001d8affd0709de8def8ef921b9764daf663ebc7852efc75605aeaeff4223677

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftGayService.exe
Size 7.1MB
Sample260817-tzclgsvxht
SHA256 001d8affd0709de8def8ef921b9764daf663ebc7852efc75605aeaeff4223677
MD5 8e86226e5b1e65ba8752be19b69e4306
SHA1 2524b3a9db84054eb61916a05bdc071a3cc23c2d
SHA512 f780e7d8e336168271d74effb46375ec0c116a66111f47059b29bc615c159c0b2f154829744fb54fe9eb1f06828feac4a9b150fd882577c2d7c8cf1aab362bc0
SSDEEP 49152:YCG7Xi3O7kVQZHpP4ETJtlhGzDj5angT7Q7oTuq7zE6FAxgnB/knWixVapm7um6w:YCKrQwZI/NRmHeumvBh8huTVEV
TLSH
T15D764917ECA558E9C0ADC13085729563BF717C481B2063D72B90F6287F76BE46EBA384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe
2036	powershell.exe
724	powershell.exe
3836	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3496	powershell.exe
3496	powershell.exe
2036	powershell.exe
2036	powershell.exe
724	powershell.exe
724	powershell.exe
3836	powershell.exe
3836	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3496	1184	MicrosoftGayService.exe	89
PID 1184 wrote to memory of 2036	1184	MicrosoftGayService.exe	92
PID 1184 wrote to memory of 724	1184	MicrosoftGayService.exe	94
PID 1184 wrote to memory of 3836	1184	MicrosoftGayService.exe	96

C:\Users\Admin\AppData\Local\Temp\MicrosoftGayService.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftGayService.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd74999f32b3f0473a729fc46fd33ec3c6f9e411cc6391b1a7b3d521a5b7896d
MD5 1fdb4d03f2339da5b682f67d0c7283e3
SHA1 65c69466f755371bbb561b1f134618bf883d7045
SHA512 a4433af4af5b91f29dcc90db9d825f0634f073ce9b3f424f0d462775248fa3dd42c31a62e14a43f8cce18d9a40253014d9e24bba8be3d3b664999cd8d53283d3
TLSH
T10D115733B3CC8724C89A403A50CEAC1136B597DB90DEDFAB7B84D148A83F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4aafe533d43fa82a504f0b1c739a5b062a69339087db865d7833b0472502827f
MD5 b953c78e1658af39c5c3e8db6ef956ac
SHA1 33cd7b2a87152f3850bb30ee5155a6962dd1eac9
SHA512 31e29d3d533078dd5dfcabe4359e616c6c47a4573e4dac1b607381dc7090589a5c6ad837dece0a5cdf5bd56f6958679e224ec2295359b28a268bcc8e060821a0
TLSH
T1AC115733B3CC8624C89A413650CEAC1036B587DB519EDE6BBB84D154B43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vheh11ea.gcg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vheh11ea.gcg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3496-10-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-13-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-8-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-9-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-0-0x00007FFA7686F000-0x00007FFA76870000-memory.dmp

Download

memory/3496-11-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-12-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-7-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-14-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-16-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-17-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-6-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-5-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-4-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3496-3-0x00000273F7CD0000-0x00000273F7CF2000-memory.dmp

Download