Analysis
- max time kernel
104s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
10/04/2025, 14:30
General
- Target tt.exe
- Size 736KB
- Sample250410-rt8evstq13
- SHA256 ce1cdc18e2f0affe111e30fef5c27dd5bc000625ee49f9e48f298a55c00fe682
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tt.exe"C:\Users\Admin\AppData\Local\Temp\tt.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tt.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\tt.exe"C:\Users\Admin\AppData\Local\Temp\tt.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tt.exe"C:\Users\Admin\AppData\Local\Temp\tt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tsi1zppr.po5.ps1
memory/860-48-0x0000000007990000-0x00000000079AA000-memory.dmp
memory/860-50-0x0000000007C10000-0x0000000007CA6000-memory.dmp
memory/860-58-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/860-55-0x0000000007CB0000-0x0000000007CB8000-memory.dmp
memory/860-54-0x0000000007CD0000-0x0000000007CEA000-memory.dmp
memory/860-53-0x0000000007BD0000-0x0000000007BE4000-memory.dmp
memory/860-52-0x0000000007BC0000-0x0000000007BCE000-memory.dmp
memory/860-51-0x0000000007B90000-0x0000000007BA1000-memory.dmp
memory/860-32-0x0000000006730000-0x000000000677C000-memory.dmp
memory/860-49-0x0000000007A00000-0x0000000007A0A000-memory.dmp
memory/860-47-0x0000000007FD0000-0x000000000864A000-memory.dmp
memory/860-46-0x0000000007680000-0x0000000007723000-memory.dmp
memory/860-14-0x0000000002D40000-0x0000000002D76000-memory.dmp
memory/860-16-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/860-15-0x000000007523E000-0x000000007523F000-memory.dmp
memory/860-17-0x00000000058E0000-0x0000000005F08000-memory.dmp
memory/860-18-0x00000000055B0000-0x00000000055D2000-memory.dmp
memory/860-19-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/860-20-0x0000000006080000-0x00000000060E6000-memory.dmp
memory/860-33-0x0000000006C70000-0x0000000006CA2000-memory.dmp
memory/860-45-0x0000000006C30000-0x0000000006C4E000-memory.dmp
memory/860-31-0x0000000006670000-0x000000000668E000-memory.dmp
memory/860-30-0x00000000061F0000-0x0000000006544000-memory.dmp
memory/860-34-0x0000000071050000-0x000000007109C000-memory.dmp
memory/860-44-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/5188-7-0x00000000054F0000-0x0000000005504000-memory.dmp
memory/5188-8-0x00000000751BE000-0x00000000751BF000-memory.dmp
memory/5188-13-0x00000000751B0000-0x0000000075960000-memory.dmp
memory/5188-3-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/5188-0-0x00000000751BE000-0x00000000751BF000-memory.dmp
memory/5188-10-0x0000000006200000-0x0000000006292000-memory.dmp
memory/5188-1-0x0000000000450000-0x000000000050E000-memory.dmp
memory/5188-9-0x00000000751B0000-0x0000000075960000-memory.dmp
memory/5188-6-0x0000000005180000-0x000000000521C000-memory.dmp
memory/5188-2-0x0000000005500000-0x0000000005AA4000-memory.dmp
memory/5188-5-0x00000000751B0000-0x0000000075960000-memory.dmp
memory/5188-4-0x0000000004F00000-0x0000000004F0A000-memory.dmp
memory/5548-11-0x0000000000400000-0x0000000000447000-memory.dmp
memory/5548-59-0x0000000000400000-0x0000000000447000-memory.dmp
memory/5548-60-0x0000000001320000-0x000000000166A000-memory.dmp
memory/5548-61-0x0000000000400000-0x0000000000447000-memory.dmp