Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 15:19
General
- Target KnoxLeaderboardCompanion_Setup_v1.7.1.exe
- Size 14.1MB
- Sample260815-sqlmcsge62
- SHA256 49adb1cf421a0d1f725f9f8262a633909e5d9966627f3c1615c6f1a3600e6ad1
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 27 IoCs
- Suspicious use of SendNotifyMessage 27 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KnoxLeaderboardCompanion_Setup_v1.7.1.exe"C:\Users\Admin\AppData\Local\Temp\KnoxLeaderboardCompanion_Setup_v1.7.1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Start Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments=''; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Open Knox Leaderboard Status.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments='--show-status'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Stop Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments='--quit'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knox Leaderboard Companion\Uninstall Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanionInstaller.exe'; $s.Arguments='--uninstall'; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$w=New-Object -ComObject WScript.Shell; $s=$w.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Knox Leaderboard Companion.lnk'); $s.TargetPath='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe'; $s.Arguments=''; $s.WorkingDirectory='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion'; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico') { $s.IconLocation='C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\kcsn.ico' }; $s.Save()"2⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exeC:\Users\Admin\AppData\Local\KnoxLeaderboardCompanion\KnoxLeaderboardCompanion.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('Knox Leaderboard Companion v1.7.1 installed. The companion now runs in the Windows system tray. Right-click the KCSN tray icon for Open Leaderboard, Pause Uploading, and Exit. Signed anti-cheat protection and version enforcement are active.','Knox Leaderboard Companion') | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
KnoxLeaderboardCompanion.exe
KnoxLeaderboardCompanionInstaller.exe
config.json
kcsn.ico
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n2uzjcvm.gkd.ps1
memory/4232-12-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-19-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-20-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-16-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-14-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-13-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-11-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-5-0x00007FFA5146F000-0x00007FFA51470000-memory.dmp
memory/4232-10-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/4232-9-0x00000266F1DB0000-0x00000266F1DD2000-memory.dmp
memory/4232-6-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-28-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-32-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-33-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-36-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-37-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-31-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-30-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-29-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-27-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-26-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-22-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp
memory/5548-21-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp