Analysis
- user interaction
yes - max time kernel
20s - max time network
18s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
26/08/2026, 17:16
Errors
General
- Target build.exe
- Size 2.8MB
- Sample260826-vs799atakh
- SHA256 8fc75b2d31eb34601599a13bd5046d8a42517731cb78cf16cb1c9bd3e5a43bd5
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "UQHMJNDW"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "UQHMJNDW" binpath= "C:\ProgramData\smyyoopgnboi\xhbhvrnlbufi.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "UQHMJNDW"2⤵
- Launches sc.exe
-
-
C:\ProgramData\smyyoopgnboi\xhbhvrnlbufi.exeC:\ProgramData\smyyoopgnboi\xhbhvrnlbufi.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
xhbhvrnlbufi.exe
xhbhvrnlbufi.exe
__PSScriptPolicyTest_oi4bmoqw.qtj.ps1
memory/3284-12-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-20-0x0000028344560000-0x000002834456A000-memory.dmp
memory/3284-7-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-8-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-9-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-10-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-11-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-16-0x00000283447A0000-0x0000028344852000-memory.dmp
memory/3284-15-0x0000028344780000-0x000002834479E000-memory.dmp
memory/3284-17-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-18-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-0-0x00007FFC28D1F000-0x00007FFC28D20000-memory.dmp
memory/3284-19-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-6-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-21-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-23-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-24-0x00000283444D9000-0x00000283444DF000-memory.dmp
memory/3284-3-0x00000283444E0000-0x0000028344502000-memory.dmp
memory/3284-4-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/3284-5-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4560-37-0x000001539FB70000-0x000001539FC22000-memory.dmp
memory/5944-25-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5944-27-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5944-28-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5944-26-0x0000000140000000-0x000000014002B000-memory.dmp