Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 12:33
General
- Target Microsoft.UI.Xaml.2.8_8.2501.31001.0_x86__8wekyb3d8bbwe.appx
- Size 4.4MB
- Sample260723-prdrcscn4w
- SHA256 34377ebe0cb380f5754f2bbcc13bff1fdfa02d8cc83cc8e237e635d9b8b514e7
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell start shell:AppsFolder\Get-Content : Cannot find path 'C:\AppxManifest.xml' because it does not exist. At line:1 char:881 + ... ath)) {exit -1;};[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\AppxManifest.xml:String) [Get-Content], ItemNotFoundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe' is denied. At line:1 char:881 + ... ath)) {exit -1;};[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x86__8wekyb3d8bbwe' is denied. At line:1 char:881 + ... ath)) {exit -1;};[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe !1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2792-0-0x00007FFF9ED3F000-0x00007FFF9ED40000-memory.dmp
memory/2792-4-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-3-0x000001C292B60000-0x000001C292B82000-memory.dmp
memory/2792-5-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-6-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-7-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-8-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-9-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-10-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-11-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-12-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-13-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-14-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-17-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp
memory/2792-16-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp