Analysis
- max time kernel
58s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
08/09/2026, 01:02
General
- Target entahV4.ps1
- Size 8KB
- Sample260908-bea8tacc78
- SHA256 2aa35145a91c27fda4b7167f55cabb68e016d4ea31ef8eaf6a58cb8b77a67a95
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in Windows directory 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\entahV4.ps11⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Deletes itself
- Enumerates connected drives
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {218474E8-3FFE-40FB-8C6A-A22F5B05D07A}2⤵
- Drops file in Windows directory
-
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {3A764E6A-E67E-465B-842B-A7136D0A6939}2⤵
- Drops file in Windows directory
-
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {60B4544C-28AF-4F96-B789-23F4DFEDF4CB}2⤵
- Drops file in Windows directory
-
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {452F83D7-585C-434E-929B-478B6BF66CEB}2⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -h off2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Edge.GameAssist_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xnd42m3o.es4.ps1
dism.log
dism.log
dism.log
dism.log
dism.log
dism.log
dism.log
dism.log
memory/2252-23-0x000001EF47C00000-0x000001EF47E04000-memory.dmp
memory/2252-29-0x000001EF47150000-0x000001EF47158000-memory.dmp
memory/2252-11-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-12-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-14-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-17-0x000001EF470E0000-0x000001EF470FE000-memory.dmp
memory/2252-18-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-19-0x000001EF476E0000-0x000001EF47792000-memory.dmp
memory/2252-20-0x000001EF47100000-0x000001EF4710A000-memory.dmp
memory/2252-21-0x000001EF47130000-0x000001EF4714E000-memory.dmp
memory/2252-22-0x000001EF47970000-0x000001EF479E6000-memory.dmp
memory/2252-9-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-24-0x000001EF47110000-0x000001EF4712A000-memory.dmp
memory/2252-25-0x000001EF479F0000-0x000001EF47A1A000-memory.dmp
memory/2252-26-0x000001EF470E0000-0x000001EF470E8000-memory.dmp
memory/2252-27-0x000001EF47130000-0x000001EF47136000-memory.dmp
memory/2252-28-0x000001EF47140000-0x000001EF4714A000-memory.dmp
memory/2252-10-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-30-0x000001EF47920000-0x000001EF47946000-memory.dmp
memory/2252-31-0x000001EF47160000-0x000001EF47168000-memory.dmp
memory/2252-32-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-99-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-100-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-102-0x000001EF47A20000-0x000001EF47A48000-memory.dmp
memory/2252-177-0x000001EF47BB0000-0x000001EF47BD4000-memory.dmp
memory/2252-176-0x000001EF47BB0000-0x000001EF47BDA000-memory.dmp
memory/2252-175-0x000001EF47AD0000-0x000001EF47ADE000-memory.dmp
memory/2252-8-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-7-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-6-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-5-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-4-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/2252-3-0x000001EF47010000-0x000001EF47032000-memory.dmp
memory/2252-0-0x00007FFFABD1F000-0x00007FFFABD20000-memory.dmp
memory/5696-70-0x00000280D5D00000-0x00000280D5D01000-memory.dmp
memory/5696-79-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-80-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-82-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-83-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-81-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-84-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-85-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-86-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-87-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-88-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-89-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-91-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-90-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-92-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-93-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-78-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-77-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-76-0x00000280D5D30000-0x00000280D5D31000-memory.dmp
memory/5696-75-0x00000280D5D20000-0x00000280D5D21000-memory.dmp
memory/5696-74-0x00000280D5D10000-0x00000280D5D11000-memory.dmp
memory/5696-72-0x00000280D5D00000-0x00000280D5D01000-memory.dmp
memory/5696-73-0x00000280D5D10000-0x00000280D5D11000-memory.dmp
memory/5696-68-0x00000280D5BC0000-0x00000280D5BC1000-memory.dmp
memory/5696-34-0x00000280C58A0000-0x00000280C58B0000-memory.dmp
memory/5696-49-0x00000280C5990000-0x00000280C59A0000-memory.dmp
memory/5696-94-0x00000280D5D40000-0x00000280D5D41000-memory.dmp
memory/5696-96-0x00000280D5E50000-0x00000280D5E51000-memory.dmp
memory/5696-95-0x00000280D5D40000-0x00000280D5D41000-memory.dmp
memory/5696-97-0x00000280D7900000-0x00000280D7901000-memory.dmp
memory/5696-98-0x00000280D7900000-0x00000280D7901000-memory.dmp