Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 03:09
General
- Target mmc.ps1
- Size 11KB
- Sample260908-dnf7jay1es
- SHA256 cbdd84d423c21630bd4f0a73ebe70e41aff22f60ad852d0199ba43cfbf99a93d
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mmc.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn SystemUpdate /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemUpdate\mmc.ps1"" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemUpdate\mmc.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_t13ysrcp.4zm.ps1
tmp82DB.tmp.png
memory/4768-4-0x0000026C472C0000-0x0000026C472E2000-memory.dmp
memory/4768-7-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4768-8-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4768-9-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4768-11-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4768-6-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4768-0-0x00007FFE3558F000-0x00007FFE35590000-memory.dmp
memory/4768-5-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4768-1-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-23-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-17-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-20-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-21-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-22-0x000001B0398E0000-0x000001B039928000-memory.dmp
memory/4848-18-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-24-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-25-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-27-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-28-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-29-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-19-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-14-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-13-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/4848-12-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5500-37-0x0000029E1D420000-0x0000029E1D4D2000-memory.dmp
memory/5500-38-0x0000029E1D1E0000-0x0000029E1D1EA000-memory.dmp
memory/5500-39-0x0000029E1D760000-0x0000029E1D78A000-memory.dmp
memory/5500-40-0x0000029E1D760000-0x0000029E1D784000-memory.dmp
memory/5500-41-0x0000029E1D930000-0x0000029E1DAF2000-memory.dmp
memory/5500-44-0x0000029E1D760000-0x0000029E1D77E000-memory.dmp
memory/5500-47-0x0000029E1D760000-0x0000029E1D76A000-memory.dmp
memory/5500-48-0x0000029E1D790000-0x0000029E1D7A2000-memory.dmp
memory/5500-36-0x0000029E1D400000-0x0000029E1D41E000-memory.dmp