Overview
overview
3Static
static
1Diag-MumuNx.ps1
windows10-2004-x64
3Diag-MumuNx.ps1
windows11-ltsc_2024-x64
3SKILL.ps1
windows10-2004-x64
3SKILL.ps1
windows11-ltsc_2024-x64
3Test-MumuTunnelAB.ps1
windows10-2004-x64
3Test-MumuTunnelAB.ps1
windows11-ltsc_2024-x64
3Watch-Mumu...ns.ps1
windows10-2004-x64
3Watch-Mumu...ns.ps1
windows11-ltsc_2024-x64
3bootstrap-update.ps1
windows10-2004-x64
3bootstrap-update.ps1
windows11-ltsc_2024-x64
3mumu-menu.ps1
windows10-2004-x64
3mumu-menu.ps1
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
Diag-MumuNx.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Diag-MumuNx.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
SKILL.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SKILL.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Test-MumuTunnelAB.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Test-MumuTunnelAB.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Watch-MumuConnections.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Watch-MumuConnections.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
bootstrap-update.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
bootstrap-update.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
mumu-menu.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
mumu-menu.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Diag-MumuNx.ps1
- Size 8KB
- Sample261104-2rm19aeh48
- SHA256 2fa0baf77e84e92d5ac944b346d4d187d6f4199ad972868c522b80b16235055e
- MD5 e023fadc11452d1ca6bee04a6ff433cf
- SHA1 b4b7ff4f854d6cbebcedfc927e87738a00b9f933
- SHA512 c2405abc7bc7a00eb180f6b582f16c4137c872f1947d94f1ee68aac438d4cb6bd513c0d35e0fa65e7d6eba7fcfb773b1db687d8dd5db3e589df0e9c1ebddebca
- SSDEEP 192:UTy7iOTzzzcGHIg7iyqYCBfDQKtUIKuE4mlrjMi5jo05uvgHnl7Pm09jsO1:3pTzz1ji9jXtUpulmV4gE09J1
- TLSH T1FF02A6997FE8127673CFC113F5E79216E329901E09291600BABCC3D42F9683D86BD5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 2700 powershell.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2700 powershell.exe 2700 powershell.exe 2700 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2700 powershell.exe Token: SeIncreaseQuotaPrivilege 2700 powershell.exe Token: SeSecurityPrivilege 2700 powershell.exe Token: SeTakeOwnershipPrivilege 2700 powershell.exe Token: SeLoadDriverPrivilege 2700 powershell.exe Token: SeSystemProfilePrivilege 2700 powershell.exe Token: SeSystemtimePrivilege 2700 powershell.exe Token: SeProfSingleProcessPrivilege 2700 powershell.exe Token: SeIncBasePriorityPrivilege 2700 powershell.exe Token: SeCreatePagefilePrivilege 2700 powershell.exe Token: SeBackupPrivilege 2700 powershell.exe Token: SeRestorePrivilege 2700 powershell.exe Token: SeShutdownPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeSystemEnvironmentPrivilege 2700 powershell.exe Token: SeRemoteShutdownPrivilege 2700 powershell.exe Token: SeUndockPrivilege 2700 powershell.exe Token: SeManageVolumePrivilege 2700 powershell.exe Token: 33 2700 powershell.exe Token: 34 2700 powershell.exe Token: 35 2700 powershell.exe Token: 36 2700 powershell.exe Token: SeIncreaseQuotaPrivilege 2700 powershell.exe Token: SeSecurityPrivilege 2700 powershell.exe Token: SeTakeOwnershipPrivilege 2700 powershell.exe Token: SeLoadDriverPrivilege 2700 powershell.exe Token: SeSystemProfilePrivilege 2700 powershell.exe Token: SeSystemtimePrivilege 2700 powershell.exe Token: SeProfSingleProcessPrivilege 2700 powershell.exe Token: SeIncBasePriorityPrivilege 2700 powershell.exe Token: SeCreatePagefilePrivilege 2700 powershell.exe Token: SeBackupPrivilege 2700 powershell.exe Token: SeRestorePrivilege 2700 powershell.exe Token: SeShutdownPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeSystemEnvironmentPrivilege 2700 powershell.exe Token: SeRemoteShutdownPrivilege 2700 powershell.exe Token: SeUndockPrivilege 2700 powershell.exe Token: SeManageVolumePrivilege 2700 powershell.exe Token: 33 2700 powershell.exe Token: 34 2700 powershell.exe Token: 35 2700 powershell.exe Token: 36 2700 powershell.exe Token: SeIncreaseQuotaPrivilege 2700 powershell.exe Token: SeSecurityPrivilege 2700 powershell.exe Token: SeTakeOwnershipPrivilege 2700 powershell.exe Token: SeLoadDriverPrivilege 2700 powershell.exe Token: SeSystemProfilePrivilege 2700 powershell.exe Token: SeSystemtimePrivilege 2700 powershell.exe Token: SeProfSingleProcessPrivilege 2700 powershell.exe Token: SeIncBasePriorityPrivilege 2700 powershell.exe Token: SeCreatePagefilePrivilege 2700 powershell.exe Token: SeBackupPrivilege 2700 powershell.exe Token: SeRestorePrivilege 2700 powershell.exe Token: SeShutdownPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeSystemEnvironmentPrivilege 2700 powershell.exe Token: SeRemoteShutdownPrivilege 2700 powershell.exe Token: SeUndockPrivilege 2700 powershell.exe Token: SeManageVolumePrivilege 2700 powershell.exe Token: 33 2700 powershell.exe Token: 34 2700 powershell.exe Token: 35 2700 powershell.exe Token: 36 2700 powershell.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvz51uda.vrf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH