Analysis
- max time kernel
689s - max time network
472s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 22:28
General
- Target $R0/Uninstall sklauncher.exe
- Size 248KB
- Sample260703-2dtxmsgy9x
- SHA256 2e8fc0d22f29cf1ad7bd9ee207a31afd6fbe6e271254bc6515a00520827e2c5e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 13 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall sklauncher.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall sklauncher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\sklauncher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_qndanag0.1sb.ps1
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
Un_A.exe
memory/120-70-0x0000000007060000-0x0000000007071000-memory.dmp
memory/120-69-0x0000000007100000-0x0000000007196000-memory.dmp
memory/120-66-0x000000006F820000-0x000000006F86C000-memory.dmp
memory/120-64-0x0000000005660000-0x00000000059BB000-memory.dmp
memory/5196-35-0x0000000072E60000-0x000000007361C000-memory.dmp
memory/5196-42-0x0000000005D40000-0x0000000005D5E000-memory.dmp
memory/5196-44-0x0000000006D20000-0x0000000006D56000-memory.dmp
memory/5196-48-0x0000000006320000-0x0000000006340000-memory.dmp
memory/5196-45-0x000000006F820000-0x000000006F86C000-memory.dmp
memory/5196-49-0x0000000007010000-0x00000000070B3000-memory.dmp
memory/5196-50-0x0000000007740000-0x0000000007DBC000-memory.dmp
memory/5196-51-0x00000000070C0000-0x00000000070DA000-memory.dmp
memory/5196-52-0x0000000007130000-0x000000000713A000-memory.dmp
memory/5196-53-0x00000000072D0000-0x00000000072FA000-memory.dmp
memory/5196-54-0x0000000007300000-0x0000000007324000-memory.dmp
memory/5196-55-0x000000006F980000-0x000000006FCDB000-memory.dmp
memory/5196-57-0x0000000072E60000-0x000000007361C000-memory.dmp
memory/5196-43-0x0000000005E00000-0x0000000005E4C000-memory.dmp
memory/5196-41-0x0000000005960000-0x0000000005CBB000-memory.dmp
memory/5196-37-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/5196-38-0x0000000005830000-0x0000000005896000-memory.dmp
memory/5196-36-0x0000000004EA0000-0x0000000004EC2000-memory.dmp
memory/5196-34-0x0000000072E60000-0x000000007361C000-memory.dmp
memory/5196-31-0x0000000072E72000-0x0000000072E73000-memory.dmp
memory/5196-33-0x0000000005100000-0x000000000574A000-memory.dmp
memory/5196-32-0x0000000002500000-0x0000000002536000-memory.dmp
memory/5736-83-0x000000006FA30000-0x000000006FD8B000-memory.dmp
memory/5736-80-0x000000006F820000-0x000000006F86C000-memory.dmp
memory/5736-76-0x0000000005790000-0x0000000005AEB000-memory.dmp