Find similar analyses in TI Lookup

Analysis date (UTC): 21 October 2024, 11:26Analysis environment: Windows 10 Pro, build 19045, x64

AcWinRT.ps1

MD5:764C43128170E2762E2B5B8D5FB89800

SHA1:31E232F33AC925B25B26989E0D41667503ED8E65

SHA256:2EC59B8763ADC00F41E18D05C25B425BD212AE788CC00EDA99E9C0CEC5FC2D1E

Analysis result

Threat level:Malicious activity

Tags:

upx

Full analysis:Analysis AcWinRT.ps1 (MD5: 764C43128170E2762E2B5B8D5FB89800) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Bypass execution policy to execute commands

powershell.exe (PID: 5172)
powershell.exe (PID: 1784)
powershell.exe (PID: 5444)
powershell.exe (PID: 1568)
powershell.exe (PID: 7964)
powershell.exe (PID: 7856)
powershell.exe (PID: 8064)
powershell.exe (PID: 4436)
powershell.exe (PID: 7952)
powershell.exe (PID: 4548)
powershell.exe (PID: 6244)

Changes powershell execution policy (Bypass)

AcWinRT.exe (PID: 6132)
powershell.exe (PID: 1784)

Run PowerShell with an invisible window

powershell.exe (PID: 5444)
powershell.exe (PID: 7964)
powershell.exe (PID: 7856)
powershell.exe (PID: 1568)
powershell.exe (PID: 4436)
powershell.exe (PID: 8064)
powershell.exe (PID: 7952)
powershell.exe (PID: 4548)
powershell.exe (PID: 6244)

Deletes shadow copies

powershell.exe (PID: 7952)

SUSPICIOUS

Uses REG/REGEDIT.EXE to modify registry

powershell.exe (PID: 5172)
powershell.exe (PID: 5444)

Executable content was dropped or overwritten

powershell.exe (PID: 5172)

Starts POWERSHELL.EXE for commands execution

AcWinRT.exe (PID: 6132)
powershell.exe (PID: 1784)

The process executes Powershell scripts

AcWinRT.exe (PID: 6132)
powershell.exe (PID: 1784)

Application launched itself

powershell.exe (PID: 1784)

The process hide an interactive prompt from the user

powershell.exe (PID: 1784)

The process bypasses the loading of PowerShell profile settings

powershell.exe (PID: 1784)

Likely accesses (executes) a file from the Public directory

icacls.exe (PID: 7948)
icacls.exe (PID: 7188)

Uses ICACLS.EXE to modify access control lists

powershell.exe (PID: 1568)

INFO

UPX packer has been detected

AcWinRT.exe (PID: 6132)

Threats

No threats detected