Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/09/2026, 16:25
General
- Target desktop-updates_install.ps1
- Size 14KB
- Sample260926-tw86aaxdkd
- SHA256 d09c24d7c0398ecd30ad09b37e2d66aa3a89c44c53d74a422ad27f68cea65f4f
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 6 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 3 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\desktop-updates_install.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe"C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe"C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Cizi Code" --field-trial-handle=1724,i,6666299969881758055,15189593564120764248,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1728,i,15960679697997570467,15811988345826878059,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1764 /prefetch:113⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe"C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Cizi Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1724,i,6666299969881758055,15189593564120764248,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1728,i,15960679697997570467,15811988345826878059,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1720 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe"C:\Users\Admin\AppData\Local\CiziCode\Cizi Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Cizi Code" --app-path="C:\Users\Admin\AppData\Local\CiziCode\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1724,i,6666299969881758055,15189593564120764248,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1728,i,15960679697997570467,15811988345826878059,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2508 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop';$p=Get-AppxPackage -Name Claude | Where-Object { $_.PackageFamilyName -eq 'Claude_pzs8sxrjxfjjc' -and $_.Status -eq 'Ok' } | Sort-Object Version -Descending | Select-Object -First 1;if($p){[pscustomobject]@{InstallKind='msix';PackageFullName=$p.PackageFullName;PackageFamilyName=$p.PackageFamilyName;Publisher=$p.Publisher;Version=$p.Version.ToString();InstallLocation=$p.InstallLocation}|ConvertTo-Json -Compress;exit 0};$expected=[IO.Path]::GetFullPath((Join-Path $env:LOCALAPPDATA 'AnthropicClaude')).TrimEnd('\');$u=Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -eq 'Claude' -and $_.Publisher -eq 'Anthropic PBC'} | Select-Object -First 1;if($u){$root=[IO.Path]::GetFullPath([string]$u.InstallLocation).TrimEnd('\');if([string]::Equals($root,$expected,[StringComparison]::OrdinalIgnoreCase)){$app=Get-ChildItem -LiteralPath $root -Directory -Filter 'app-*' -ErrorAction SilentlyContinue | Where-Object {$_.Name -match '^app-\d+(?:\.\d+){2,3}$'} | Sort-Object {[version]($_.Name.Substring(4))} -Descending | Select-Object -First 1;if($app){$exe=Join-Path $app.FullName 'claude.exe';$asar=Join-Path $app.FullName 'resources\app.asar';$update=Join-Path $root 'Update.exe';if((Test-Path -LiteralPath $exe -PathType Leaf)-and(Test-Path -LiteralPath $asar -PathType Leaf)-and(Test-Path -LiteralPath $update -PathType Leaf)){[pscustomobject]@{InstallKind='squirrel';PackageFullName=('AnthropicClaude_'+$u.DisplayVersion);PackageFamilyName='AnthropicClaude';Publisher=$u.Publisher;Version=$u.DisplayVersion;InstallLocation=$app.FullName;InstallRoot=$root;Executable=$exe;Asar=$asar;UninstallString=$u.UninstallString}|ConvertTo-Json -Compress}}}}"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop';$searcher=New-Object System.Management.ManagementObjectSearcher(\"SELECT ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine,CreationDate FROM Win32_Process WHERE Name='claude.exe'\");$rows=@($searcher.Get()|ForEach-Object{;$path=[string]$_.ExecutablePath;if([string]::IsNullOrWhiteSpace($path)){try{$path=[string](Get-Process -Id ([int]$_.ProcessId) -ErrorAction Stop).Path}catch{}};$created=$null;if(-not[string]::IsNullOrWhiteSpace([string]$_.CreationDate)){try{$created=[System.Management.ManagementDateTimeConverter]::ToDateTime([string]$_.CreationDate).ToUniversalTime().ToString('o')}catch{}};[pscustomobject]@{pid=[int]$_.ProcessId;ppid=[int]$_.ParentProcessId;name=[string]$_.Name;path=$path;commandLine=[string]$_.CommandLine;creationDate=$created};});@($rows)|ConvertTo-Json -Compress -Depth 3"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg.exe query HKCU\SOFTWARE\Policies\Claude3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe query HKLM\SOFTWARE\Policies\Claude3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe query HKLM\SOFTWARE\Policies3⤵
- Modifies registry key
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
libEGL.dll
libGLESv2.dll
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0wts2cu4.nhg.ps1
data_0
data_1
data_2
data_3
tool-intents.json
tool-intents.json
default.exc
image.ico
memory/1364-26-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-8-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-33-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-34-0x000002161BC00000-0x000002161BC0A000-memory.dmp
memory/1364-35-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-36-0x000002161BC00000-0x000002161BC12000-memory.dmp
memory/1364-37-0x000002161BB20000-0x000002161BB2A000-memory.dmp
memory/1364-392-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-426-0x000002161BC50000-0x000002161BC74000-memory.dmp
memory/1364-425-0x000002161BC50000-0x000002161BC7A000-memory.dmp
memory/1364-427-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-428-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-429-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-430-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-431-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-432-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-434-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-435-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-437-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-441-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-443-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-444-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-448-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-31-0x000002161BB20000-0x000002161BB3E000-memory.dmp
memory/1364-0-0x00007FF863C6F000-0x00007FF863C70000-memory.dmp
memory/1364-3-0x000002161B4B0000-0x000002161B4D2000-memory.dmp
memory/1364-4-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-24-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-21-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-18-0x000002161C3D0000-0x000002161C8F8000-memory.dmp
memory/1364-17-0x000002161BCD0000-0x000002161BE92000-memory.dmp
memory/1364-14-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-13-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-12-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-11-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-10-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-9-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-32-0x000002161BB40000-0x000002161BBF2000-memory.dmp
memory/1364-7-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-6-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-5-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/3940-569-0x0000015A54C80000-0x0000015A54E84000-memory.dmp
memory/3940-570-0x0000015A547E0000-0x0000015A547FA000-memory.dmp
memory/3940-571-0x0000015A54B00000-0x0000015A54B2A000-memory.dmp
memory/3940-572-0x0000015A547D0000-0x0000015A547D8000-memory.dmp
memory/3940-573-0x0000015A54800000-0x0000015A54806000-memory.dmp
memory/3940-574-0x0000015A54810000-0x0000015A5481A000-memory.dmp
memory/3940-575-0x0000015A54A70000-0x0000015A54A78000-memory.dmp
memory/3940-576-0x0000015A54AB0000-0x0000015A54AD6000-memory.dmp
memory/4220-500-0x00007FF8867F0000-0x00007FF8867F1000-memory.dmp
memory/4220-499-0x00007FF8853C0000-0x00007FF8853C1000-memory.dmp
memory/4220-606-0x0000020C98380000-0x0000020C983AF000-memory.dmp