Analysis
- max time kernel
150s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 18:41
General
- Target BensCloud.exe
- Size 6.5MB
- Sample260604-xb3dsacy9k
- SHA256 cdcd3e64e4ff234c00060df2a391126c228ec5b86bdb224c4feaf5851fdbe7bc
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
- Drops startup file 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BensCloud.exe"C:\Users\Admin\AppData\Local\Temp\BensCloud.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\BensCloud.exe" /sc onlogon /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\BensCloud.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; Register-ScheduledTask -TaskName 'SystemOptimizer' -Action $Action -Trigger $Trigger -RunLevel Highest -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BensCloud.exeC:\Users\Admin\AppData\Local\Temp\BensCloud.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\BensCloud.exe" /sc onlogon /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\BensCloud.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; Register-ScheduledTask -TaskName 'SystemOptimizer' -Action $Action -Trigger $Trigger -RunLevel Highest -Force"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_kdpekrbb.zye.ps1
tay.mp3
WindowsUpdate.exe
memory/3424-38-0x00007FF729420000-0x00007FF729A43000-memory.dmp
memory/3424-71-0x00007FF729420000-0x00007FF729A43000-memory.dmp
memory/3424-46-0x000001BB72810000-0x000001BB72820000-memory.dmp
memory/3424-49-0x000001BB72810000-0x000001BB72820000-memory.dmp
memory/3424-48-0x000001BB72810000-0x000001BB72820000-memory.dmp
memory/3424-47-0x000001BB72810000-0x000001BB72820000-memory.dmp
memory/3424-45-0x000001BB72810000-0x000001BB72820000-memory.dmp
memory/3784-31-0x0000018FF2300000-0x0000018FF230A000-memory.dmp
memory/3784-29-0x0000018FF22E0000-0x0000018FF22FC000-memory.dmp
memory/3784-32-0x0000018FF2850000-0x0000018FF286C000-memory.dmp
memory/3784-35-0x0000018FF1330000-0x0000018FF1DF2000-memory.dmp
memory/3784-30-0x0000018FF2540000-0x0000018FF25F3000-memory.dmp
memory/3784-16-0x0000018FF2210000-0x0000018FF2232000-memory.dmp
memory/3872-68-0x00000222AA340000-0x00000222AA3F3000-memory.dmp
memory/4384-14-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-37-0x0000023BA0AC0000-0x0000023BA0AD0000-memory.dmp
memory/4384-36-0x00007FF729420000-0x00007FF729A43000-memory.dmp
memory/4384-11-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-8-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-10-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-9-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-7-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-5-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp
memory/4384-6-0x0000023BA0AC0000-0x0000023BA0AD0000-memory.dmp
memory/4384-0-0x00007FF729420000-0x00007FF729A43000-memory.dmp
memory/4384-4-0x0000023BA0AB0000-0x0000023BA0AC0000-memory.dmp