Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
21/08/2026, 02:08
General
- Target PCUpCheck_Setup.exe
- Size 17KB
- Sample260821-ckpttseq6w
- SHA256 aa06dca499fc13184a318c0ea0f6f8e4403acc9686639c772a56f0797df7fb79
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCUpCheck_Setup.exe"C:\Users\Admin\AppData\Local\Temp\PCUpCheck_Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pcupcheck_scan.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
pcupcheck_scan.ps1
memory/5052-19-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-29-0x000001A24A960000-0x000001A24AB22000-memory.dmp
memory/5052-6-0x000001A231C60000-0x000001A231C82000-memory.dmp
memory/5052-33-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-21-0x000001A24A780000-0x000001A24A7A4000-memory.dmp
memory/5052-9-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-13-0x000001A24A440000-0x000001A24A4F2000-memory.dmp
memory/5052-12-0x000001A24A420000-0x000001A24A43E000-memory.dmp
memory/5052-14-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-15-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-17-0x000001A24A200000-0x000001A24A20A000-memory.dmp
memory/5052-16-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-30-0x000001A24B060000-0x000001A24B588000-memory.dmp
memory/5052-18-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-8-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-20-0x000001A24A780000-0x000001A24A7AA000-memory.dmp
memory/5052-22-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-23-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-24-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-25-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-26-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-27-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5052-28-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5308-0-0x00007FFAE0BAF000-0x00007FFAE0BB0000-memory.dmp
memory/5308-3-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5308-1-0x0000000000690000-0x000000000069A000-memory.dmp
memory/5308-34-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp
memory/5308-35-0x00007FFAE0A20000-0x00007FFAE13C4000-memory.dmp