3e1f54d408f0cce16d52ff3745048e48414b52368ef4456792685315941d10a2

Analysis

user interaction
yes
max time kernel
28s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
backgroundimage.exe
Size 3.6MB
Sample260623-245rtsgz21
SHA256 3e1f54d408f0cce16d52ff3745048e48414b52368ef4456792685315941d10a2
MD5 e9e772b543f77750f0ece1b8237265f8
SHA1 f586382f3923a0a601cad5fdbde17793d601a4c5
SHA512 a6e0fe58099d8b6b0ea3a4ea4955af3ad523eb06f0ee16f77e36670f24533e121366c551740ff35448515197fa43a4e392bae4c8544adf2f18626fc285c12dad
SSDEEP 98304:YJWwMKp2Pe9lC17B3YLzzX4KXxEENjJQc6j1HGSf/HshqROuQHx:2iKpe1ZYLI+PpJZ6j1HGSffshqkuQ
TLSH
T1DD06330FB00667C6EE3C5EFD939629E61D7D4E1C9E7393523076320E8291380B56B99E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
4752	powershell.exe
2372	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4296	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdateService\\svchost.exe"	backgroundimage.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	api.ipify.org

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5084-0-0x00007FF687C00000-0x00007FF68A723000-memory.dmp	upx
behavioral1/files/0x00080000000243e9-14.dat	upx
behavioral1/memory/4296-25-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp	upx
behavioral1/memory/5084-31-0x00007FF687C00000-0x00007FF68A723000-memory.dmp	upx
behavioral1/memory/4296-49-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp	upx
behavioral1/memory/4296-50-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp	upx
behavioral1/memory/4296-51-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp	upx

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	10	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5084	backgroundimage.exe
5084	backgroundimage.exe
5084	backgroundimage.exe
5084	backgroundimage.exe
4752	powershell.exe
4752	powershell.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
2372	powershell.exe
2372	powershell.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe
4296	svchost.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	backgroundimage.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeIncreaseQuotaPrivilege	4752	powershell.exe
Token: SeSecurityPrivilege	4752	powershell.exe
Token: SeTakeOwnershipPrivilege	4752	powershell.exe
Token: SeLoadDriverPrivilege	4752	powershell.exe
Token: SeSystemProfilePrivilege	4752	powershell.exe
Token: SeSystemtimePrivilege	4752	powershell.exe
Token: SeProfSingleProcessPrivilege	4752	powershell.exe
Token: SeIncBasePriorityPrivilege	4752	powershell.exe
Token: SeCreatePagefilePrivilege	4752	powershell.exe
Token: SeBackupPrivilege	4752	powershell.exe
Token: SeRestorePrivilege	4752	powershell.exe
Token: SeShutdownPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeSystemEnvironmentPrivilege	4752	powershell.exe
Token: SeRemoteShutdownPrivilege	4752	powershell.exe
Token: SeUndockPrivilege	4752	powershell.exe
Token: SeManageVolumePrivilege	4752	powershell.exe
Token: 33	4752	powershell.exe
Token: 34	4752	powershell.exe
Token: 35	4752	powershell.exe
Token: 36	4752	powershell.exe
Token: SeDebugPrivilege	4296	svchost.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4752	5084	backgroundimage.exe	85
PID 5084 wrote to memory of 4296	5084	backgroundimage.exe	88
PID 4296 wrote to memory of 2372	4296	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\backgroundimage.exe
"C:\Users\Admin\AppData\Local\Temp\backgroundimage.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct).displayName -join ', '"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe
  C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct).displayName -join ', '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fbd6b175b9e1ffc92c569a6467172b6f1cebd4b8cd2d3bbb5119e1b4856cfe50
MD5 c24e9d1123bd6a335730119e7399c481
SHA1 53e88f378e61191fd1b0213e0beac692297cc5c2
SHA512 3323e8e2d73cb4e986b25ccd7abfe350f5205f144999ffe01cf8e30e4eb6c6d68ac03b1f1a0c82e3d1ab292320e66c44263bcdf05e1c78b5953fa5bb5bf2a80d
TLSH
T18B71CF323375B0D4C8567F072A2819C063BF4396EA98AF0CB65C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a92afb17c619023d235a996153d19ac22e12d1ca17db3e0aafb8105c87a10498
MD5 fca4ab3e00b425d99b1b5217ef9fad9a
SHA1 aca38b5ea5ab85e6016450991aee7f114963662e
SHA512 986ff69ac988e144a0d89352fce3c9dcad020be07263342a5b6474c86e1cfee06949152e4e4349953eea88f754259aa993c173aaa7704b8847b653f3b440abf5
TLSH
T1BC218727B39DC961CCDA113A209D9C113276C3C7809ECF8F6BC4D224A47F6C4CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tyaywfit.ztk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tyaywfit.ztk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe
Size 3.6MB
SHA256 3e1f54d408f0cce16d52ff3745048e48414b52368ef4456792685315941d10a2
MD5 e9e772b543f77750f0ece1b8237265f8
SHA1 f586382f3923a0a601cad5fdbde17793d601a4c5
SHA512 a6e0fe58099d8b6b0ea3a4ea4955af3ad523eb06f0ee16f77e36670f24533e121366c551740ff35448515197fa43a4e392bae4c8544adf2f18626fc285c12dad
SSDEEP 98304:YJWwMKp2Pe9lC17B3YLzzX4KXxEENjJQc6j1HGSf/HshqROuQHx:2iKpe1ZYLI+PpJZ6j1HGSffshqkuQ
TLSH
T1DD06330FB00667C6EE3C5EFD939629E61D7D4E1C9E7393523076320E8291380B56B99E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4296-25-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp

Download

memory/4296-51-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp

Download

memory/4296-50-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp

Download

memory/4296-49-0x00007FF6A1310000-0x00007FF6A3E33000-memory.dmp

Download

memory/4752-23-0x000001C071280000-0x000001C07129C000-memory.dmp

Download

memory/4752-26-0x000001C071270000-0x000001C07127A000-memory.dmp

Download

memory/4752-28-0x000001C0712D0000-0x000001C0712F4000-memory.dmp

Download

memory/4752-27-0x000001C0712D0000-0x000001C0712FA000-memory.dmp

Download

memory/4752-24-0x000001C071510000-0x000001C0715C5000-memory.dmp

Download

memory/4752-12-0x00007FF4D9890000-0x00007FF4D98A0000-memory.dmp

Download

memory/4752-8-0x000001C06EE00000-0x000001C06EE22000-memory.dmp

Download

memory/4752-2-0x000001C06F0A0000-0x000001C06F0B0000-memory.dmp

Download

memory/4752-1-0x000001C06F0A0000-0x000001C06F0B0000-memory.dmp

Download

memory/5084-0-0x00007FF687C00000-0x00007FF68A723000-memory.dmp

Download

memory/5084-31-0x00007FF687C00000-0x00007FF68A723000-memory.dmp

Download