Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/09/2026, 14:37
General
- Target analysis.exe
- Size 165KB
- Sample260929-rzbcbatwew
- SHA256 418851426f699081a5fa1b2393816757cf08ab38ad2587594f307f9090852201
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\analysis.exe"C:\Users\Admin\AppData\Local\Temp\analysis.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_VideoController).Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Create /TN "WindowsCacheService" /XML "C:\Users\Admin\AppData\Local\Temp\wctask.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';try{Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe';}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WmiApSrvHost.exe';}catch{};"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
BackgroundTaskHost.exe
StartupProfileData-NonInteractive
__PSScriptPolicyTest_g0d4y5vy.sm3.ps1
wctask.xml
memory/3148-12-0x0000021AB85A0000-0x0000021AB8652000-memory.dmp
memory/3148-14-0x0000021AB8660000-0x0000021AB868A000-memory.dmp
memory/3148-8-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3148-11-0x0000021AB8410000-0x0000021AB842E000-memory.dmp
memory/3148-0-0x00007FFA3124F000-0x00007FFA31250000-memory.dmp
memory/3148-13-0x0000021AB8430000-0x0000021AB843A000-memory.dmp
memory/3148-15-0x0000021AB8660000-0x0000021AB8684000-memory.dmp
memory/3148-7-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3148-17-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3148-18-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3148-6-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3148-5-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3148-4-0x0000021AA0360000-0x0000021AA0382000-memory.dmp
memory/3148-1-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp