Analysis
- user interaction
yes - max time kernel
5s - max time network
8s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
05/08/2026, 20:04
General
- Target 7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9.exe
- Size 9.6MB
- Sample260805-ythb1afk7t
- SHA256 7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9.exe"C:\Users\Admin\AppData\Local\Temp\7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exe'; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /delete /tn "MicrosoftUpdateService" /f2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn "MicrosoftUpdateService" /xml "C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdateService.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /tn "MicrosoftUpdateService"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exeC:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /tn "MicrosoftUpdateService"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
MicrosoftUpdateService.xml
__PSScriptPolicyTest_wozgo1qk.1xe.ps1
MicrosoftUpdateService.exe
memory/2228-10-0x0000018D733D0000-0x0000018D733E0000-memory.dmp
memory/2228-19-0x0000018D73380000-0x0000018D733A2000-memory.dmp
memory/2228-11-0x0000018D733D0000-0x0000018D733E0000-memory.dmp
memory/2652-65-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-64-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-63-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-66-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-67-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-68-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-56-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-53-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-69-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-71-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2652-72-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/4232-40-0x00000000088C0000-0x00000000088C1000-memory.dmp
memory/4232-20-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-3-0x00007FFB4DC50000-0x00007FFB4DC60000-memory.dmp
memory/4232-39-0x0000000006EB0000-0x0000000006EB1000-memory.dmp
memory/4232-41-0x0000000008900000-0x0000000008901000-memory.dmp
memory/4232-0-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-46-0x00000000088D0000-0x00000000088E0000-memory.dmp
memory/4232-43-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-50-0x0000000025EB0000-0x0000000025EB1000-memory.dmp
memory/4232-2-0x00007FF45B6B0000-0x00007FF45BA81000-memory.dmp
memory/4232-52-0x0000000025ED0000-0x0000000025ED1000-memory.dmp
memory/4232-55-0x0000000025EE0000-0x0000000025EE1000-memory.dmp
memory/4232-57-0x0000000025EF0000-0x0000000025EF1000-memory.dmp
memory/4232-1-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-23-0x00007FF45B6B0000-0x00007FF45BA81000-memory.dmp
memory/4232-35-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-4-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-60-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-5-0x0000000000A00000-0x00000000039C4000-memory.dmp
memory/4232-9-0x00000000088E0000-0x00000000088FA000-memory.dmp
memory/4232-8-0x00000000237D0000-0x000000002398E000-memory.dmp
memory/4232-7-0x0000000022E20000-0x0000000022ED2000-memory.dmp
memory/4232-6-0x00000000088D0000-0x00000000088E0000-memory.dmp
memory/4456-62-0x0000000000CA0000-0x0000000003C64000-memory.dmp
memory/4456-70-0x0000000006A00000-0x0000000006AB2000-memory.dmp
memory/4456-61-0x0000000000CA0000-0x0000000003C64000-memory.dmp
memory/4456-54-0x0000000000CA0000-0x0000000003C64000-memory.dmp
memory/4456-45-0x0000000000CA0000-0x0000000003C64000-memory.dmp
memory/4456-37-0x0000000000CA0000-0x0000000003C64000-memory.dmp