aa06dca499fc13184a318c0ea0f6f8e4403acc9686639c772a56f0797df7fb79

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PCUpCheck_Setup.exe
Size 17KB
Sample260821-g1ar3aaa84
SHA256 aa06dca499fc13184a318c0ea0f6f8e4403acc9686639c772a56f0797df7fb79
MD5 913e137867b39922298c829965e9076d
SHA1 9798bc0ad59379e7047557ad89f771b4d82faa7e
SHA512 0c72ff548c7859f72703773f049120877c22ac5d1c3ec75f9c03d156aff82521a64eb9b924de9630aa1e7f1326997e815836f6e0bf06c6eab5acdcacd5dc1fea
SSDEEP 384:hTFcp4ecF5Cec3YDkkvTcGJupDpwcczPy3v4cZc3HLRZ63yOZ3:lF4XO3SYDkk4GPtzPy3v4J1Z639Z3
TLSH
T1DB82898263ED0148F1FB3F756ABE4525097BBD65AD35CA0E0098250E1BF2E04C876BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1164	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1164	powershell.exe
1164	powershell.exe
1164	powershell.exe
1164	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe
Token: 36	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe
Token: 36	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe
Token: 36	1164	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1164	2692	PCUpCheck_Setup.exe	88

C:\Users\Admin\AppData\Local\Temp\PCUpCheck_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\PCUpCheck_Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pcupcheck_scan.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pcupcheck_scan.ps1

Path C:\Users\Admin\AppData\Local\Temp\pcupcheck_scan.ps1
Size 6KB
SHA256 d8026ccda52b2ec1d3964ba83e8f4c228265c98be6509747b4325bdb0eafa143
MD5 ab9e6b60b520699b02020d308ef6a398
SHA1 f3f32b0ca8c63050bc95b189b6c0febec455a8ed
SHA512 51eadbc291512f03a232358cd7b66c527dfefb3e4511685d53d25474dac4a2957414c030039a0300203c2f551e3b1903b9f43731fb872eb6dc03a95b749ac5bd
SSDEEP 192:uiADhXRwbumopCxFXiEdIH6ENzLPshJH3I:ux/wbtcZT5NzLEw
TLSH
T1B9D1D514B70945AED0D2137BD287839BEE2500AF0B998104B6DCC1883BBA95DD76EF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-19-0x000001D4CE910000-0x000001D4CE93A000-memory.dmp

Download

memory/1164-26-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-36-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-7-0x000001D4B6200000-0x000001D4B6222000-memory.dmp

Download

memory/1164-32-0x000001D4CF350000-0x000001D4CF878000-memory.dmp

Download

memory/1164-10-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-11-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-15-0x000001D4CE5B0000-0x000001D4CE5CE000-memory.dmp

Download

memory/1164-16-0x000001D4CE5D0000-0x000001D4CE682000-memory.dmp

Download

memory/1164-17-0x000001D4CE590000-0x000001D4CE59A000-memory.dmp

Download

memory/1164-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-31-0x000001D4CEC50000-0x000001D4CEE12000-memory.dmp

Download

memory/1164-30-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-21-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-28-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-23-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-24-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-25-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-20-0x000001D4CE910000-0x000001D4CE934000-memory.dmp

Download

memory/1164-27-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-22-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1164-29-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2692-3-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2692-0-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp

Download

memory/2692-1-0x0000000000830000-0x000000000083A000-memory.dmp

Download

memory/2692-4-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2692-37-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2692-38-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download