Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
08/04/2025, 08:36
General
- Target 69751b0b812a765001e8b190751083a3091f8a95fb17be0cddcdf69dfd814804.exe
- Size 847KB
- Sample250408-khxewssset
- SHA256 69751b0b812a765001e8b190751083a3091f8a95fb17be0cddcdf69dfd814804
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69751b0b812a765001e8b190751083a3091f8a95fb17be0cddcdf69dfd814804.exe"C:\Users\Admin\AppData\Local\Temp\69751b0b812a765001e8b190751083a3091f8a95fb17be0cddcdf69dfd814804.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tsDOrvOguGh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tsDOrvOguGh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp990.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yy10gbqd.yev.ps1
tmp990.tmp
memory/1020-77-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-31-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-2133-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/1020-2106-0x0000000005470000-0x000000000549C000-memory.dmp
memory/1020-2107-0x00000000054A0000-0x00000000054EC000-memory.dmp
memory/1020-28-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-29-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-33-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-35-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-39-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-41-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-43-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-45-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-47-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-51-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-55-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-57-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-25-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1020-61-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-53-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-49-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-37-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-27-0x00000000052F0000-0x0000000005388000-memory.dmp
memory/1020-59-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-63-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-75-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-91-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-79-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/1020-65-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-89-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-87-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-67-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-69-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-85-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-83-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-81-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-71-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1020-73-0x00000000052F0000-0x0000000005381000-memory.dmp
memory/1740-10-0x0000000006480000-0x0000000006524000-memory.dmp
memory/1740-3-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/1740-4-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/1740-5-0x00000000051F0000-0x00000000051FA000-memory.dmp
memory/1740-271-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/1740-6-0x00000000052E0000-0x000000000537C000-memory.dmp
memory/1740-8-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/1740-1-0x0000000000570000-0x000000000064A000-memory.dmp
memory/1740-7-0x0000000005540000-0x0000000005558000-memory.dmp
memory/1740-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/1740-9-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/1740-2-0x0000000005560000-0x0000000005B04000-memory.dmp
memory/5960-20-0x0000000005650000-0x0000000005672000-memory.dmp
memory/5960-2120-0x0000000007900000-0x00000000079A3000-memory.dmp
memory/5960-15-0x0000000005190000-0x00000000051C6000-memory.dmp
memory/5960-16-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/5960-19-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/5960-22-0x0000000006090000-0x00000000060F6000-memory.dmp
memory/5960-26-0x0000000006100000-0x0000000006454000-memory.dmp
memory/5960-23-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/5960-21-0x0000000005E30000-0x0000000005E96000-memory.dmp
memory/5960-403-0x0000000006710000-0x000000000672E000-memory.dmp
memory/5960-2109-0x0000000075360000-0x00000000753AC000-memory.dmp
memory/5960-2119-0x0000000006CC0000-0x0000000006CDE000-memory.dmp
memory/5960-2108-0x00000000076C0000-0x00000000076F2000-memory.dmp
memory/5960-17-0x0000000005800000-0x0000000005E28000-memory.dmp
memory/5960-2121-0x0000000008070000-0x00000000086EA000-memory.dmp
memory/5960-2122-0x0000000007A30000-0x0000000007A4A000-memory.dmp
memory/5960-2123-0x0000000007AA0000-0x0000000007AAA000-memory.dmp
memory/5960-2124-0x0000000007CB0000-0x0000000007D46000-memory.dmp
memory/5960-2125-0x0000000007C30000-0x0000000007C41000-memory.dmp
memory/5960-2126-0x0000000007C60000-0x0000000007C6E000-memory.dmp
memory/5960-2127-0x0000000007C70000-0x0000000007C84000-memory.dmp
memory/5960-2128-0x0000000007D70000-0x0000000007D8A000-memory.dmp
memory/5960-2129-0x0000000007D50000-0x0000000007D58000-memory.dmp
memory/5960-2132-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/5960-404-0x0000000006730000-0x000000000677C000-memory.dmp