Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/11/2026, 22:49
General
- Target mumu-menu.ps1
- Size 610KB
- Sample261104-2rm19aeh48
- SHA256 66e7db5708913d24cde60cf935b8970d2841a4de9cad262fa4c418eac51dcd55
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mumu-menu.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry-all-errors --connect-timeout 10 --max-time 15 https://api.github.com/zen2⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 10 --max-time 20 https://api.github.com/zen2⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fzyk03ba\fzyk03ba.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCFF.tmp" "c:\Users\Admin\AppData\Local\Temp\fzyk03ba\CSC15F232B24A7D4A338B13FB664A3B374C.TMP"3⤵
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 15 -H "Accept: application/vnd.github.v3+json" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_0dcc568d06ab40d3baa294f1d300d456.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_4ce64849d4d448b48119136ca3644e8f.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/releases/latest2⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 30 -H "Accept: application/vnd.github.v3+json" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_c8fec1fd179f4a23a112920ea15e2e15.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_81d61d51411b4690950aa70037ea7c32.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.142⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 30 -H "Accept: application/vnd.github.raw" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_5ba5ef4aeef54b19a15d4abaada1080b.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_7b1895b836824a739fc34fc0adcf871f.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/./mumu-menu.ps1?ref=v10.4.142⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 15 -H "Accept: application/vnd.github.v3+json" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_8140d349dba44f26a2f9bb0c48b683c7.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_ee8d195628464ad4bf81054351102dd5.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.142⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 30 -H "Accept: application/vnd.github.v3+json" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_bd68fb5c8dc74458823eceb8ca9fa03f.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_f794cfe37a7945f28ec4efd0335d54c7.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.142⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 30 -H "Accept: application/vnd.github.raw" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_e293201dddbd4bd4b8a8734a26f7143c.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_77e10558076246bf9d6b1c275b0faf09.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/./mumu-menu.ps1?ref=v10.4.142⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESCCFF.tmp
__PSScriptPolicyTest_1n2kxtgt.ov0.ps1
fzyk03ba.dll
gh_hdr_0dcc568d06ab40d3baa294f1d300d456.txt
gh_hdr_5ba5ef4aeef54b19a15d4abaada1080b.txt
gh_hdr_8140d349dba44f26a2f9bb0c48b683c7.txt
gh_hdr_bd68fb5c8dc74458823eceb8ca9fa03f.txt
gh_hdr_c8fec1fd179f4a23a112920ea15e2e15.txt
gh_hdr_e293201dddbd4bd4b8a8734a26f7143c.txt
gh_resp_4ce64849d4d448b48119136ca3644e8f.json
gh_resp_81d61d51411b4690950aa70037ea7c32.json
CSC15F232B24A7D4A338B13FB664A3B374C.TMP
fzyk03ba.0.cs
fzyk03ba.cmdline
memory/2136-11-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-0-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-1-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-25-0x0000013F6B2A0000-0x0000013F6B462000-memory.dmp
memory/2136-24-0x0000013F6AD60000-0x0000013F6AD68000-memory.dmp
memory/2136-10-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-9-0x0000013F6ACB0000-0x0000013F6ACD2000-memory.dmp
memory/2136-30-0x0000013F6B9A0000-0x0000013F6BEC8000-memory.dmp
memory/2136-53-0x0000013F6B120000-0x0000013F6B14A000-memory.dmp
memory/2136-54-0x0000013F6B120000-0x0000013F6B144000-memory.dmp
memory/2136-55-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-56-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-57-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp
memory/2136-58-0x0000013F6A3B0000-0x0000013F6A3C0000-memory.dmp