Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/09/2026, 07:29
General
- Target cf498d214f4bb69758d0caa5356c6400dacbf9deb2c73adeaa2c2309b75b2bcf.exe
- Size 1.2MB
- Sample260909-jbpwsstejg
- SHA256 cf498d214f4bb69758d0caa5356c6400dacbf9deb2c73adeaa2c2309b75b2bcf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf498d214f4bb69758d0caa5356c6400dacbf9deb2c73adeaa2c2309b75b2bcf.exe"C:\Users\Admin\AppData\Local\Temp\cf498d214f4bb69758d0caa5356c6400dacbf9deb2c73adeaa2c2309b75b2bcf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp4745.tmp"C:\Users\Admin\AppData\Local\Temp\tmp4745.tmp"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\IsSpecialName\MemberType.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -Force ; Add-MpPreference -ExclusionProcess 'InstallUtil.exe' -Force ; Add-MpPreference -ExclusionProcess 'RegAsm.exe' -Force ; Add-MpPreference -ExclusionProcess 'MSBuild.exe' -Force ; Add-MpPreference -ExclusionProcess 'aspnet_compiler.exe' -Force ; Add-MpPreference -ExclusionProcess 'AppLaunch.exe' -Force ; Add-MpPreference -ExclusionProcess 'RegSvcs.exe' -Force ; Add-MpPreference -ExclusionProcess 'MemberType.exe' -Force"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\IsSpecialName\MemberType.exeC:\Users\Admin\AppData\Roaming\IsSpecialName\MemberType.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\IsSpecialName\MemberType.exeC:\Users\Admin\AppData\Roaming\IsSpecialName\MemberType.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zadqcdwi.51i.ps1
tmp4745.tmp
memory/3440-2841-0x0000022A05E00000-0x0000022A05E10000-memory.dmp
memory/3440-2849-0x0000022A1E510000-0x0000022A1E532000-memory.dmp
memory/3660-80-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-7-0x0000000000F30000-0x0000000000F40000-memory.dmp
memory/3660-10-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-22-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-62-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-60-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-106-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-132-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-130-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-128-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-124-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-122-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-120-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-118-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-116-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-114-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-112-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-110-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-108-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-104-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-102-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-100-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-98-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-96-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-94-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-92-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-126-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-90-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-88-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-86-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-84-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-82-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-74-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-78-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-8-0x000000001C190000-0x000000001C29E000-memory.dmp
memory/3660-76-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-40-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-70-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-68-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-66-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-64-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-58-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-56-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-54-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-52-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-50-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-48-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-44-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-42-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-72-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-38-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-36-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-34-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-30-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-28-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-26-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-24-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-20-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-18-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-16-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-14-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-12-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-46-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-32-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-9-0x000000001C190000-0x000000001C29A000-memory.dmp
memory/3660-6-0x00000000004A0000-0x000000000054C000-memory.dmp
memory/3660-2837-0x0000000002FA0000-0x0000000002FF6000-memory.dmp
memory/3660-2838-0x0000000000EE0000-0x0000000000F2C000-memory.dmp
memory/3660-2839-0x0000000003010000-0x0000000003064000-memory.dmp
memory/3660-2840-0x0000000000F30000-0x0000000000F40000-memory.dmp
memory/4092-0-0x00007FFC14B70000-0x00007FFC14D65000-memory.dmp