Analysis
- max time kernel
104s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 20:46
General
- Target 06e40da40a4dd8c64646d9d708b6ff01e4b3dfdc7344d1ea1233b1d58e9c12f4.exe
- Size 4.3MB
- Sample260604-zkc7cset4s
- SHA256 06e40da40a4dd8c64646d9d708b6ff01e4b3dfdc7344d1ea1233b1d58e9c12f4
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\06e40da40a4dd8c64646d9d708b6ff01e4b3dfdc7344d1ea1233b1d58e9c12f4.exe"C:\Users\Admin\AppData\Local\Temp\06e40da40a4dd8c64646d9d708b6ff01e4b3dfdc7344d1ea1233b1d58e9c12f4.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delegate\ElementType.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -Force ; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\Delegate\ElementType.exe' -Force"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Delegate\ElementType.exeC:\Users\Admin\AppData\Roaming\Delegate\ElementType.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Delegate\ElementType.exeC:\Users\Admin\AppData\Roaming\Delegate\ElementType.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ujh1qz5r.kbb.ps1
ElementType.exe
memory/792-0-0x000002EA43EE0000-0x000002EA44324000-memory.dmp
memory/792-1-0x000002EA60050000-0x000002EA603D2000-memory.dmp
memory/792-2-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-7-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-25-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-35-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-41-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-45-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-51-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-49-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-47-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-44-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-39-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-37-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-33-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-29-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-27-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-31-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-23-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-21-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-19-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-17-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-15-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-13-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-11-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-9-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-3-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-5-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-61-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-57-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-65-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-77-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-88-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-101-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-113-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-125-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-127-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-123-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-121-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-119-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-117-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-115-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-111-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-109-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-107-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-105-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-103-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-99-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-97-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-95-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-93-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-91-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-89-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-85-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-83-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-81-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-79-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-75-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-73-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-71-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-69-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-67-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-63-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-55-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-53-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-59-0x000002EA60050000-0x000002EA603CB000-memory.dmp
memory/792-6012-0x000002EA60040000-0x000002EA60050000-memory.dmp
memory/792-6013-0x000002EA44730000-0x000002EA44731000-memory.dmp
memory/792-6014-0x000002EA5FF10000-0x000002EA60018000-memory.dmp
memory/792-6015-0x000002EA603D0000-0x000002EA604D4000-memory.dmp
memory/792-6017-0x000002EA60040000-0x000002EA60050000-memory.dmp
memory/792-6016-0x000002EA60040000-0x000002EA60050000-memory.dmp
memory/792-6018-0x000002EA604D0000-0x000002EA6051C000-memory.dmp
memory/792-6019-0x000002EA60040000-0x000002EA60050000-memory.dmp
memory/792-6021-0x000002EA60040000-0x000002EA60050000-memory.dmp
memory/792-6020-0x000002EA60040000-0x000002EA60050000-memory.dmp
memory/792-6023-0x000002EA60DD0000-0x000002EA60E24000-memory.dmp
memory/792-6026-0x000002EA612D0000-0x000002EA61390000-memory.dmp
memory/792-6027-0x000002EA61390000-0x000002EA6149E000-memory.dmp
memory/1236-8848-0x00000129D2F30000-0x00000129D2F40000-memory.dmp
memory/1236-8849-0x00000129B96F0000-0x00000129B9712000-memory.dmp
memory/1236-8856-0x00000129D2F30000-0x00000129D2F40000-memory.dmp
memory/1236-8857-0x00007FF4CC8F0000-0x00007FF4CC900000-memory.dmp
memory/1236-8864-0x00000129D39F0000-0x00000129D3A0C000-memory.dmp
memory/1236-8865-0x00000129D3A10000-0x00000129D3AC3000-memory.dmp
memory/1236-8866-0x00000129D3BD0000-0x00000129D3BDA000-memory.dmp
memory/1236-8867-0x00000129D3D50000-0x00000129D3D6C000-memory.dmp
memory/1236-8868-0x00000129D3D30000-0x00000129D3D3A000-memory.dmp
memory/1236-8869-0x00000129D3D90000-0x00000129D3DAA000-memory.dmp
memory/1236-8870-0x00000129D3D40000-0x00000129D3D48000-memory.dmp
memory/1236-8871-0x00000129D3D70000-0x00000129D3D76000-memory.dmp
memory/1236-8872-0x00000129D3D80000-0x00000129D3D8A000-memory.dmp
memory/1236-8873-0x00000129D2F30000-0x00000129D2F40000-memory.dmp