Analysis
- user interaction
yes - max time kernel
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 04:24
General
- Target UacBypassTest.exe
- Size 28KB
- Sample260714-e1m2aaes4l
- SHA256 ddaf7834f23c2670a114e5f331e2be8b0e3cfe8f3f1a85d01e447890e496b089
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\UacBypassTest.exe"C:\Users\Admin\AppData\Local\Temp\UacBypassTest.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -W Hidden -Command "$w=New-Object -ComObject WScript.Shell;$w.Popup('UAC BYPASS WORKED! Method 5 (CLSID Scan)',10,'UacBypassTest',0)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {10964DDD-6A53-4C60-917F-7B5723014344} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {2EF44DE8-80C9-42D9-8541-F40EF0862FA3} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {3213CD15-4DF2-415F-83F2-9FC58F3AEB3A} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {3886CA90-AB09-49D1-A047-7A62D096D275} -Embedding1⤵
-
C:\Windows\System32\TpmVscMgrSvr.exepowershell.exe -NoP -W Hidden -Command "$p=[System.Security.Principal.WindowsIdentity]::GetCurrent();$wp=New-Object System.Security.Principal.WindowsPrincipal($p);$r=$wp.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator);'Elevated='+$r | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\uac_bypass_result.txt' -Encoding ascii;if($r){$w=New-Object -ComObject WScript.Shell;$w.Popup('UAC BYPASS WORKED - Running as ADMIN',10,'UacBypassTest',0)}" -Embedding1⤵
-
C:\Windows\System32\easinvoker.exepowershell.exe -NoP -W Hidden -Command "$p=[System.Security.Principal.WindowsIdentity]::GetCurrent();$wp=New-Object System.Security.Principal.WindowsPrincipal($p);$r=$wp.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator);'Elevated='+$r | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\uac_bypass_result.txt' -Encoding ascii;if($r){$w=New-Object -ComObject WScript.Shell;$w.Popup('UAC BYPASS WORKED - Running as ADMIN',10,'UacBypassTest',0)}" -Embedding1⤵
-
C:\Windows\System32\ImmersiveTpmVscMgrSvr.exepowershell.exe -NoP -W Hidden -Command "$p=[System.Security.Principal.WindowsIdentity]::GetCurrent();$wp=New-Object System.Security.Principal.WindowsPrincipal($p);$r=$wp.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator);'Elevated='+$r | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\uac_bypass_result.txt' -Encoding ascii;if($r){$w=New-Object -ComObject WScript.Shell;$w.Popup('UAC BYPASS WORKED - Running as ADMIN',10,'UacBypassTest',0)}" -Embedding1⤵
-
C:\Windows\system32\lpksetup.exepowershell.exe -NoP -W Hidden -Command "$p=[System.Security.Principal.WindowsIdentity]::GetCurrent();$wp=New-Object System.Security.Principal.WindowsPrincipal($p);$r=$wp.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator);'Elevated='+$r | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\uac_bypass_result.txt' -Encoding ascii;if($r){$w=New-Object -ComObject WScript.Shell;$w.Popup('UAC BYPASS WORKED - Running as ADMIN',10,'UacBypassTest',0)}" -Embedding1⤵
-
C:\Windows\system32\lpksetup.exe"C:\Windows\system32\lpksetup.exe" -Embedding1⤵
-
\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE"c:\Program Files\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE" -Embedding1⤵
-
C:\Windows\System32\cttunesvr.exeC:\Windows\System32\cttunesvr.exe -Embedding1⤵
-
C:\Windows\system32\CertEnrollCtrl.exeC:\Windows\system32\CertEnrollCtrl.exe -Embedding1⤵
-
C:\Program Files\Internet Explorer\IEInstal.exe"C:\Program Files\Internet Explorer\IEInstal.exe" -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -W Hidden -Command "$p=[System.Security.Principal.WindowsIdentity]::GetCurrent();$wp=New-Object System.Security.Principal.WindowsPrincipal($p);$r=$wp.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator);'Elevated='+$r | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\uac_bypass_result.txt' -Encoding ascii;if($r){$w=New-Object -ComObject WScript.Shell;$w.Popup('UAC BYPASS WORKED - Running as ADMIN',10,'UacBypassTest',0)}" -Embedding1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yrb2szqo.j2t.ps1
uac_bypass_result.txt
memory/1508-14-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-16-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-5-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-6-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-7-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-8-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-9-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-10-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-11-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-12-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-13-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-1-0x00000233A6BE0000-0x00000233A6BEC000-memory.dmp
memory/1508-15-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-4-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-38-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-3-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-2-0x00007FFA3A1D0000-0x00007FFA3AB74000-memory.dmp
memory/1508-0-0x00007FFA3A35F000-0x00007FFA3A360000-memory.dmp
memory/5760-27-0x0000025EDE1F0000-0x0000025EDE2A2000-memory.dmp
memory/5760-28-0x0000025EDE2B0000-0x0000025EDE2BA000-memory.dmp
memory/5760-29-0x0000025EDE2E0000-0x0000025EDE2FE000-memory.dmp
memory/5760-30-0x0000025EDE2C0000-0x0000025EDE2CA000-memory.dmp
memory/5760-31-0x0000025EDE320000-0x0000025EDE33C000-memory.dmp
memory/5760-32-0x0000025EDE2D0000-0x0000025EDE2D8000-memory.dmp
memory/5760-33-0x0000025EDE300000-0x0000025EDE306000-memory.dmp
memory/5760-34-0x0000025EDE310000-0x0000025EDE31A000-memory.dmp
memory/5760-26-0x0000025EDE1D0000-0x0000025EDE1EE000-memory.dmp
memory/5760-19-0x0000025EDDC30000-0x0000025EDDC52000-memory.dmp