Overview

overview

7

Static

static

3

KnoxLeader....1.exe

windows10-2004-x64

7

KnoxLeader....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 15:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    KnoxLeaderboardCompanion_Setup_v1.7.1.exe
  • Size 14.1MB
  • Sample260815-sqlmcsge62
  • SHA256 49adb1cf421a0d1f725f9f8262a633909e5d9966627f3c1615c6f1a3600e6ad1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KnoxLeaderboardCompanion_Setup_v1.7.1.exe
    "C:\Users\Admin\AppData\Local\Temp\KnoxLeaderboardCompanion_Setup_v1.7.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Start Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments=''; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Open Knox Leaderboard Status.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments='--show-status'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Stop Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments='--quit'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Uninstall Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanionInstaller.exe'; $s.Arguments='--uninstall'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments=''; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4728
    • C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe
      C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('Knox Leaderboard Companion v1.7.1 installed. The companion now runs in the Windows system tray. Right-click the KCSN tray icon for Open Leaderboard, Pause Uploading, and Exit. Signed anti-cheat protection and version enforcement are active.','Knox Leaderboard Companion') | Out-Null"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1624

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        KnoxLeaderboardCompanion.exe
        • Path C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe
        • Size 11.3MB
        • SHA256 9da3038fcd890b46afd548d829d3ca6def4736137bbd5f75285de8975019805b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KnoxLeaderboardCompanionInstaller.exe
        • Path C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanionInstaller.exe
        • Size 14.1MB
        • SHA256 49adb1cf421a0d1f725f9f8262a633909e5d9966627f3c1615c6f1a3600e6ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\config.json
        • Size 443B
        • SHA256 a17f8eeedf57ab1a650a38c4af560d44265db535d0b2e3ab14d1dccd46a5090d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kcsn.ico
        • Path C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico
        • Size 171KB
        • SHA256 cfadfacab19d239b0fbc7f86f356944935033b20c7eb728489da09dc1c839e7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 cdb4038645bf0206888c95666093becded85b1abdec6134428d7bc5ca65bd525
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c889ab605b2cde9ba5ec49b9d499f2e34c0a63b1861d032a78bfebd215cac289
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 0652be9bd035e584372271dfcc8866a11207183f571c8e0f21890d49f1e217b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 6f8ac41385bb99c3fcba58c015a4c2a6c096d0b6a25bbea4dd7375c3e2b64e83
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_ohq0xpae.rkq.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohq0xpae.rkq.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1368-21-0x000001C045080000-0x000001C045090000-memory.dmp
        Download

        memory/1368-22-0x000001C045080000-0x000001C045090000-memory.dmp
        Download

        memory/1368-33-0x000001C05F5D0000-0x000001C05F71E000-memory.dmp
        Download

        memory/1440-56-0x00000186F7AE0000-0x00000186F7C2E000-memory.dmp
        Download

        memory/1624-81-0x000001E4F4220000-0x000001E4F436E000-memory.dmp
        Download

        memory/2448-44-0x0000028352F10000-0x000002835305E000-memory.dmp
        Download

        memory/4104-5-0x000001BEFA870000-0x000001BEFA880000-memory.dmp
        Download

        memory/4104-19-0x000001BEFCD20000-0x000001BEFCE6E000-memory.dmp
        Download

        memory/4104-7-0x000001BEFC9F0000-0x000001BEFCA12000-memory.dmp
        Download

        memory/4104-6-0x000001BEFA870000-0x000001BEFA880000-memory.dmp
        Download

        memory/4728-67-0x0000023BF3A80000-0x0000023BF3BCE000-memory.dmp
        Download