Analysis
- max time kernel
149s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install-runner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
install-runner.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
安装宏表格运行器.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
安装宏表格运行器.cmd
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
宏表格运行器.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
宏表格运行器.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target install-runner.ps1
- Size 3KB
- Sample260909-ppx28acb65
- SHA256 53ac2df0f1891f4e542a047b0e5700e4ade3be70c4ce2efb44922bb7e26e1d08
- MD5 c7cf7a88041f79629df1bd5de1dd81ad
- SHA1 93d34a271357bcbecbd04e3755baa958bec0eee9
- SHA512 db3daaeb624fad40ff48f1033cb32f3f1cf03a61addd9ece66ac81e8d7938bc04de7b553bca49ca9541665112e2db2ac92e6fd64e64e664e15833f318cc5cdbb
- TLSH T1D47187288490188EAA73129B51C6238CFC2E4975C67A1AC0ED78E85139C373E4B665F3
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 4768 PowerShell.exe - Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum\shell\open PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh\ = "URL:宏表格" PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms\URL Protocol PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid\URL Protocol PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd\shell PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp\shell PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum\URL Protocol PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms\ = "URL:宏表格" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid\shell\open\command PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd\URL Protocol PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv\URL Protocol PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn\shell\open PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh\shell PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd\shell\open PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd\ = "URL:宏表格" PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv\shell\open\command PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp\URL Protocol PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn\shell\open\command PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh\shell\open PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh\URL Protocol PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid\shell PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv\shell\open PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn\shell PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn\ = "URL:宏表格" PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid\ = "URL:宏表格" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtbd\shell\open\command PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp\ = "URL:宏表格" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms\shell\open\command PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtid\shell\open PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv\shell PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp\shell\open PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum\shell\open\command PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum\ = "URL:宏表格" PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms\shell\open PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtuv\ = "URL:宏表格" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtfn\URL Protocol PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsum\shell PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh\shell\open\command PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbthh\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms\shell PowerShell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtms\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" PowerShell.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\hbtsp\shell\open\command PowerShell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4768 PowerShell.exe 4768 PowerShell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4768 PowerShell.exe
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install-runner.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768