66e7db5708913d24cde60cf935b8970d2841a4de9cad262fa4c418eac51dcd55

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mumu-menu.ps1
Size 610KB
Sample261104-2rm19aeh48
SHA256 66e7db5708913d24cde60cf935b8970d2841a4de9cad262fa4c418eac51dcd55
MD5 15793049b0023e5a51ffebe70186f5d3
SHA1 53ba8c1433b4d369f1951d42ed10f7c8a5cb14f0
SHA512 c5aae0e48fda93feb18b59391bf69ff968d51e6e1d1dc8916286e299f875a364e1da9b06a4618b503579926e443bbff00e88ad9c669381f964fff6f8fdc46167
SSDEEP 12288:DQsGQeTg/4AhrS7jRzAw7NCt23LkhvIZH:ksGQeTg/4AhrS7jRzAw7NCtG44H
TLSH
T1F0D4D83A6941053E6683107F5C996054BBA6903FD24D2EC4B48C91E4BFDA13DC3BABF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4256	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4256	PowerShell.exe
4256	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4256	PowerShell.exe
Token: SeSecurityPrivilege	4256	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4256	PowerShell.exe
Token: SeLoadDriverPrivilege	4256	PowerShell.exe
Token: SeSystemProfilePrivilege	4256	PowerShell.exe
Token: SeSystemtimePrivilege	4256	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4256	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4256	PowerShell.exe
Token: SeCreatePagefilePrivilege	4256	PowerShell.exe
Token: SeBackupPrivilege	4256	PowerShell.exe
Token: SeRestorePrivilege	4256	PowerShell.exe
Token: SeShutdownPrivilege	4256	PowerShell.exe
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4256	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4256	PowerShell.exe
Token: SeUndockPrivilege	4256	PowerShell.exe
Token: SeManageVolumePrivilege	4256	PowerShell.exe
Token: 33	4256	PowerShell.exe
Token: 34	4256	PowerShell.exe
Token: 35	4256	PowerShell.exe
Token: 36	4256	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4256	PowerShell.exe
Token: SeSecurityPrivilege	4256	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4256	PowerShell.exe
Token: SeLoadDriverPrivilege	4256	PowerShell.exe
Token: SeSystemProfilePrivilege	4256	PowerShell.exe
Token: SeSystemtimePrivilege	4256	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4256	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4256	PowerShell.exe
Token: SeCreatePagefilePrivilege	4256	PowerShell.exe
Token: SeBackupPrivilege	4256	PowerShell.exe
Token: SeRestorePrivilege	4256	PowerShell.exe
Token: SeShutdownPrivilege	4256	PowerShell.exe
Token: SeDebugPrivilege	4256	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4256	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4256	PowerShell.exe
Token: SeUndockPrivilege	4256	PowerShell.exe
Token: SeManageVolumePrivilege	4256	PowerShell.exe
Token: 33	4256	PowerShell.exe
Token: 34	4256	PowerShell.exe
Token: 35	4256	PowerShell.exe
Token: 36	4256	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3784	4256	PowerShell.exe	90
PID 4256 wrote to memory of 4488	4256	PowerShell.exe	91
PID 4256 wrote to memory of 3848	4256	PowerShell.exe	92
PID 3848 wrote to memory of 4780	3848	csc.exe	93
PID 4256 wrote to memory of 1468	4256	PowerShell.exe	94

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	4	curl/8.8.0
HTTP User-Agent header	11	curl/8.8.0
HTTP User-Agent header	14	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mumu-menu.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s --retry-all-errors --connect-timeout 10 --max-time 15 https://api.github.com/zen
  2⤵
  PID:3784
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 10 --max-time 20 https://api.github.com/zen
  2⤵
  PID:4488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\beu4bgcu\beu4bgcu.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C20.tmp" "c:\Users\Admin\AppData\Local\Temp\beu4bgcu\CSC83367CF65BE746DFBE7CFA2CECCCB35.TMP"
    3⤵
    PID:4780
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s --retry 3 --retry-delay 2 --retry-all-errors --connect-timeout 30 --max-time 15 -H "Accept: application/vnd.github.v3+json" -D C:\Users\Admin\AppData\Local\Temp\gh_hdr_b2da5061b1f3471fb29382598c4599c3.txt -o C:\Users\Admin\AppData\Local\Temp\gh_resp_7de1a16360d24e27815dfb98f542cd76.json https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/releases/latest
  2⤵
  PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5C20.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5C20.tmp
Size 1KB
SHA256 0eefce6037fd5a1ee4c54931aade9bcd92420aa5e1b615ecaf76e79432243078
MD5 752212fe8936ea40f2319a3731bb415c
SHA1 c25a89ba5ff0b92e08d4bfb141f0b9ae56356112
SHA512 8c4b055f564568e6e27e19f366cf5a7c6f1633a95d9a75297f2775ce9310f5246e2e3e05627fc0e340de1e696e2e53e13b29482ff3fe312fde52fcae54d3a2b2
TLSH
T1C521CC0553EC471FF07747316AF6075FA278FD55EF62A35A4840422C2C41504EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4ehr4ect.2w4.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ehr4ect.2w4.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

beu4bgcu.dll

Path C:\Users\Admin\AppData\Local\Temp\beu4bgcu\beu4bgcu.dll
Size 3KB
SHA256 ac666ff349aafa2e7309e41d18b15368feccc7236683d3ce487fbf361a2dac6e
MD5 c371be848279891fc27cacf2b3c90bb5
SHA1 2f9ee83fdcc6374796c136e0bd7ceb5e8d8cb12e
SHA512 69ed27740ae45cec29a5c832b82ee9c61c7029fe5c4a5a683246509ac23958901a6b0923aeeadc3eb6ff5d5ff20961fb1bc431d1f829b4b1c343fd6ac85e05b9
TLSH
T173711C5787E90637E4BB4B74AEF3475363B1F8618B22972E0C80022CAC957501D76FB0
MD5 SHA1 SHA512 TLSH

Submit Download

gh_hdr_b2da5061b1f3471fb29382598c4599c3.txt

Path C:\Users\Admin\AppData\Local\Temp\gh_hdr_b2da5061b1f3471fb29382598c4599c3.txt
Size 1KB
SHA256 6f6ab06cd3d5fe881d50c47086e8d8d8d11a98c38610d8315ae0b838686a411f
MD5 55714a05af3b43fdfba3ad6be13a582b
SHA1 ab84f5e8ad653cde8bc2edf323d9a2495445ba0e
SHA512 6231d425cff8b44e088c3872c37d896f30fcf2f5692a6b3199e7abd6a71db4159173a27b4dcc64cf85ceda227911c3d4459ed3ec070709f5dc82962132340a20
TLSH
T11B11F39EBA152C441DA02995E3698301D132F3CF247340E9F263027463CDDAC911F68F
MD5 SHA1 SHA512 TLSH

Submit Download

gh_resp_7de1a16360d24e27815dfb98f542cd76.json

Path C:\Users\Admin\AppData\Local\Temp\gh_resp_7de1a16360d24e27815dfb98f542cd76.json
Size 278B
SHA256 cbacd1d5ced98314639ceabf312bf999da38944b1b90da1cab686ca165d5994d
MD5 13106fa258936d33d103504d553b0868
SHA1 88048c1cf9bbdd06936159be4d8a4c59a46a2a81
SHA512 338d344fbbc45f478b0a39d5aa8eb3ee28de9c5429c483e4dd862764fd75399634680cf724a87893f6fa2f6ab26fc81542ec565aeacf161ae533aca8f039e5e2
TLSH
T102D02B77DC401976B7135047F624D1802765F524E997B52532ECD11C112C531424E616
MD5 SHA1 SHA512 TLSH

Submit Download

CSC83367CF65BE746DFBE7CFA2CECCCB35.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\beu4bgcu\CSC83367CF65BE746DFBE7CFA2CECCCB35.TMP
Size 652B
SHA256 721d80741576d4976394ff1aab6162e53763767ee052af786c96a2cb53f4abf7
MD5 d779c547b5abc85a71f3dd832eccef5c
SHA1 a37e3394a9dd12ee0809660b7f5bd18c26ad5f69
SHA512 27d9996c693041b6f334086f19ade7dd892411a8b3f0dcf655832b2d7bfc5da33e5c671fd90381521425c2766d7fcdbf601cd86930c72609cc6216073633aaad
TLSH
T1F9F0540963F8020EF1F38B30BDF543A39569BC65EE3293ED1840035918645109962F71
MD5 SHA1 SHA512 TLSH

Submit Download

beu4bgcu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\beu4bgcu\beu4bgcu.0.cs
Size 203B
SHA256 7106c4e5438ef83b3ffca35a4e9b942729b8acc71a410541cae249652c1be7f5
MD5 68e83972f00bd91872f2a9c9a19bc159
SHA1 566330facb48499341511923b91f9aba35e7b148
SHA512 38a1af26f58175c9eedd2f7ce350f9853351c56cf91b8ef3a0291e3dd9864f1491003e6259980d52c1f6f85412a7d01d3bc3feedbcad3e6a208016d52ab82bdc
TLSH
T187D023C5C3C58134DC434401DD6E591B57061197432D1930304DF54C0F52548B7FC7D5
MD5 SHA1 SHA512 TLSH

Submit Download

beu4bgcu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\beu4bgcu\beu4bgcu.cmdline
Size 369B
SHA256 8f467df5252e7b68c7eb4a2c18c0ff8fd8cc73a5502ef13a27f8190ca7eafe7e
MD5 ac9fbf273b1a394e6b10f4f24679372f
SHA1 00df2dde95cdcf580f0bbb71a278b5e9918044dd
SHA512 a7f277f429eba847082c5525feb343ab51c1e3a84b253dc73e2eec26a6ef541077d7ae22e0b431695139c04ac8c96967ef98ca0d4d9c091a42e2edc8a5b89ce8
TLSH
T1BFE0C03A4247CAFF51DD1017317AC4ACC2724BDB2B413F845088882DD01F00437D1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4256-8-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-44-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-12-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-13-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-14-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-15-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-16-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-17-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-0-0x00007FFB4844F000-0x00007FFB48450000-memory.dmp

Download

memory/4256-9-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-30-0x0000019AC1FF0000-0x0000019AC1FF8000-memory.dmp

Download

memory/4256-31-0x0000019AC26A0000-0x0000019AC2862000-memory.dmp

Download

memory/4256-11-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-10-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-7-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-5-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-3-0x0000019AC1FA0000-0x0000019AC1FC2000-memory.dmp

Download

memory/4256-36-0x0000019AC2DA0000-0x0000019AC32C8000-memory.dmp

Download

memory/4256-39-0x0000019AC2640000-0x0000019AC265E000-memory.dmp

Download

memory/4256-4-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-40-0x0000019AC2870000-0x0000019AC2922000-memory.dmp

Download

memory/4256-41-0x0000019AC2660000-0x0000019AC266A000-memory.dmp

Download

memory/4256-42-0x0000019AC2930000-0x0000019AC295A000-memory.dmp

Download

memory/4256-43-0x0000019AC2930000-0x0000019AC2954000-memory.dmp

Download

memory/4256-6-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-45-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download

memory/4256-47-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp

Download