Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 03:09
General
- Target mmc.ps1
- Size 11KB
- Sample260908-dnf7jay1es
- SHA256 cbdd84d423c21630bd4f0a73ebe70e41aff22f60ad852d0199ba43cfbf99a93d
Malware Config
Extracted
-
ps1
-
exe.dropper
https://discord.com/api/webhooks/1545743202919907349/umITgS5rys39d2bWHwn7UerGKfAbX5HO1RMRI6mbijd25MwWMdL4Ekzv8GewxDTsSO9V
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mmc.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn SystemUpdate /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemUpdate\mmc.ps1"" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemUpdate\mmc.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.EXE.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_43hzazhq.1rm.ps1
mmc.ps1
memory/3024-1-0x000001D46DB20000-0x000001D46DB30000-memory.dmp
memory/3024-9-0x000001D46FCD0000-0x000001D46FCF2000-memory.dmp
memory/3024-0-0x000001D46DB20000-0x000001D46DB30000-memory.dmp
memory/5128-44-0x000001ADC8090000-0x000001ADC80A2000-memory.dmp
memory/5128-43-0x000001ADC5BA0000-0x000001ADC5BAA000-memory.dmp
memory/5128-40-0x000001ADC5B40000-0x000001ADC5B64000-memory.dmp
memory/5128-39-0x000001ADC5B40000-0x000001ADC5B6A000-memory.dmp
memory/5736-13-0x000001FB4B780000-0x000001FB4B790000-memory.dmp
memory/5736-26-0x000001FB4B780000-0x000001FB4B790000-memory.dmp
memory/5736-25-0x000001FB4B780000-0x000001FB4B790000-memory.dmp
memory/5736-22-0x000001FB66450000-0x000001FB664C6000-memory.dmp
memory/5736-21-0x000001FB66380000-0x000001FB663C4000-memory.dmp
memory/5736-12-0x000001FB4B780000-0x000001FB4B790000-memory.dmp