Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 09:33
General
- Target SystemService.exe
- Size 2.4MB
- Sample260620-ljglhad19m
- SHA256 d997af9e892a331ffdee8303baa6230862e9a032f31eb63c461445c22b5789d7
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Delays execution with timeout.exe 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SystemService.exe"C:\Users\Admin\AppData\Local\Temp\SystemService.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\svc_setup.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "$s=(New-Object -COM WScript.Shell).CreateShortcut(\"$env:USERPROFILE\Desktop\System Service.lnk\");$s.TargetPath=\"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemService.exe\";$s.WorkingDirectory=\"$env:LOCALAPPDATA\Microsoft\CLR_v4.0\";$s.Description=\"System Service\";$s.IconLocation=\"$env:SystemRoot\System32\shell32.dll,15\";$s.WindowStyle=7;$s.Save()"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemService.exe"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemService.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SystemService.exe
__PSScriptPolicyTest_uyqtjvux.b5u.ps1
svc_setup.bat
memory/4488-36-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-31-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-38-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-37-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-28-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-29-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-35-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-34-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-33-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-32-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-39-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-30-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-40-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/4488-24-0x00000141A8790000-0x00000141A8791000-memory.dmp
memory/4488-27-0x00007FF786D80000-0x00007FF786FEA000-memory.dmp
memory/5924-1-0x00007FF79CFD0000-0x00007FF79D23A000-memory.dmp
memory/6036-13-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-22-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-18-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-21-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-17-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-16-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-15-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-14-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-12-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-10-0x0000022D327D0000-0x0000022D327F2000-memory.dmp
memory/6036-9-0x00007FFD48AA0000-0x00007FFD49444000-memory.dmp
memory/6036-3-0x00007FFD48C2F000-0x00007FFD48C30000-memory.dmp