Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 00:15
General
- Target Access_document.exe
- Size 6.2MB
- Sample260709-aj2e5aay7n
- SHA256 97787d85be23c1d44e055415b258e99722f87771980e8d028c503779c26d3703
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops file in Program Files directory 10 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Access_document.exe"C:\Users\Admin\AppData\Local\Temp\Access_document.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Program Files (x86)\RemotePulseAgent\defender-exclude.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\RemotePulseAgent\install.cmd" "SGHEFF2J" "https://remotepulse.io" "C:\Users\Admin\AppData\Local\Temp\Access_document.exe" "RemotePulseAgent" """2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe"C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe" "SGHEFF2J" "https://remotepulse.io" "C:\Users\Admin\AppData\Local\Temp\Access_document.exe" "RemotePulseAgent" ""3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$o=Get-CimInstance Win32_OperatingSystem -EA 0;$d=Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA 0;$p=Get-CimInstance Win32_PerfFormattedData_PerfOS_Processor -Filter \"Name='_Total'\" -EA 0;$cpu=0;$mem=0;$disk=0;if($p){$cpu=[math]::Round($p.PercentProcessorTime,1)};if($o -and $o.TotalVisibleMemorySize){$mem=[math]::Round((($o.TotalVisibleMemorySize-$o.FreePhysicalMemory)/$o.TotalVisibleMemorySize)*100,1)};if($d -and $d.Size){$disk=[math]::Round((($d.Size-$d.FreeSpace)/$d.Size)*100,1)};$os=if($o){$o.Caption}else{'Windows'};@{os=$os;cpu=$cpu;memory=$mem;disk=$disk}|ConvertTo-Json|Out-File -Encoding utf8 'C:\ProgramData\RemotePulseAgent\enroll-metrics.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
InstallCore.exe
install.log
install.log
install.log
install.log
install.log
msi-ca.log
msi-ca.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_llry2brg.mcc.ps1
memory/1972-70-0x00000000002E0000-0x000000000091C000-memory.dmp
memory/1972-148-0x00000000002E0000-0x000000000091C000-memory.dmp
memory/3336-52-0x00000000709C0000-0x0000000070A0C000-memory.dmp
memory/3336-48-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/3336-53-0x0000000070B20000-0x0000000070E7B000-memory.dmp
memory/3336-56-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-57-0x0000000007B20000-0x0000000007B40000-memory.dmp
memory/3336-58-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-59-0x0000000007B60000-0x0000000007C03000-memory.dmp
memory/3336-60-0x0000000008300000-0x000000000897C000-memory.dmp
memory/3336-61-0x0000000007CB0000-0x0000000007CCA000-memory.dmp
memory/3336-62-0x0000000007D00000-0x0000000007D0A000-memory.dmp
memory/3336-63-0x0000000007F00000-0x0000000007F96000-memory.dmp
memory/3336-64-0x00000000740B2000-0x00000000740B3000-memory.dmp
memory/3336-65-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-66-0x0000000007FA0000-0x0000000007FC2000-memory.dmp
memory/3336-67-0x0000000008F40000-0x00000000094FA000-memory.dmp
memory/3336-68-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-69-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-51-0x0000000007AE0000-0x0000000007B16000-memory.dmp
memory/3336-50-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-74-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-49-0x0000000006930000-0x000000000697C000-memory.dmp
memory/3336-37-0x00000000740B2000-0x00000000740B3000-memory.dmp
memory/3336-47-0x0000000006550000-0x00000000068AB000-memory.dmp
memory/3336-43-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/3336-44-0x0000000005D10000-0x0000000005D76000-memory.dmp
memory/3336-38-0x0000000003060000-0x0000000003096000-memory.dmp
memory/3336-42-0x0000000005B00000-0x0000000005B22000-memory.dmp
memory/3336-39-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-41-0x00000000740A0000-0x000000007485C000-memory.dmp
memory/3336-40-0x0000000005E10000-0x000000000645A000-memory.dmp
memory/3892-117-0x00000000703F0000-0x000000007043C000-memory.dmp
memory/3892-120-0x0000000007410000-0x00000000074B3000-memory.dmp
memory/3892-121-0x00000000075D0000-0x00000000075FA000-memory.dmp
memory/3892-122-0x0000000007760000-0x0000000007784000-memory.dmp
memory/3892-123-0x0000000070550000-0x00000000708AB000-memory.dmp
memory/3892-125-0x00000000079B0000-0x0000000007B72000-memory.dmp
memory/3892-126-0x0000000008740000-0x0000000008C6C000-memory.dmp
memory/3892-116-0x0000000006200000-0x000000000624C000-memory.dmp
memory/3892-114-0x0000000005D60000-0x00000000060BB000-memory.dmp
memory/4956-138-0x0000000000310000-0x0000000000329000-memory.dmp
memory/4956-98-0x0000000000310000-0x0000000000329000-memory.dmp