Overview
overview
3Static
static
1Diag-MumuNx.ps1
windows10-2004-x64
3Diag-MumuNx.ps1
windows11-ltsc_2024-x64
3SKILL.ps1
windows10-2004-x64
3SKILL.ps1
windows11-ltsc_2024-x64
3Test-MumuTunnelAB.ps1
windows10-2004-x64
3Test-MumuTunnelAB.ps1
windows11-ltsc_2024-x64
3Watch-Mumu...ns.ps1
windows10-2004-x64
3Watch-Mumu...ns.ps1
windows11-ltsc_2024-x64
3bootstrap-update.ps1
windows10-2004-x64
3bootstrap-update.ps1
windows11-ltsc_2024-x64
3mumu-menu.ps1
windows10-2004-x64
3mumu-menu.ps1
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
Diag-MumuNx.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Diag-MumuNx.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
SKILL.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SKILL.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Test-MumuTunnelAB.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Test-MumuTunnelAB.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Watch-MumuConnections.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Watch-MumuConnections.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
bootstrap-update.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
bootstrap-update.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
mumu-menu.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
mumu-menu.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Watch-MumuConnections.ps1
- Size 4KB
- Sample261104-2rm19aeh48
- SHA256 d5226c1033508e779e420bb25ab468040afc000cd210dbed6ee857fa91b30147
- MD5 d12adeb6769e83e99ad86a66d04c4cd0
- SHA1 87d705a837ebf125347ac874372aaf452e0c7413
- SHA512 a70da2a90e507e3b05ec96d871d3a8e58840203619b038c14bbfb6ce43d68c773384953cd1caad67c513433e8fbfe97847b3228b5ca8bc7e851f5c9e0d2aeea9
- SSDEEP 96:JgXPmGpmAZYljrRhPRTLeH2nNDWskhuUCyl2RA:2VmAal5hPRTyuxWhCPRA
- TLSH T11EA1C820FA694A357BDB1067908BD410BB06C03F52296550B4EEE3D45FA6508D0BDF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 5020 powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5020 powershell.exe Token: SeIncreaseQuotaPrivilege 5020 powershell.exe Token: SeSecurityPrivilege 5020 powershell.exe Token: SeTakeOwnershipPrivilege 5020 powershell.exe Token: SeLoadDriverPrivilege 5020 powershell.exe Token: SeSystemProfilePrivilege 5020 powershell.exe Token: SeSystemtimePrivilege 5020 powershell.exe Token: SeProfSingleProcessPrivilege 5020 powershell.exe Token: SeIncBasePriorityPrivilege 5020 powershell.exe Token: SeCreatePagefilePrivilege 5020 powershell.exe Token: SeBackupPrivilege 5020 powershell.exe Token: SeRestorePrivilege 5020 powershell.exe Token: SeShutdownPrivilege 5020 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeSystemEnvironmentPrivilege 5020 powershell.exe Token: SeRemoteShutdownPrivilege 5020 powershell.exe Token: SeUndockPrivilege 5020 powershell.exe Token: SeManageVolumePrivilege 5020 powershell.exe Token: 33 5020 powershell.exe Token: 34 5020 powershell.exe Token: 35 5020 powershell.exe Token: 36 5020 powershell.exe Token: SeIncreaseQuotaPrivilege 5020 powershell.exe Token: SeSecurityPrivilege 5020 powershell.exe Token: SeTakeOwnershipPrivilege 5020 powershell.exe Token: SeLoadDriverPrivilege 5020 powershell.exe Token: SeSystemProfilePrivilege 5020 powershell.exe Token: SeSystemtimePrivilege 5020 powershell.exe Token: SeProfSingleProcessPrivilege 5020 powershell.exe Token: SeIncBasePriorityPrivilege 5020 powershell.exe Token: SeCreatePagefilePrivilege 5020 powershell.exe Token: SeBackupPrivilege 5020 powershell.exe Token: SeRestorePrivilege 5020 powershell.exe Token: SeShutdownPrivilege 5020 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeSystemEnvironmentPrivilege 5020 powershell.exe Token: SeRemoteShutdownPrivilege 5020 powershell.exe Token: SeUndockPrivilege 5020 powershell.exe Token: SeManageVolumePrivilege 5020 powershell.exe Token: 33 5020 powershell.exe Token: 34 5020 powershell.exe Token: 35 5020 powershell.exe Token: 36 5020 powershell.exe Token: SeIncreaseQuotaPrivilege 5020 powershell.exe Token: SeSecurityPrivilege 5020 powershell.exe Token: SeTakeOwnershipPrivilege 5020 powershell.exe Token: SeLoadDriverPrivilege 5020 powershell.exe Token: SeSystemProfilePrivilege 5020 powershell.exe Token: SeSystemtimePrivilege 5020 powershell.exe Token: SeProfSingleProcessPrivilege 5020 powershell.exe Token: SeIncBasePriorityPrivilege 5020 powershell.exe Token: SeCreatePagefilePrivilege 5020 powershell.exe Token: SeBackupPrivilege 5020 powershell.exe Token: SeRestorePrivilege 5020 powershell.exe Token: SeShutdownPrivilege 5020 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeSystemEnvironmentPrivilege 5020 powershell.exe Token: SeRemoteShutdownPrivilege 5020 powershell.exe Token: SeUndockPrivilege 5020 powershell.exe Token: SeManageVolumePrivilege 5020 powershell.exe Token: 33 5020 powershell.exe Token: 34 5020 powershell.exe Token: 35 5020 powershell.exe Token: 36 5020 powershell.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i2hdwzre.bm2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH