Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250207-en - resource tags
- submitted
12/02/2025, 08:16
General
- Target D108928742025.exe
- Size 858KB
- Sample250212-j5626stmax
- SHA256 ce108a4c76c010d33b950d3dc8d4bf3c381ebd94a2d725f473065b47abd43a0c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"C:\Users\Admin\AppData\Local\Temp\D108928742025.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDcyQTgwRUMtRDA2MS00RTZELUJBNEQtODBDNzMyMDhBNkVGfSIgdXNlcmlkPSJ7QjcyQjQ0NjktQjQyQy00RjkxLUI2REItNkIxMzRENjJDQzc3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTA5MEFFQTctRTVDNy00RDU5LTgyQzgtMkU0NTgwQ0E3RjU5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTYyMjEwMzMyIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_m5w5lk34.yx5.ps1
memory/1112-11-0x000000000AE30000-0x000000000AECC000-memory.dmp
memory/1112-15-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/1112-3-0x0000000004F20000-0x0000000004FB2000-memory.dmp
memory/1112-4-0x0000000004ED0000-0x0000000004EDA000-memory.dmp
memory/1112-5-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/1112-6-0x00000000051C0000-0x0000000005298000-memory.dmp
memory/1112-7-0x00000000053C0000-0x00000000053DE000-memory.dmp
memory/1112-8-0x0000000073BBE000-0x0000000073BBF000-memory.dmp
memory/1112-9-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/1112-10-0x0000000002750000-0x00000000027E2000-memory.dmp
memory/1112-0-0x0000000073BBE000-0x0000000073BBF000-memory.dmp
memory/1112-1-0x0000000000530000-0x000000000060C000-memory.dmp
memory/1112-2-0x00000000054D0000-0x0000000005A74000-memory.dmp
memory/2236-12-0x0000000000400000-0x0000000000447000-memory.dmp
memory/2236-14-0x0000000000400000-0x0000000000447000-memory.dmp
memory/2236-65-0x0000000000400000-0x0000000000447000-memory.dmp
memory/2236-63-0x00000000011F0000-0x000000000153A000-memory.dmp
memory/2236-62-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4612-48-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/4612-50-0x00000000074E0000-0x0000000007B5A000-memory.dmp
memory/4612-32-0x00000000055A0000-0x00000000058F4000-memory.dmp
memory/4612-20-0x0000000004CA0000-0x0000000004CC2000-memory.dmp
memory/4612-21-0x0000000004D40000-0x0000000004DA6000-memory.dmp
memory/4612-33-0x0000000005B50000-0x0000000005B6E000-memory.dmp
memory/4612-34-0x0000000005BE0000-0x0000000005C2C000-memory.dmp
memory/4612-46-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/4612-36-0x0000000070070000-0x00000000700BC000-memory.dmp
memory/4612-47-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/4612-17-0x00000000045A0000-0x00000000045D6000-memory.dmp
memory/4612-35-0x0000000006100000-0x0000000006132000-memory.dmp
memory/4612-49-0x0000000006D30000-0x0000000006DD3000-memory.dmp
memory/4612-22-0x0000000005530000-0x0000000005596000-memory.dmp
memory/4612-51-0x0000000006E90000-0x0000000006EAA000-memory.dmp
memory/4612-52-0x0000000006F00000-0x0000000006F0A000-memory.dmp
memory/4612-53-0x0000000007110000-0x00000000071A6000-memory.dmp
memory/4612-54-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/4612-55-0x00000000070C0000-0x00000000070CE000-memory.dmp
memory/4612-56-0x00000000070D0000-0x00000000070E4000-memory.dmp
memory/4612-57-0x00000000071D0000-0x00000000071EA000-memory.dmp
memory/4612-58-0x00000000071B0000-0x00000000071B8000-memory.dmp
memory/4612-61-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/4612-19-0x0000000004DD0000-0x00000000053F8000-memory.dmp
memory/4612-18-0x0000000073BB0000-0x0000000074360000-memory.dmp
memory/4612-16-0x0000000073BBE000-0x0000000073BBF000-memory.dmp