Analysis
- max time kernel
124s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
06/02/2025, 06:52
General
- Target 43d8dd38914c19560b04e0de6f79d196.exe
- Size 869KB
- Sample250206-hm57gsynap
- SHA256 d1492c1b794e9e2825ab8c8dc030b73b18abe9b0c56a563edda6c9cb82921dfd
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mqlFeGpZ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mqlFeGpZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"C:\Users\Admin\AppData\Local\Temp\43d8dd38914c19560b04e0de6f79d196.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4s5jx13a.suh.ps1
tmpBD83.tmp
memory/1084-74-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-60-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-2116-0x0000000005430000-0x000000000547C000-memory.dmp
memory/1084-2115-0x00000000052C0000-0x00000000052EC000-memory.dmp
memory/1084-47-0x00000000051C0000-0x0000000005258000-memory.dmp
memory/1084-49-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-52-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-54-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-56-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-58-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-64-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-62-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-70-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-76-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-90-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-68-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-86-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-45-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1084-72-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-50-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-102-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-110-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-108-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-106-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-104-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-100-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-98-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-96-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-94-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-92-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-88-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-66-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-84-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-82-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-80-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/1084-78-0x00000000051C0000-0x0000000005251000-memory.dmp
memory/4740-498-0x0000000005C90000-0x0000000005CDC000-memory.dmp
memory/4740-2151-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4740-2148-0x0000000007240000-0x0000000007248000-memory.dmp
memory/4740-44-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4740-2147-0x0000000007260000-0x000000000727A000-memory.dmp
memory/4740-2146-0x0000000007160000-0x0000000007174000-memory.dmp
memory/4740-2145-0x0000000007150000-0x000000000715E000-memory.dmp
memory/4740-21-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4740-2144-0x0000000007120000-0x0000000007131000-memory.dmp
memory/4740-2133-0x00000000071A0000-0x0000000007236000-memory.dmp
memory/4740-494-0x0000000005BF0000-0x0000000005C0E000-memory.dmp
memory/4740-2132-0x0000000006F90000-0x0000000006F9A000-memory.dmp
memory/4740-2130-0x0000000007570000-0x0000000007BEA000-memory.dmp
memory/4740-2131-0x0000000006F20000-0x0000000006F3A000-memory.dmp
memory/4740-2129-0x0000000006DF0000-0x0000000006E93000-memory.dmp
memory/4740-2128-0x0000000006BC0000-0x0000000006BDE000-memory.dmp
memory/4740-34-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4740-2117-0x0000000006B80000-0x0000000006BB2000-memory.dmp
memory/4740-2118-0x0000000075B90000-0x0000000075BDC000-memory.dmp
memory/4776-16-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4776-17-0x0000000004ED0000-0x00000000054F8000-memory.dmp
memory/4776-2155-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4776-33-0x00000000057D0000-0x0000000005B24000-memory.dmp
memory/4776-22-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/4776-23-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/4776-20-0x0000000004E10000-0x0000000004E32000-memory.dmp
memory/4776-18-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4776-2134-0x0000000075B90000-0x0000000075BDC000-memory.dmp
memory/4776-15-0x00000000024E0000-0x0000000002516000-memory.dmp
memory/4792-8-0x00000000752EE000-0x00000000752EF000-memory.dmp
memory/4792-10-0x00000000076D0000-0x0000000007774000-memory.dmp
memory/4792-9-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4792-4-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4792-0-0x00000000752EE000-0x00000000752EF000-memory.dmp
memory/4792-6-0x0000000004E70000-0x0000000004F0C000-memory.dmp
memory/4792-3-0x0000000004C30000-0x0000000004CC2000-memory.dmp
memory/4792-5-0x0000000004C10000-0x0000000004C1A000-memory.dmp
memory/4792-2-0x00000000051E0000-0x0000000005784000-memory.dmp
memory/4792-1-0x0000000000140000-0x000000000021E000-memory.dmp
memory/4792-48-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4792-7-0x0000000005050000-0x000000000506A000-memory.dmp