Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 12:15
General
- Target app/ApexTweaks.ps1
- Size 542KB
- Sample261030-pfcd6aee73
- SHA256 1ff4e71cd67498036380439852ab8b4d5b0a47a336281e53d7c6420221911338
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\app\ApexTweaks.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_as1f42u4.f5e.ps1
memory/3012-26-0x000001F7424A0000-0x000001F7424A8000-memory.dmp
memory/3012-20-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-7-0x000001F73EF20000-0x000001F73EF42000-memory.dmp
memory/3012-9-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-10-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-11-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-12-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-13-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-14-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-15-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-16-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-17-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-18-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-19-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-0-0x00007FFFADECF000-0x00007FFFADED0000-memory.dmp
memory/3012-21-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-22-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-24-0x000001F73F470000-0x000001F73F4FE000-memory.dmp
memory/3012-1-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-25-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-39-0x000001F7449E0000-0x000001F744A92000-memory.dmp
memory/3012-27-0x000001F742520000-0x000001F74255E000-memory.dmp
memory/3012-29-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-36-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-38-0x000001F7449C0000-0x000001F7449DE000-memory.dmp
memory/3012-28-0x000001F7424F0000-0x000001F7424FE000-memory.dmp
memory/3012-40-0x000001F7449B0000-0x000001F7449BA000-memory.dmp
memory/3012-41-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-42-0x000001F744AD0000-0x000001F744AFA000-memory.dmp
memory/3012-43-0x000001F744AD0000-0x000001F744AF4000-memory.dmp
memory/3012-44-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-46-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-45-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-47-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-48-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-50-0x000001F744AA0000-0x000001F744B90000-memory.dmp
memory/3012-51-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-52-0x00007FFFADD40000-0x00007FFFAE6E4000-memory.dmp
memory/3012-55-0x000001F744AA0000-0x000001F744B90000-memory.dmp
memory/3012-57-0x000001F744AA0000-0x000001F744B90000-memory.dmp