33a3c987d3f19a0216b80d87701107669ec4ca00dbf3447a6672b8ac2f147ac0

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PCUpCheck_Setup_EN.exe
Size 17KB
Sample260716-pgn5cagy6x
SHA256 33a3c987d3f19a0216b80d87701107669ec4ca00dbf3447a6672b8ac2f147ac0
MD5 9115c9d5df811966d69f1b5527870f91
SHA1 355d022accc3a3571d93c547cf52684eed095a58
SHA512 37b025fd54dab0f8032a14e2bfd48491599c228385c82ebbe95edfc6dabc9abb359a326c3d86b37a62ff426f1e0a3058f3c0c2f1e954d9cf464834fd4b54da58
SSDEEP 384:9DNTFcp4ecFuc3YDkkvTcGJupDpwcczPy3v4cZc3HElyc3:hhF4XOuSYDkk4GPtzPy3v4Jklyc3
TLSH
T1AB72788267ED0148F1FB7F756ABE4525097BBD669D35CA0E0098250E1BF2A04CC76BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2148	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeIncreaseQuotaPrivilege	2148	powershell.exe
Token: SeSecurityPrivilege	2148	powershell.exe
Token: SeTakeOwnershipPrivilege	2148	powershell.exe
Token: SeLoadDriverPrivilege	2148	powershell.exe
Token: SeSystemProfilePrivilege	2148	powershell.exe
Token: SeSystemtimePrivilege	2148	powershell.exe
Token: SeProfSingleProcessPrivilege	2148	powershell.exe
Token: SeIncBasePriorityPrivilege	2148	powershell.exe
Token: SeCreatePagefilePrivilege	2148	powershell.exe
Token: SeBackupPrivilege	2148	powershell.exe
Token: SeRestorePrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeSystemEnvironmentPrivilege	2148	powershell.exe
Token: SeRemoteShutdownPrivilege	2148	powershell.exe
Token: SeUndockPrivilege	2148	powershell.exe
Token: SeManageVolumePrivilege	2148	powershell.exe
Token: 33	2148	powershell.exe
Token: 34	2148	powershell.exe
Token: 35	2148	powershell.exe
Token: 36	2148	powershell.exe
Token: SeIncreaseQuotaPrivilege	2148	powershell.exe
Token: SeSecurityPrivilege	2148	powershell.exe
Token: SeTakeOwnershipPrivilege	2148	powershell.exe
Token: SeLoadDriverPrivilege	2148	powershell.exe
Token: SeSystemProfilePrivilege	2148	powershell.exe
Token: SeSystemtimePrivilege	2148	powershell.exe
Token: SeProfSingleProcessPrivilege	2148	powershell.exe
Token: SeIncBasePriorityPrivilege	2148	powershell.exe
Token: SeCreatePagefilePrivilege	2148	powershell.exe
Token: SeBackupPrivilege	2148	powershell.exe
Token: SeRestorePrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeSystemEnvironmentPrivilege	2148	powershell.exe
Token: SeRemoteShutdownPrivilege	2148	powershell.exe
Token: SeUndockPrivilege	2148	powershell.exe
Token: SeManageVolumePrivilege	2148	powershell.exe
Token: 33	2148	powershell.exe
Token: 34	2148	powershell.exe
Token: 35	2148	powershell.exe
Token: 36	2148	powershell.exe
Token: SeIncreaseQuotaPrivilege	2148	powershell.exe
Token: SeSecurityPrivilege	2148	powershell.exe
Token: SeTakeOwnershipPrivilege	2148	powershell.exe
Token: SeLoadDriverPrivilege	2148	powershell.exe
Token: SeSystemProfilePrivilege	2148	powershell.exe
Token: SeSystemtimePrivilege	2148	powershell.exe
Token: SeProfSingleProcessPrivilege	2148	powershell.exe
Token: SeIncBasePriorityPrivilege	2148	powershell.exe
Token: SeCreatePagefilePrivilege	2148	powershell.exe
Token: SeBackupPrivilege	2148	powershell.exe
Token: SeRestorePrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeSystemEnvironmentPrivilege	2148	powershell.exe
Token: SeRemoteShutdownPrivilege	2148	powershell.exe
Token: SeUndockPrivilege	2148	powershell.exe
Token: SeManageVolumePrivilege	2148	powershell.exe
Token: 33	2148	powershell.exe
Token: 34	2148	powershell.exe
Token: 35	2148	powershell.exe
Token: 36	2148	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2148	4660	PCUpCheck_Setup_EN.exe	87

C:\Users\Admin\AppData\Local\Temp\PCUpCheck_Setup_EN.exe
"C:\Users\Admin\AppData\Local\Temp\PCUpCheck_Setup_EN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pcupcheck_scan.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pcupcheck_scan.ps1

Path C:\Users\Admin\AppData\Local\Temp\pcupcheck_scan.ps1
Size 5KB
SHA256 6b18d214591272d48d0068afcb54a7ef163c2648eb45e00843e7a3368bd66ac5
MD5 8f32c63a4eac9efb586d0dc8c63033da
SHA1 4c39336a5df8a292392e10d3003ae82cf7c8a3e5
SHA512 bb6998dc39ce8eebb5e3e88cf3f46845a19ae7cf1a088c7335eade7b80f1f9c5a61750789fb5b7b9e5a3e5679717c060f043d4a94c40470d31f153ba276e489e
SSDEEP 96:uNkAD2aDEV43ieTOgij03Lu90opCxV4K91mLEd9eH6ENagkTgH9ZshJ9YqL3I:uiADhCdwbumopCxFXiEdIH6ENzLPshJ4
TLSH
T102C1D714B70945AED4D2077AD287839BED6400AF0B984105B6DCC1892BBF95CCBAEF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2148-18-0x0000029CA7B10000-0x0000029CA7B34000-memory.dmp

Download

memory/2148-17-0x0000029CA7B10000-0x0000029CA7B3A000-memory.dmp

Download

memory/2148-6-0x0000029CA74D0000-0x0000029CA74F2000-memory.dmp

Download

memory/2148-30-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-8-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-9-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-28-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-11-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-14-0x0000029CA77B0000-0x0000029CA77CE000-memory.dmp

Download

memory/2148-15-0x0000029CA77D0000-0x0000029CA7882000-memory.dmp

Download

memory/2148-26-0x0000029CA8420000-0x0000029CA8948000-memory.dmp

Download

memory/2148-10-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-22-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-19-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-20-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-21-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-16-0x0000029CA7590000-0x0000029CA759A000-memory.dmp

Download

memory/2148-23-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-24-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/2148-25-0x0000029CA7D20000-0x0000029CA7EE2000-memory.dmp

Download

memory/4660-3-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download

memory/4660-0-0x00007FFEFFD0F000-0x00007FFEFFD10000-memory.dmp

Download

memory/4660-1-0x0000000000F60000-0x0000000000F6A000-memory.dmp

Download

memory/4660-31-0x00007FFEFFB80000-0x00007FFF00524000-memory.dmp

Download