392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72

Analysis

max time kernel
150s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
09/08/2025, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EUNIQ[1].exe
Size 3.0MB
Sample250809-bbdvjafk5x
SHA256 392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72
MD5 12be42cf0a58e850f4989b6f58c93e7e
SHA1 b62b0210af7ace1bc61702006ef29c6e419c5f7d
SHA512 e6a58206c448ed3030170a4d7df8a98a8db27123116733db08d10b9cf05d31f249908e7c76d45946ec2e701cc5a13d922ece3a7277442eb633b56432d4700135
SSDEEP 49152:dcW4fbnyLhseO405FOdbdGESKMlye417u491bKICzmJUPZfPgneVgA:dX4ulsv5oBdFaIe4ph3KIu7VgA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2480555372-1462975536-333993236-1000\Control Panel\International\Geo\Nation	EUNIQ[1].tmp

Executes dropped EXE 2 IoCs

pid	Process
4316	EUNIQ[1].tmp
5604	EUNIQ[1].tmp

Loads dropped DLL 3 IoCs

pid	Process
220	regsvr32.exe
5544	regsvr32.exe
5348	regsvr32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to execute payload.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe
5004	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5604	EUNIQ[1].tmp
5604	EUNIQ[1].tmp
220	regsvr32.exe
220	regsvr32.exe
220	regsvr32.exe
220	regsvr32.exe
1028	powershell.exe
1028	powershell.exe
5004	PowerShell.exe
5004	PowerShell.exe
5544	regsvr32.exe
5544	regsvr32.exe
5544	regsvr32.exe
5544	regsvr32.exe
5348	regsvr32.exe
5348	regsvr32.exe
5348	regsvr32.exe
5348	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeIncreaseQuotaPrivilege	1028	powershell.exe
Token: SeSecurityPrivilege	1028	powershell.exe
Token: SeTakeOwnershipPrivilege	1028	powershell.exe
Token: SeLoadDriverPrivilege	1028	powershell.exe
Token: SeSystemProfilePrivilege	1028	powershell.exe
Token: SeSystemtimePrivilege	1028	powershell.exe
Token: SeProfSingleProcessPrivilege	1028	powershell.exe
Token: SeIncBasePriorityPrivilege	1028	powershell.exe
Token: SeCreatePagefilePrivilege	1028	powershell.exe
Token: SeBackupPrivilege	1028	powershell.exe
Token: SeRestorePrivilege	1028	powershell.exe
Token: SeShutdownPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeSystemEnvironmentPrivilege	1028	powershell.exe
Token: SeRemoteShutdownPrivilege	1028	powershell.exe
Token: SeUndockPrivilege	1028	powershell.exe
Token: SeManageVolumePrivilege	1028	powershell.exe
Token: 33	1028	powershell.exe
Token: 34	1028	powershell.exe
Token: 35	1028	powershell.exe
Token: 36	1028	powershell.exe
Token: SeDebugPrivilege	5004	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5004	PowerShell.exe
Token: SeSecurityPrivilege	5004	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5004	PowerShell.exe
Token: SeLoadDriverPrivilege	5004	PowerShell.exe
Token: SeSystemProfilePrivilege	5004	PowerShell.exe
Token: SeSystemtimePrivilege	5004	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5004	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5004	PowerShell.exe
Token: SeCreatePagefilePrivilege	5004	PowerShell.exe
Token: SeBackupPrivilege	5004	PowerShell.exe
Token: SeRestorePrivilege	5004	PowerShell.exe
Token: SeShutdownPrivilege	5004	PowerShell.exe
Token: SeDebugPrivilege	5004	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5004	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5004	PowerShell.exe
Token: SeUndockPrivilege	5004	PowerShell.exe
Token: SeManageVolumePrivilege	5004	PowerShell.exe
Token: 33	5004	PowerShell.exe
Token: 34	5004	PowerShell.exe
Token: 35	5004	PowerShell.exe
Token: 36	5004	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5004	PowerShell.exe
Token: SeSecurityPrivilege	5004	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5004	PowerShell.exe
Token: SeLoadDriverPrivilege	5004	PowerShell.exe
Token: SeSystemProfilePrivilege	5004	PowerShell.exe
Token: SeSystemtimePrivilege	5004	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5004	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5004	PowerShell.exe
Token: SeCreatePagefilePrivilege	5004	PowerShell.exe
Token: SeBackupPrivilege	5004	PowerShell.exe
Token: SeRestorePrivilege	5004	PowerShell.exe
Token: SeShutdownPrivilege	5004	PowerShell.exe
Token: SeDebugPrivilege	5004	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5004	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5004	PowerShell.exe
Token: SeUndockPrivilege	5004	PowerShell.exe
Token: SeManageVolumePrivilege	5004	PowerShell.exe
Token: 33	5004	PowerShell.exe
Token: 34	5004	PowerShell.exe
Token: 35	5004	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5604	EUNIQ[1].tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4316	3740	EUNIQ[1].exe	83
PID 3740 wrote to memory of 4316	3740	EUNIQ[1].exe	83
PID 3740 wrote to memory of 4316	3740	EUNIQ[1].exe	83
PID 4316 wrote to memory of 1952	4316	EUNIQ[1].tmp	84
PID 4316 wrote to memory of 1952	4316	EUNIQ[1].tmp	84
PID 4316 wrote to memory of 1952	4316	EUNIQ[1].tmp	84
PID 1952 wrote to memory of 5604	1952	EUNIQ[1].exe	85
PID 1952 wrote to memory of 5604	1952	EUNIQ[1].exe	85
PID 1952 wrote to memory of 5604	1952	EUNIQ[1].exe	85
PID 5604 wrote to memory of 220	5604	EUNIQ[1].tmp	86
PID 5604 wrote to memory of 220	5604	EUNIQ[1].tmp	86
PID 5604 wrote to memory of 220	5604	EUNIQ[1].tmp	86
PID 220 wrote to memory of 1028	220	regsvr32.exe	87
PID 220 wrote to memory of 1028	220	regsvr32.exe	87
PID 220 wrote to memory of 1028	220	regsvr32.exe	87
PID 220 wrote to memory of 5004	220	regsvr32.exe	94
PID 220 wrote to memory of 5004	220	regsvr32.exe	94
PID 220 wrote to memory of 5004	220	regsvr32.exe	94
PID 2052 wrote to memory of 5544	2052	regsvr32.EXE	101
PID 2052 wrote to memory of 5544	2052	regsvr32.EXE	101
PID 2052 wrote to memory of 5544	2052	regsvr32.EXE	101
PID 4568 wrote to memory of 5348	4568	regsvr32.EXE	103
PID 4568 wrote to memory of 5348	4568	regsvr32.EXE	103
PID 4568 wrote to memory of 5348	4568	regsvr32.EXE	103

C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
"C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\is-8FQE0.tmp\EUNIQ[1].tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8FQE0.tmp\EUNIQ[1].tmp" /SL5="$401F6,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
    "C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\is-ID7AO.tmp\EUNIQ[1].tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ID7AO.tmp\EUNIQ[1].tmp" /SL5="$60254,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx\"' }) { exit 0 } else { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004

C:\Windows\system32\regsvr32.EXE
"C:\Windows\system32\regsvr32.EXE" /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Windows\system32\regsvr32.EXE
"C:\Windows\system32\regsvr32.EXE" /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Admin:.repos

Path C:\Users\Admin:.repos
Size 1.2MB
SHA256 e85b4e442a98a05c30fa5178488c38fa256ac22939aa16246969e825354c6640
MD5 9c4ac4ad79eb0786fe81ba9eb478e92f
SHA1 93b8fcc4bf78ee4402be8f391acee6a870dce37e
SHA512 67c910aa58b18ac641dda4f6cd3f85d4c751539bc4b5f28ae479168040bab25e54a1116959fbc6f1096664e05f96f4b2300fe5ac6597b354c69e74c5b8dbf095
SSDEEP 12288:4SANb15a6J0BNOxLAEOf3zxj2CR6caShedZthKm+/4WvYAq0frG3drFYeCnFwbeG:lWjJ0PO9AEOHaSEdZevvbCzCnFwbeer1
MD5 SHA1 SHA512 SSDEEP

Submit Download

9MediumVioletRed.pfx

Path C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx
Size 4.3MB
SHA256 f16cb9989af3303e14ee04f6e094cd6533e6bf9b0783dbf7b9e2024405b0a621
MD5 12177628dfbcd9f04372307405ae958c
SHA1 2a808366a146d162b00909b30593f6df8e697d64
SHA512 23ba0f27dec11a6cb79f566930d9cbe4e95427295cb7c1996216e34e21928ff39e84a4854efa0f9a8878b4b9a24cae0a318633bb5d685fcde7045ee12de002d1
SSDEEP 49152:dfk/1pDYD1SB3dXtCHjCCL/zZHtiz35wmAA5gp:Jk/lftSB/zZHtidwmAMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 b97b56e7ceecc7fe39522d3989d98bd233353d0269a7f6517e4a8286b4ed1dc4
MD5 f8634c179c1a738e20815ec466527e78
SHA1 5ff99194f001b39289485a6c6fa0ba8b5f50aa42
SHA512 806b40ab4b2cd38140210d1bff3317d51af96008526298aee07e67fa858d5e9646ba594d87a5f22ec5026ee25b93f62d600eb6da92216dfb524b28260fa7388f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 ca20e281b958d0d048bd9ee571a78ce816e568aee882ac12197cd6d28807e9d7
MD5 e0ec972a4f284238e873956ac6da2735
SHA1 e8b51805b377f31f8b05a0dd69def18c4b1d7d77
SHA512 a35921bbcaa93ca5fcdf2d196afca0102a8d524f1f07fee5e518b75905aed14df01dde82944e83ef398cefc2edf95271cc39f2cabfe1e6f8b2b53649d7e84f54
SSDEEP 384:qtfQDzakyvGSe69cs2d9F4Qi3AcN8VXebFCidq01o8njz15hW:afgfyvGC25Ji3AcNHbxfnj3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_lm12q1no.odi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lm12q1no.odi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

EUNIQ[1].tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8FQE0.tmp\EUNIQ[1].tmp
Size 2.6MB
SHA256 9467158bf60a31cbfdf60b4df84fe4b1e5afaa0e5016660265becce701a958f6
MD5 eeb922ede4d8cd7a87cf8273dab0fc10
SHA1 7b6ed244722b9ac0ff44948f03d6a41a799822e7
SHA512 d7c33a77be100011cbfd2110164b88706dcb61e43e44005140a551b9b6cfd5ad2cba85780987848470d9f87bec0e609ba4e93bc66ffa2ebde5dd634d7cfa6f5f
SSDEEP 49152:mfFRLtC2Y0SUQYZ4oVrbFoWmBOns67Be0j:mtRLtHVr9mBz6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-227-0x0000000073FD0000-0x0000000074413000-memory.dmp

Download

memory/220-172-0x0000000073FD0000-0x0000000074413000-memory.dmp

Download

memory/220-86-0x0000000073FD0000-0x0000000074413000-memory.dmp

Download

memory/1028-57-0x00000000070A0000-0x00000000070BA000-memory.dmp

Download

memory/1028-55-0x0000000006FF0000-0x0000000007093000-memory.dmp

Download

memory/1028-27-0x00000000051F0000-0x00000000058BA000-memory.dmp

Download

memory/1028-28-0x0000000004DE0000-0x0000000004E02000-memory.dmp

Download

memory/1028-30-0x0000000004FF0000-0x0000000005056000-memory.dmp

Download

memory/1028-29-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Download

memory/1028-60-0x0000000007280000-0x0000000007291000-memory.dmp

Download

memory/1028-40-0x00000000058C0000-0x0000000005C17000-memory.dmp

Download

memory/1028-41-0x0000000005D20000-0x0000000005D3E000-memory.dmp

Download

memory/1028-42-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Download

memory/1028-43-0x0000000006EE0000-0x0000000006F12000-memory.dmp

Download

memory/1028-44-0x0000000074B60000-0x0000000074BAC000-memory.dmp

Download

memory/1028-54-0x0000000006F20000-0x0000000006F3E000-memory.dmp

Download

memory/1028-26-0x00000000023B0000-0x00000000023E6000-memory.dmp

Download

memory/1028-56-0x0000000007720000-0x0000000007D9A000-memory.dmp

Download

memory/1028-59-0x0000000007350000-0x00000000073E6000-memory.dmp

Download

memory/1028-58-0x00000000070F0000-0x00000000070FA000-memory.dmp

Download

memory/1952-25-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/1952-8-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3740-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3740-12-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4316-10-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/4316-5-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/5004-74-0x0000000074B60000-0x0000000074BAC000-memory.dmp

Download

memory/5604-23-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/5604-16-0x0000000000860000-0x0000000000861000-memory.dmp

Download