Analysis
- max time kernel
27s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 21:45
Errors
General
- Target file.exe
- Size 3.3MB
- Sample260620-1menmshy6n
- SHA256 5122b2cc1fc99c60330b863c94e09e82553eff28cbfba8496f30bea88465b77d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "EBNMKRSL"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "EBNMKRSL" binpath= "C:\ProgramData\kthwavpmjgaj\qsvieogojvpf.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "EBNMKRSL"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
-
C:\ProgramData\kthwavpmjgaj\qsvieogojvpf.exeC:\ProgramData\kthwavpmjgaj\qsvieogojvpf.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
qsvieogojvpf.exe
__PSScriptPolicyTest_a5idbuhc.dzc.ps1
memory/3640-28-0x0000000140000000-0x000000014002B000-memory.dmp
memory/3640-29-0x0000000140000000-0x000000014002B000-memory.dmp
memory/3640-30-0x0000000140000000-0x000000014002B000-memory.dmp
memory/3640-31-0x0000000140000000-0x000000014002B000-memory.dmp
memory/4116-10-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-27-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-0-0x000002129969C000-0x000002129969D000-memory.dmp
memory/4116-11-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-12-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-13-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-14-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-15-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-19-0x00000212B1E90000-0x00000212B1F42000-memory.dmp
memory/4116-18-0x00000212B1E70000-0x00000212B1E8E000-memory.dmp
memory/4116-20-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-21-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-22-0x00000212B1E60000-0x00000212B1E6A000-memory.dmp
memory/4116-23-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-24-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-9-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-8-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-7-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-6-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-5-0x00000212B1CA0000-0x00000212B1CC2000-memory.dmp
memory/4116-2-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4116-1-0x0000021298F00000-0x00000212998A4000-memory.dmp
memory/4836-52-0x0000000140000000-0x0000000140014000-memory.dmp
memory/4836-51-0x0000000140000000-0x0000000140014000-memory.dmp
memory/4836-50-0x0000000140000000-0x0000000140014000-memory.dmp
memory/4836-49-0x0000000140000000-0x0000000140014000-memory.dmp
memory/4836-48-0x0000000140000000-0x0000000140014000-memory.dmp
memory/5568-40-0x00000262D4990000-0x00000262D4A42000-memory.dmp
memory/5568-42-0x00000262BB590000-0x00000262BBF34000-memory.dmp