392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2025, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EUNIQ[1].exe
Size 3.0MB
Sample250809-bbdvjafk5x
SHA256 392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72
MD5 12be42cf0a58e850f4989b6f58c93e7e
SHA1 b62b0210af7ace1bc61702006ef29c6e419c5f7d
SHA512 e6a58206c448ed3030170a4d7df8a98a8db27123116733db08d10b9cf05d31f249908e7c76d45946ec2e701cc5a13d922ece3a7277442eb633b56432d4700135
SSDEEP 49152:dcW4fbnyLhseO405FOdbdGESKMlye417u491bKICzmJUPZfPgneVgA:dX4ulsv5oBdFaIe4ph3KIu7VgA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation	EUNIQ[1].tmp

Executes dropped EXE 2 IoCs

pid	Process
384	EUNIQ[1].tmp
3928	EUNIQ[1].tmp

Loads dropped DLL 3 IoCs

pid	Process
3468	regsvr32.exe
3192	regsvr32.exe
2992	regsvr32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3240	PowerShell.exe
2692	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3928	EUNIQ[1].tmp
3928	EUNIQ[1].tmp
3468	regsvr32.exe
3468	regsvr32.exe
3468	regsvr32.exe
3468	regsvr32.exe
2692	powershell.exe
2692	powershell.exe
3240	PowerShell.exe
3240	PowerShell.exe
3192	regsvr32.exe
3192	regsvr32.exe
3192	regsvr32.exe
3192	regsvr32.exe
2992	regsvr32.exe
2992	regsvr32.exe
2992	regsvr32.exe
2992	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeDebugPrivilege	3240	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3240	PowerShell.exe
Token: SeSecurityPrivilege	3240	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3240	PowerShell.exe
Token: SeLoadDriverPrivilege	3240	PowerShell.exe
Token: SeSystemProfilePrivilege	3240	PowerShell.exe
Token: SeSystemtimePrivilege	3240	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3240	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3240	PowerShell.exe
Token: SeCreatePagefilePrivilege	3240	PowerShell.exe
Token: SeBackupPrivilege	3240	PowerShell.exe
Token: SeRestorePrivilege	3240	PowerShell.exe
Token: SeShutdownPrivilege	3240	PowerShell.exe
Token: SeDebugPrivilege	3240	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3240	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3240	PowerShell.exe
Token: SeUndockPrivilege	3240	PowerShell.exe
Token: SeManageVolumePrivilege	3240	PowerShell.exe
Token: 33	3240	PowerShell.exe
Token: 34	3240	PowerShell.exe
Token: 35	3240	PowerShell.exe
Token: 36	3240	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3240	PowerShell.exe
Token: SeSecurityPrivilege	3240	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3240	PowerShell.exe
Token: SeLoadDriverPrivilege	3240	PowerShell.exe
Token: SeSystemProfilePrivilege	3240	PowerShell.exe
Token: SeSystemtimePrivilege	3240	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3240	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3240	PowerShell.exe
Token: SeCreatePagefilePrivilege	3240	PowerShell.exe
Token: SeBackupPrivilege	3240	PowerShell.exe
Token: SeRestorePrivilege	3240	PowerShell.exe
Token: SeShutdownPrivilege	3240	PowerShell.exe
Token: SeDebugPrivilege	3240	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3240	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3240	PowerShell.exe
Token: SeUndockPrivilege	3240	PowerShell.exe
Token: SeManageVolumePrivilege	3240	PowerShell.exe
Token: 33	3240	PowerShell.exe
Token: 34	3240	PowerShell.exe
Token: 35	3240	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3928	EUNIQ[1].tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 384	832	EUNIQ[1].exe	84
PID 832 wrote to memory of 384	832	EUNIQ[1].exe	84
PID 832 wrote to memory of 384	832	EUNIQ[1].exe	84
PID 384 wrote to memory of 3876	384	EUNIQ[1].tmp	85
PID 384 wrote to memory of 3876	384	EUNIQ[1].tmp	85
PID 384 wrote to memory of 3876	384	EUNIQ[1].tmp	85
PID 3876 wrote to memory of 3928	3876	EUNIQ[1].exe	86
PID 3876 wrote to memory of 3928	3876	EUNIQ[1].exe	86
PID 3876 wrote to memory of 3928	3876	EUNIQ[1].exe	86
PID 3928 wrote to memory of 3468	3928	EUNIQ[1].tmp	87
PID 3928 wrote to memory of 3468	3928	EUNIQ[1].tmp	87
PID 3928 wrote to memory of 3468	3928	EUNIQ[1].tmp	87
PID 3468 wrote to memory of 2692	3468	regsvr32.exe	88
PID 3468 wrote to memory of 2692	3468	regsvr32.exe	88
PID 3468 wrote to memory of 2692	3468	regsvr32.exe	88
PID 3468 wrote to memory of 3240	3468	regsvr32.exe	97
PID 3468 wrote to memory of 3240	3468	regsvr32.exe	97
PID 3468 wrote to memory of 3240	3468	regsvr32.exe	97
PID 2208 wrote to memory of 3192	2208	regsvr32.EXE	112
PID 2208 wrote to memory of 3192	2208	regsvr32.EXE	112
PID 2208 wrote to memory of 3192	2208	regsvr32.EXE	112
PID 4308 wrote to memory of 2992	4308	regsvr32.EXE	114
PID 4308 wrote to memory of 2992	4308	regsvr32.EXE	114
PID 4308 wrote to memory of 2992	4308	regsvr32.EXE	114

C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
"C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\is-L75AQ.tmp\EUNIQ[1].tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L75AQ.tmp\EUNIQ[1].tmp" /SL5="$7028E,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
    "C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\is-FBDDM.tmp\EUNIQ[1].tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FBDDM.tmp\EUNIQ[1].tmp" /SL5="$70272,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3468
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx\"' }) { exit 0 } else { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Admin:.repos

Path C:\Users\Admin:.repos
Size 1.2MB
SHA256 15e8be6bdbe4d36fa6c1c8175c95d91f1fe8a1618c5704b029a6cb5d6253bdec
MD5 f34d6b59d2e3cd8d2d38ffda0dd61e1d
SHA1 009294ead4380e5097c0b9fd37b92e3e466bfa66
SHA512 dbeed739c558dd23ea4d8b4adbcdf4750e0f3775183a3ee92e66c44256ff4797e4cfafb8bb61258c73503555e74760ba14d0cc804f7a8450d35bba1b570ff405
SSDEEP 12288:gSGNb1Oa6J0BNO2LAEOf3zxj2CR6caShedZthKm+/4WvYAq0frG3drrYeOnFwiev:tQUJ0POmAEOHaSEdZevvbCVOnFwieerm
MD5 SHA1 SHA512 SSDEEP

Submit Download

9MediumVioletRed.pfx

Path C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx
Size 4.3MB
SHA256 f16cb9989af3303e14ee04f6e094cd6533e6bf9b0783dbf7b9e2024405b0a621
MD5 12177628dfbcd9f04372307405ae958c
SHA1 2a808366a146d162b00909b30593f6df8e697d64
SHA512 23ba0f27dec11a6cb79f566930d9cbe4e95427295cb7c1996216e34e21928ff39e84a4854efa0f9a8878b4b9a24cae0a318633bb5d685fcde7045ee12de002d1
SSDEEP 49152:dfk/1pDYD1SB3dXtCHjCCL/zZHtiz35wmAA5gp:Jk/lftSB/zZHtidwmAMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7
MD5 9751fcb3d8dc82d33d50eebe53abe314
SHA1 7a680212700a5d9f3ca67c81e0e243834387c20c
SHA512 54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 039b08176023fa8a53ee8fae5334f9204c0f2c0429d8f82111d1c224da78d595
MD5 9e900cecfa9e76d15d7e625c8aa2b55b
SHA1 edb35a0bbc9d2f2c4073c3ce9e734f41596672b7
SHA512 82c119e2e68597c03fab66b9d1d9e7407c850a040a96fa072d14cbe652b17a263030255a51caf6be1467492e5d2b4e04b9e7e985954590d8b6979c1a275d97bb
SSDEEP 384:bsf+zY9i+pDIxBBi+WkIo9o93rznK6seY0+aJ/jl3Ko9owf3hE/yTKKbeHB:Aft6ow9o9bznN8AlKJiRE/Ubm
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_hslhixhm.0zg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hslhixhm.0zg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

EUNIQ[1].tmp

Path C:\Users\Admin\AppData\Local\Temp\is-L75AQ.tmp\EUNIQ[1].tmp
Size 2.6MB
SHA256 9467158bf60a31cbfdf60b4df84fe4b1e5afaa0e5016660265becce701a958f6
MD5 eeb922ede4d8cd7a87cf8273dab0fc10
SHA1 7b6ed244722b9ac0ff44948f03d6a41a799822e7
SHA512 d7c33a77be100011cbfd2110164b88706dcb61e43e44005140a551b9b6cfd5ad2cba85780987848470d9f87bec0e609ba4e93bc66ffa2ebde5dd634d7cfa6f5f
SSDEEP 49152:mfFRLtC2Y0SUQYZ4oVrbFoWmBOns67Be0j:mtRLtHVr9mBz6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-5-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/384-10-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/832-12-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/832-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2692-57-0x0000000007C40000-0x0000000007C5A000-memory.dmp

Download

memory/2692-56-0x0000000008290000-0x000000000890A000-memory.dmp

Download

memory/2692-28-0x0000000005850000-0x0000000005872000-memory.dmp

Download

memory/2692-29-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/2692-30-0x00000000061C0000-0x0000000006226000-memory.dmp

Download

memory/2692-26-0x0000000003320000-0x0000000003356000-memory.dmp

Download

memory/2692-40-0x0000000006550000-0x00000000068A4000-memory.dmp

Download

memory/2692-41-0x0000000006900000-0x000000000691E000-memory.dmp

Download

memory/2692-42-0x0000000006940000-0x000000000698C000-memory.dmp

Download

memory/2692-43-0x00000000078B0000-0x00000000078E2000-memory.dmp

Download

memory/2692-44-0x0000000073C30000-0x0000000073C7C000-memory.dmp

Download

memory/2692-54-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

Download

memory/2692-55-0x0000000007B00000-0x0000000007BA3000-memory.dmp

Download

memory/2692-27-0x0000000005AA0000-0x00000000060C8000-memory.dmp

Download

memory/2692-60-0x0000000007E40000-0x0000000007E51000-memory.dmp

Download

memory/2692-58-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Download

memory/2692-59-0x0000000007EC0000-0x0000000007F56000-memory.dmp

Download

memory/3240-74-0x0000000073C30000-0x0000000073C7C000-memory.dmp

Download

memory/3468-86-0x00000000732E0000-0x0000000073723000-memory.dmp

Download

memory/3468-172-0x00000000732E0000-0x0000000073723000-memory.dmp

Download

memory/3468-227-0x00000000732E0000-0x0000000073723000-memory.dmp

Download

memory/3876-25-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3876-8-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3928-23-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/3928-16-0x0000000000980000-0x0000000000981000-memory.dmp

Download