Analysis
- max time kernel
20s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
25/06/2026, 12:37
Errors
General
- Target _d727c634a81811e5a557dfcffb92e033862b636785410a81cf717046a91e0d19.exe
- Size 3.3MB
- Sample260625-ptr2rsb19p
- SHA256 d727c634a81811e5a557dfcffb92e033862b636785410a81cf717046a91e0d19
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Power Settings 1 TTPs 3 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_d727c634a81811e5a557dfcffb92e033862b636785410a81cf717046a91e0d19.exe"C:\Users\Admin\AppData\Local\Temp\_d727c634a81811e5a557dfcffb92e033862b636785410a81cf717046a91e0d19.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "TOPSOCSR"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "TOPSOCSR" binpath= "C:\ProgramData\rcmeotmtrtmm\szlvtzbcbfby.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "TOPSOCSR"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\_d727c634a81811e5a557dfcffb92e033862b636785410a81cf717046a91e0d19.exe"2⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
-
C:\ProgramData\rcmeotmtrtmm\szlvtzbcbfby.exeC:\ProgramData\rcmeotmtrtmm\szlvtzbcbfby.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
szlvtzbcbfby.exe
szlvtzbcbfby.exe
__PSScriptPolicyTest_xy10ttlh.buj.ps1
memory/1404-45-0x0000023D47EB0000-0x0000023D47F8A000-memory.dmp
memory/2796-20-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-23-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-10-0x00000218DBE80000-0x00000218DBE9E000-memory.dmp
memory/2796-12-0x00000218DBEA0000-0x00000218DBF52000-memory.dmp
memory/2796-11-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-13-0x00000218DBF60000-0x00000218DBF6A000-memory.dmp
memory/2796-14-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-15-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-16-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-17-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-18-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-19-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-0-0x00000218C367C000-0x00000218C367D000-memory.dmp
memory/2796-21-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-22-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-7-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-24-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-25-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-26-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-28-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-1-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-5-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-6-0x00000218C2EE0000-0x00000218C3884000-memory.dmp
memory/2796-4-0x00000218C3A00000-0x00000218C3A22000-memory.dmp
memory/4424-42-0x000001D1508B0000-0x000001D150962000-memory.dmp
memory/4972-31-0x0000000140000000-0x000000014002B000-memory.dmp
memory/4972-33-0x0000000140000000-0x000000014002B000-memory.dmp
memory/4972-30-0x0000000140000000-0x000000014002B000-memory.dmp
memory/4972-32-0x0000000140000000-0x000000014002B000-memory.dmp