Analysis

  • max time kernel
    107s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2025, 11:21

General

  • Target

    be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e.exe

  • Size

    1.2MB

  • MD5

    498c31b587f16c1263e92a03a8baeb93

  • SHA1

    8c6edd8e32870a3276d2ed246d2311e05764b42d

  • SHA256

    be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e

  • SHA512

    f10fe82ba2a995c77737260c6b0407ae59b97d16fecebeaef5a22ae636197b33fcaf0dacabc925167b6f21a764ee19d34636ecb02194ab5a1e2780151b799f92

  • SSDEEP

    24576:1o7MrTswryb85Fm6lmnr4eKiwMonfJk/WvDHal++UQcOVh9Z:kQ2bcs6cseJwMofqeakQJh9

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e.exe
    "C:\Users\Admin\AppData\Local\Temp\be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xIjdSSf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1744
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xIjdSSf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1648
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:1972
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
          PID:1260
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
            PID:4076
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:812
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:4568

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              3d086a433708053f9bf9523e1d87a4e8

              SHA1

              b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

              SHA256

              6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

              SHA512

              931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              18KB

              MD5

              bdc5fffbf084b134b1988ce584c15b94

              SHA1

              d5f71791f9ef8364c0939f81fa03a477963ef7eb

              SHA256

              deb01feb1eadbf728c097f03bf04263f3c0bde30dd2cf2929a87677057206980

              SHA512

              1cf83511d3500fac4801259f43034c1dede335d6a721f57c1d7779ee54bbf47366be2d443e82187331577b6f2eb708ef2bb76f1435a393472623713f63ee7aca

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sutyqula.quc.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp

              Filesize

              1KB

              MD5

              ee33992f9b95f362b64b902c115220fc

              SHA1

              b7701a795e964f172b7408dee07523c2c64d98df

              SHA256

              9e194e1cb8519b3679c42ee0a5ed240128516cd006f2058f3772ec02a4f0b32c

              SHA512

              79aa48b6090c3c88627902ab8e16e6aa7b55218ac1cf2a84e37436c3533d2ba726b743eaab350aeafb46eab61e6c5f3102618245d23bfc97e1e69ebcc67a82dc

            • memory/1744-73-0x0000000007760000-0x0000000007DDA000-memory.dmp

              Filesize

              6.5MB

            • memory/1744-22-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/1744-84-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/1744-81-0x0000000007430000-0x0000000007438000-memory.dmp

              Filesize

              32KB

            • memory/1744-80-0x0000000007450000-0x000000000746A000-memory.dmp

              Filesize

              104KB

            • memory/1744-77-0x0000000007310000-0x0000000007321000-memory.dmp

              Filesize

              68KB

            • memory/1744-76-0x0000000007390000-0x0000000007426000-memory.dmp

              Filesize

              600KB

            • memory/1744-75-0x0000000007180000-0x000000000718A000-memory.dmp

              Filesize

              40KB

            • memory/1744-63-0x000000006F330000-0x000000006F37C000-memory.dmp

              Filesize

              304KB

            • memory/1744-23-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/3564-47-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/3564-12-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/3564-1-0x00000000006B0000-0x00000000007F0000-memory.dmp

              Filesize

              1.2MB

            • memory/3564-2-0x00000000056A0000-0x0000000005C44000-memory.dmp

              Filesize

              5.6MB

            • memory/3564-7-0x00000000054C0000-0x000000000555C000-memory.dmp

              Filesize

              624KB

            • memory/3564-13-0x00000000070B0000-0x000000000716C000-memory.dmp

              Filesize

              752KB

            • memory/3564-8-0x0000000006480000-0x000000000694C000-memory.dmp

              Filesize

              4.8MB

            • memory/3564-9-0x0000000008620000-0x000000000871E000-memory.dmp

              Filesize

              1016KB

            • memory/3564-4-0x00000000053B0000-0x00000000053BA000-memory.dmp

              Filesize

              40KB

            • memory/3564-3-0x00000000051D0000-0x0000000005262000-memory.dmp

              Filesize

              584KB

            • memory/3564-5-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/3564-10-0x0000000005620000-0x000000000563E000-memory.dmp

              Filesize

              120KB

            • memory/3564-6-0x0000000005C50000-0x0000000005FA4000-memory.dmp

              Filesize

              3.3MB

            • memory/3564-11-0x00000000743FE000-0x00000000743FF000-memory.dmp

              Filesize

              4KB

            • memory/3564-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

              Filesize

              4KB

            • memory/4712-30-0x00000000060A0000-0x0000000006106000-memory.dmp

              Filesize

              408KB

            • memory/4712-78-0x0000000007D60000-0x0000000007D6E000-memory.dmp

              Filesize

              56KB

            • memory/4712-61-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

              Filesize

              120KB

            • memory/4712-50-0x0000000006DD0000-0x0000000006E02000-memory.dmp

              Filesize

              200KB

            • memory/4712-51-0x000000006F330000-0x000000006F37C000-memory.dmp

              Filesize

              304KB

            • memory/4712-74-0x0000000007B30000-0x0000000007B4A000-memory.dmp

              Filesize

              104KB

            • memory/4712-49-0x0000000006830000-0x000000000687C000-memory.dmp

              Filesize

              304KB

            • memory/4712-24-0x0000000005840000-0x0000000005862000-memory.dmp

              Filesize

              136KB

            • memory/4712-62-0x0000000007800000-0x00000000078A3000-memory.dmp

              Filesize

              652KB

            • memory/4712-79-0x0000000007D70000-0x0000000007D84000-memory.dmp

              Filesize

              80KB

            • memory/4712-19-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/4712-31-0x00000000061C0000-0x0000000006226000-memory.dmp

              Filesize

              408KB

            • memory/4712-18-0x0000000002EF0000-0x0000000002F26000-memory.dmp

              Filesize

              216KB

            • memory/4712-48-0x0000000006810000-0x000000000682E000-memory.dmp

              Filesize

              120KB

            • memory/4712-20-0x00000000058C0000-0x0000000005EE8000-memory.dmp

              Filesize

              6.2MB

            • memory/4712-21-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/4712-88-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB