Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 04:27
General
- Target HEVC视频扩展-双击安装.appx
- Size 2.4MB
- Sample261027-e3kc6sav6x
- SHA256 46695112aa70a05faf71c69ecf4ff0502a3b82d152168d3ffb67219eafe51b85
Malware Config
Signatures
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\TEMP\tem64.tmp2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qzwfeht4.1xg.ps1
tem64.tmp
memory/2124-14-0x000001C7B83B0000-0x000001C7B83C0000-memory.dmp
memory/2124-23-0x000001C7B83B0000-0x000001C7B83C0000-memory.dmp
memory/2124-24-0x000001C7B83B0000-0x000001C7B83C0000-memory.dmp
memory/2124-13-0x000001C7B83B0000-0x000001C7B83C0000-memory.dmp
memory/2124-12-0x000001C7B83B0000-0x000001C7B83C0000-memory.dmp
memory/2124-15-0x000001C7B83B0000-0x000001C7B83C0000-memory.dmp
memory/4016-11-0x0000018EF9E40000-0x0000018EF9F8E000-memory.dmp
memory/4016-0-0x0000018EF75F0000-0x0000018EF7600000-memory.dmp
memory/4016-3-0x0000018EF9D10000-0x0000018EF9D32000-memory.dmp
memory/4016-1-0x0000018EF75F0000-0x0000018EF7600000-memory.dmp
memory/5888-16-0x0000028D89580000-0x0000028D89590000-memory.dmp
memory/5888-18-0x0000028D89580000-0x0000028D89590000-memory.dmp
memory/5888-17-0x0000028D89580000-0x0000028D89590000-memory.dmp
memory/5888-20-0x0000028D89580000-0x0000028D89590000-memory.dmp
memory/5888-21-0x0000028D89580000-0x0000028D89590000-memory.dmp