff1ee8331e043c1d7ec9cb3609f0e05ddb56497eb

Analysis

user interaction
yes
max time kernel
598s
max time network
421s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PcTweaker-ui.exe
Size 708KB
Sample260430-xm8pyagz21
SHA256 8946434a04d8795fe954c16ff1ee8331e043c1d7ec9cb3609f0e05ddb56497eb
MD5 b9e5074d853ba5ee54f879a4de87c0b5
SHA1 b71e46a29e07eff04a074309e0ae51fb777f7142
SHA512 a5abf30a5d3ee7980abcf597cafe094803fb6a806aa921d173ffa1d90acd55bfaea88267d5709e3b5709ae1eb87537d52cb42b90b01a8e2c88a71121a4ea29b6
SSDEEP 12288:fPKelqSmSrNPr8N3JNuzGaIUal48GvcOI5yuUPXZZAa1X9liunnj:fPKelqSmSrNPr8N3JNuzGaIUalSvMyuG
TLSH
T1D6F49D54E9F501E9E12BA138A197B90BFB36384A07D04BD723E844192FE36D44F7B792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2080	powershell.exe
4028	powershell.exe
4968	powershell.exe
5384	powershell.exe
4480	powershell.exe
4348	powershell.exe
1716	powershell.exe
4976	powershell.exe
2960	powershell.exe
3556	powershell.exe
6008	powershell.exe
5620	powershell.exe
4800	powershell.exe
2216	powershell.exe
5028	powershell.exe
992	powershell.exe
5624	powershell.exe
3220	powershell.exe
1300	powershell.exe
5572	powershell.exe
1432	powershell.exe
1196	powershell.exe
4812	powershell.exe
4756	powershell.exe
5656	powershell.exe
1300	powershell.exe
764	powershell.exe
5272	powershell.exe
5448	powershell.exe
2684	powershell.exe
1320	powershell.exe
3268	powershell.exe
5484	powershell.exe
660	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PcTweaker-ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PcTweaker-ui.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4800	powershell.exe
4800	powershell.exe
1432	powershell.exe
1432	powershell.exe
2216	powershell.exe
2216	powershell.exe
5028	powershell.exe
5028	powershell.exe
1196	powershell.exe
1196	powershell.exe
4812	powershell.exe
4812	powershell.exe
4348	powershell.exe
4348	powershell.exe
992	powershell.exe
992	powershell.exe
5624	powershell.exe
5624	powershell.exe
1716	powershell.exe
1716	powershell.exe
3220	powershell.exe
3220	powershell.exe
4976	powershell.exe
4976	powershell.exe
2960	powershell.exe
2960	powershell.exe
1300	powershell.exe
1300	powershell.exe
4028	powershell.exe
4028	powershell.exe
4756	powershell.exe
4756	powershell.exe
3556	powershell.exe
3556	powershell.exe
6008	powershell.exe
6008	powershell.exe
2684	powershell.exe
2684	powershell.exe
764	powershell.exe
764	powershell.exe
1320	powershell.exe
1320	powershell.exe
5272	powershell.exe
5272	powershell.exe
2080	powershell.exe
2080	powershell.exe
4968	powershell.exe
4968	powershell.exe
3268	powershell.exe
3268	powershell.exe
5656	powershell.exe
5656	powershell.exe
1300	powershell.exe
1300	powershell.exe
5384	powershell.exe
5384	powershell.exe
5572	powershell.exe
5572	powershell.exe
4480	powershell.exe
4480	powershell.exe
5484	powershell.exe
5484	powershell.exe
660	powershell.exe
660	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5108	PcTweaker-ui.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeManageVolumePrivilege	5912	svchost.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	5572	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	5484	powershell.exe
Token: SeDebugPrivilege	660	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5112	5108	PcTweaker-ui.exe	79
PID 5112 wrote to memory of 4800	5112	cmd.exe	81
PID 5108 wrote to memory of 2452	5108	PcTweaker-ui.exe	85
PID 2452 wrote to memory of 1432	2452	cmd.exe	87
PID 5108 wrote to memory of 1644	5108	PcTweaker-ui.exe	90
PID 1644 wrote to memory of 2216	1644	cmd.exe	92
PID 5108 wrote to memory of 5124	5108	PcTweaker-ui.exe	93
PID 5124 wrote to memory of 5028	5124	cmd.exe	95
PID 5108 wrote to memory of 4528	5108	PcTweaker-ui.exe	96
PID 4528 wrote to memory of 1196	4528	cmd.exe	98
PID 5108 wrote to memory of 2188	5108	PcTweaker-ui.exe	99
PID 2188 wrote to memory of 4812	2188	cmd.exe	101
PID 5108 wrote to memory of 2340	5108	PcTweaker-ui.exe	104
PID 2340 wrote to memory of 4348	2340	cmd.exe	106
PID 5108 wrote to memory of 5480	5108	PcTweaker-ui.exe	109
PID 5480 wrote to memory of 992	5480	cmd.exe	111
PID 5108 wrote to memory of 996	5108	PcTweaker-ui.exe	112
PID 996 wrote to memory of 5624	996	cmd.exe	114
PID 5108 wrote to memory of 5076	5108	PcTweaker-ui.exe	115
PID 5076 wrote to memory of 1716	5076	cmd.exe	117
PID 5108 wrote to memory of 4696	5108	PcTweaker-ui.exe	120
PID 4696 wrote to memory of 3220	4696	cmd.exe	122
PID 5108 wrote to memory of 4940	5108	PcTweaker-ui.exe	123
PID 4940 wrote to memory of 4976	4940	cmd.exe	125
PID 5108 wrote to memory of 2164	5108	PcTweaker-ui.exe	126
PID 2164 wrote to memory of 2960	2164	cmd.exe	128
PID 5108 wrote to memory of 5844	5108	PcTweaker-ui.exe	132
PID 5844 wrote to memory of 1300	5844	cmd.exe	134
PID 5108 wrote to memory of 3480	5108	PcTweaker-ui.exe	135
PID 3480 wrote to memory of 4028	3480	cmd.exe	137
PID 5108 wrote to memory of 5496	5108	PcTweaker-ui.exe	138
PID 5496 wrote to memory of 4756	5496	cmd.exe	140
PID 5108 wrote to memory of 112	5108	PcTweaker-ui.exe	143
PID 112 wrote to memory of 3556	112	cmd.exe	145
PID 5108 wrote to memory of 392	5108	PcTweaker-ui.exe	147
PID 392 wrote to memory of 6008	392	cmd.exe	149
PID 5108 wrote to memory of 2056	5108	PcTweaker-ui.exe	151
PID 2056 wrote to memory of 2684	2056	cmd.exe	153
PID 5108 wrote to memory of 1356	5108	PcTweaker-ui.exe	154
PID 1356 wrote to memory of 764	1356	cmd.exe	156
PID 5108 wrote to memory of 2840	5108	PcTweaker-ui.exe	157
PID 2840 wrote to memory of 1320	2840	cmd.exe	159
PID 5108 wrote to memory of 5536	5108	PcTweaker-ui.exe	162
PID 5536 wrote to memory of 5272	5536	cmd.exe	164
PID 5108 wrote to memory of 4636	5108	PcTweaker-ui.exe	167
PID 4636 wrote to memory of 2080	4636	cmd.exe	169
PID 5108 wrote to memory of 3220	5108	PcTweaker-ui.exe	171
PID 3220 wrote to memory of 4968	3220	cmd.exe	173
PID 5108 wrote to memory of 5960	5108	PcTweaker-ui.exe	174
PID 5960 wrote to memory of 3268	5960	cmd.exe	176
PID 5108 wrote to memory of 2124	5108	PcTweaker-ui.exe	179
PID 2124 wrote to memory of 5656	2124	cmd.exe	181
PID 5108 wrote to memory of 4596	5108	PcTweaker-ui.exe	182
PID 4596 wrote to memory of 1300	4596	cmd.exe	184
PID 5108 wrote to memory of 3080	5108	PcTweaker-ui.exe	185
PID 3080 wrote to memory of 5384	3080	cmd.exe	187
PID 5108 wrote to memory of 2944	5108	PcTweaker-ui.exe	188
PID 2944 wrote to memory of 5572	2944	cmd.exe	190
PID 5108 wrote to memory of 3564	5108	PcTweaker-ui.exe	191
PID 3564 wrote to memory of 4480	3564	cmd.exe	193
PID 5108 wrote to memory of 248	5108	PcTweaker-ui.exe	194
PID 248 wrote to memory of 5484	248	cmd.exe	196
PID 5108 wrote to memory of 1200	5108	PcTweaker-ui.exe	197
PID 1200 wrote to memory of 660	1200	cmd.exe	199

C:\Users\Admin\AppData\Local\Temp\PcTweaker-ui.exe
"C:\Users\Admin\AppData\Local\Temp\PcTweaker-ui.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.Messaging* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Messaging* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.Microsoft3DViewer* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Microsoft3DViewer* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.MixedReality.Portal* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.MixedReality.Portal* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.OneConnect* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.OneConnect* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.People* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.People* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.Print3D* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Print3D* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.SkypeApp* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.SkypeApp* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsAlarms* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsAlarms* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsCamera* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsCamera* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsMaps* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsMaps* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Powershell.exe -command "& {Get-AppxPackage *Microsoft.3dBuilder* | Remove-AppxPackage}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.3dBuilder* | Remove-AppxPackage}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *bing* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *bing* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *bingfinance* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *bingfinance* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *bingsports* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *bingsports* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *CommsPhone* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *CommsPhone* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *Drawboard PDF* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *Drawboard PDF* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *Sway* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *Sway* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *WindowsAlarms* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *WindowsAlarms* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *WindowsPhone* | Remove-AppxPackage"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *WindowsPhone* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage -allusers *zune* | Remove-AppxPackage"
  2⤵
  PID:840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *zune* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell -Command "Get-AppxPackage Microsoft.MicrosoftEdge_41.16299.1004.0_netural__8wekyb3d8bbwe | Remove-AppxPackage"
  2⤵
  PID:5524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage Microsoft.MicrosoftEdge_41.16299.1004.0_netural__8wekyb3d8bbwe | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 > nul
  2⤵
  PID:3960
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingWeather_8wekyb3d8bbwe
1⤵
PID:1452

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.GetHelp_8wekyb3d8bbwe
1⤵
PID:1068

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe
1⤵
PID:1936

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe
1⤵
PID:5916

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.People_8wekyb3d8bbwe
1⤵
PID:2668

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsAlarms_8wekyb3d8bbwe
1⤵
PID:1620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsMaps_8wekyb3d8bbwe
1⤵
PID:5268

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
1⤵
PID:3076

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe
1⤵
PID:740

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.HEIFImageExtension_8wekyb3d8bbwe
1⤵
PID:1736

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WebMediaExtensions_8wekyb3d8bbwe
1⤵
PID:3664

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WebpImageExtension_8wekyb3d8bbwe
1⤵
PID:4496

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingNews_8wekyb3d8bbwe
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0a2191683274be7634f7bf47238f1de5a8cef49794e986f55130dce248bcbf6f
MD5 bad34bbcf291534e94164e82123efa91
SHA1 a4b8fae30178b3dadb547b960caab9bce04f5b45
SHA512 0ba13f01f7380b177b682689bd1d6d4315c90e7f738a8b57469b63c7b42d133c1e3fd4ce0aaf757f595ec8df1e387c664618600282ffc261108145e79c8817bb
TLSH
T10371BF313271B0D489562F07192C5AC453FF835ABA949F5CB698624EDD2704BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 4672b83e99a529fa94a87cd0b606c76bb88df0d87edfb05954a66303e0e49014
MD5 656aad331aac1c1e5fb11d0596b0ebf5
SHA1 b1e7bfb0df49c0bb4fbbe70a583fb9188f3d1d8e
SHA512 9e13eba713c7bed9afdf82eef65e376d1b96c472f19364772641e29ad5624d51c38d04e83662058913963cc3a2bbc25a5599a9401c2951a6edbaa750c62c1823
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMFYoeOV3CNBQkj2zMrxf:KflJd+qiUTYkzvHgfKQaUpeE711kDa5E
TLSH
T1C5538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download