Analysis
- user interaction
yes - max time kernel
144s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 02:20
General
- Target CodexInstaller.exe
- Size 7.3MB
- Sample261024-csec3a1zhv
- SHA256 4b469abd1358b5996cca5b80b96ff49ad07f19f70161715a3d500963e63876ac
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CodexInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CodexInstaller.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-AppxPackage -Path 'C:\Users\Admin\AppData\Local\Temp\CodexDesktopInstaller\OpenAI.Codex_26.1021.3705.0_x64__2p2nqsd0c76g0.msix' -ForceApplicationShutdown"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_h0x3nctj.3le.psm1
memory/2836-14-0x000001627E930000-0x000001627E94A000-memory.dmp
memory/2836-18-0x000001627E910000-0x000001627E91A000-memory.dmp
memory/2836-6-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-7-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-8-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-11-0x000001627E6E0000-0x000001627E6FE000-memory.dmp
memory/2836-4-0x000001627E460000-0x000001627E482000-memory.dmp
memory/2836-12-0x000001627E700000-0x000001627E7B2000-memory.dmp
memory/2836-13-0x000001627EB20000-0x000001627ED24000-memory.dmp
memory/2836-17-0x000001627E6F0000-0x000001627E6F6000-memory.dmp
memory/2836-5-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-15-0x000001627E9D0000-0x000001627E9FA000-memory.dmp
memory/2836-1-0x00007FF81C4EF000-0x00007FF81C4F0000-memory.dmp
memory/2836-19-0x000001627E920000-0x000001627E928000-memory.dmp
memory/2836-16-0x000001627E6E0000-0x000001627E6E8000-memory.dmp
memory/2836-20-0x000001627E980000-0x000001627E9A6000-memory.dmp
memory/2836-21-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-22-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-23-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-24-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-25-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/2836-26-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp