249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
Size

637KB
MD5

b10c024a554e72d81cd2b73fa9221c3c
SHA1

7f0583adc456a1dbae4fafc1831475f844e227a7
SHA256

249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544
SHA512

39ff1f04d7afc319fb5c89891051b621ee25a76adf3171b9212f61f76cfcfcb433187359f6db7ee3141a7722e61884b2edabea929f91c1598813eb08cc998fa7
SSDEEP

12288:tN+qbeco9zUKLorNknrJHbzdOLYyWMkK79EAmD1:fvicoRRo4rJHvdIBWMX9g

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe
860	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
1944	powershell.exe
860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1944	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	31
PID 2832 wrote to memory of 1944	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	31
PID 2832 wrote to memory of 1944	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	31
PID 2832 wrote to memory of 1944	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	31
PID 2832 wrote to memory of 860	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	33
PID 2832 wrote to memory of 860	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	33
PID 2832 wrote to memory of 860	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	33
PID 2832 wrote to memory of 860	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	33
PID 2832 wrote to memory of 3016	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	35
PID 2832 wrote to memory of 3016	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	35
PID 2832 wrote to memory of 3016	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	35
PID 2832 wrote to memory of 3016	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	35
PID 2832 wrote to memory of 1888	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	37
PID 2832 wrote to memory of 1888	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	37
PID 2832 wrote to memory of 1888	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	37
PID 2832 wrote to memory of 1888	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	37
PID 2832 wrote to memory of 1780	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	38
PID 2832 wrote to memory of 1780	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	38
PID 2832 wrote to memory of 1780	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	38
PID 2832 wrote to memory of 1780	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	38
PID 2832 wrote to memory of 2660	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	39
PID 2832 wrote to memory of 2660	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	39
PID 2832 wrote to memory of 2660	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	39
PID 2832 wrote to memory of 2660	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	39
PID 2832 wrote to memory of 3020	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	40
PID 2832 wrote to memory of 3020	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	40
PID 2832 wrote to memory of 3020	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	40
PID 2832 wrote to memory of 3020	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	40
PID 2832 wrote to memory of 2188	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	41
PID 2832 wrote to memory of 2188	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	41
PID 2832 wrote to memory of 2188	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	41
PID 2832 wrote to memory of 2188	2832	249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe	41

C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
"C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qOihAXGWSpFf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qOihAXGWSpFf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF3F.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
  "C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
  "C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
  "C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
  "C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe
  "C:\Users\Admin\AppData\Local\Temp\249416e64c5a1a0044fc082ffcddfe14ce05b9702cf66614560612e61162b544.exe"
  2⤵
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEF3F.tmp

Filesize
1KB

MD5
9375205e3e8c5624b5e805da33e7862d

SHA1
9f30aec004c8f94ec0654126d49be9511a7dbc23

SHA256
a66771c80a15ca252fe2a711d62ce7bb5c99ba76e0ac562184b5640f48e0b4fa

SHA512
90ad7d8c95023ecdb9a0c39148fe75e41e8f28c173ad3c09ddc441e9dbecba6e1750c2cde130a63a73c6c9e25c89b1151369eacad39ad340fa7e934d90672cdc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S3W7CFETQ6C2M40FIXOO.temp

Filesize
7KB

MD5
b332ec5c27353ac86c451d7ba3dcf0ee

SHA1
8c4be1df7fc6c7228a0f7e85be339a65eaf5a9ab

SHA256
95ce2e08402743fd206f36ce31ad5a8b7c1a6c92dcda5a1ac3e2dd8a01718f19

SHA512
19d9b047f1798767f8ccb32e560d250413ddf06f24be2aab8bd46d394a50c4ee5ba6c5566608eb4d54ec6aad40a10cebe62ab906069aab4a2eb01e5b10050080

Download Submit
memory/2832-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2832-1-0x0000000000210000-0x00000000002B6000-memory.dmp

Filesize
664KB

Download
memory/2832-2-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2832-3-0x0000000000680000-0x000000000069E000-memory.dmp

Filesize
120KB

Download
memory/2832-4-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2832-5-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2832-6-0x0000000004400000-0x0000000004462000-memory.dmp

Filesize
392KB

Download
memory/2832-19-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download