Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/07/2026, 23:49
General
- Target d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce.exe
- Size 12.3MB
- Sample260719-3vb9labx2t
- SHA256 d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce.exe"C:\Users\Admin\AppData\Local\Temp\d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create LogMgrv3 binPath= "C:\Users\Admin\AppData\Local\packages\syslog.exe 9ZE+37yC8l6+xov/QPzfifFGpsrP50m0kNi4WezWmPIv0KzvySvOmw==" displayName= "LogMgrv3" start= auto2⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\packages\syslog.exeC:\Users\Admin\AppData\Local\packages\syslog.exe 9ZE+37yC8l6+xov/QPzfifFGpsrP50m0kNi4WezWmPIv0KzvySvOmw==1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
favicon06.png
syslog.exe
__PSScriptPolicyTest_3yv3aruo.sz4.ps1
memory/3440-0-0x000001E1E7FB0000-0x000001E1E8C02000-memory.dmp
memory/3440-1-0x000001E1EB010000-0x000001E1EB020000-memory.dmp
memory/3440-18-0x000001E1EB010000-0x000001E1EB020000-memory.dmp
memory/3440-20-0x000001E1EB1F0000-0x000001E1EB202000-memory.dmp
memory/3440-21-0x000001E1EB110000-0x000001E1EB11A000-memory.dmp
memory/4844-3-0x0000016C41E70000-0x0000016C41E80000-memory.dmp
memory/4844-2-0x0000016C41E70000-0x0000016C41E80000-memory.dmp
memory/4844-4-0x0000016C5A540000-0x0000016C5A562000-memory.dmp