392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2025, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EUNIQ[1].exe
Size 3.0MB
Sample250809-bbdvjafk5x
SHA256 392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72
MD5 12be42cf0a58e850f4989b6f58c93e7e
SHA1 b62b0210af7ace1bc61702006ef29c6e419c5f7d
SHA512 e6a58206c448ed3030170a4d7df8a98a8db27123116733db08d10b9cf05d31f249908e7c76d45946ec2e701cc5a13d922ece3a7277442eb633b56432d4700135
SSDEEP 49152:dcW4fbnyLhseO405FOdbdGESKMlye417u491bKICzmJUPZfPgneVgA:dX4ulsv5oBdFaIe4ph3KIu7VgA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6104	EUNIQ[1].tmp
716	EUNIQ[1].tmp

Loads dropped DLL 3 IoCs

pid	Process
1644	regsvr32.exe
6084	regsvr32.exe
6048	regsvr32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to execute payload.

execution

PowerShell

T1059.001

pid	Process
4080	powershell.exe
3320	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5696	6084	WerFault.exe	88
236	6048	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
716	EUNIQ[1].tmp
716	EUNIQ[1].tmp
1644	regsvr32.exe
1644	regsvr32.exe
1644	regsvr32.exe
1644	regsvr32.exe
4080	powershell.exe
4080	powershell.exe
3320	PowerShell.exe
3320	PowerShell.exe
6084	regsvr32.exe
6084	regsvr32.exe
6048	regsvr32.exe
6048	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeIncreaseQuotaPrivilege	4080	powershell.exe
Token: SeSecurityPrivilege	4080	powershell.exe
Token: SeTakeOwnershipPrivilege	4080	powershell.exe
Token: SeLoadDriverPrivilege	4080	powershell.exe
Token: SeSystemProfilePrivilege	4080	powershell.exe
Token: SeSystemtimePrivilege	4080	powershell.exe
Token: SeProfSingleProcessPrivilege	4080	powershell.exe
Token: SeIncBasePriorityPrivilege	4080	powershell.exe
Token: SeCreatePagefilePrivilege	4080	powershell.exe
Token: SeBackupPrivilege	4080	powershell.exe
Token: SeRestorePrivilege	4080	powershell.exe
Token: SeShutdownPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeSystemEnvironmentPrivilege	4080	powershell.exe
Token: SeRemoteShutdownPrivilege	4080	powershell.exe
Token: SeUndockPrivilege	4080	powershell.exe
Token: SeManageVolumePrivilege	4080	powershell.exe
Token: 33	4080	powershell.exe
Token: 34	4080	powershell.exe
Token: 35	4080	powershell.exe
Token: 36	4080	powershell.exe
Token: SeDebugPrivilege	3320	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3320	PowerShell.exe
Token: SeSecurityPrivilege	3320	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3320	PowerShell.exe
Token: SeLoadDriverPrivilege	3320	PowerShell.exe
Token: SeSystemProfilePrivilege	3320	PowerShell.exe
Token: SeSystemtimePrivilege	3320	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3320	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3320	PowerShell.exe
Token: SeCreatePagefilePrivilege	3320	PowerShell.exe
Token: SeBackupPrivilege	3320	PowerShell.exe
Token: SeRestorePrivilege	3320	PowerShell.exe
Token: SeShutdownPrivilege	3320	PowerShell.exe
Token: SeDebugPrivilege	3320	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3320	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3320	PowerShell.exe
Token: SeUndockPrivilege	3320	PowerShell.exe
Token: SeManageVolumePrivilege	3320	PowerShell.exe
Token: 33	3320	PowerShell.exe
Token: 34	3320	PowerShell.exe
Token: 35	3320	PowerShell.exe
Token: 36	3320	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3320	PowerShell.exe
Token: SeSecurityPrivilege	3320	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3320	PowerShell.exe
Token: SeLoadDriverPrivilege	3320	PowerShell.exe
Token: SeSystemProfilePrivilege	3320	PowerShell.exe
Token: SeSystemtimePrivilege	3320	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3320	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3320	PowerShell.exe
Token: SeCreatePagefilePrivilege	3320	PowerShell.exe
Token: SeBackupPrivilege	3320	PowerShell.exe
Token: SeRestorePrivilege	3320	PowerShell.exe
Token: SeShutdownPrivilege	3320	PowerShell.exe
Token: SeDebugPrivilege	3320	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3320	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3320	PowerShell.exe
Token: SeUndockPrivilege	3320	PowerShell.exe
Token: SeManageVolumePrivilege	3320	PowerShell.exe
Token: 33	3320	PowerShell.exe
Token: 34	3320	PowerShell.exe
Token: 35	3320	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
716	EUNIQ[1].tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 6104	3192	EUNIQ[1].exe	78
PID 3192 wrote to memory of 6104	3192	EUNIQ[1].exe	78
PID 3192 wrote to memory of 6104	3192	EUNIQ[1].exe	78
PID 6104 wrote to memory of 2820	6104	EUNIQ[1].tmp	79
PID 6104 wrote to memory of 2820	6104	EUNIQ[1].tmp	79
PID 6104 wrote to memory of 2820	6104	EUNIQ[1].tmp	79
PID 2820 wrote to memory of 716	2820	EUNIQ[1].exe	80
PID 2820 wrote to memory of 716	2820	EUNIQ[1].exe	80
PID 2820 wrote to memory of 716	2820	EUNIQ[1].exe	80
PID 716 wrote to memory of 1644	716	EUNIQ[1].tmp	81
PID 716 wrote to memory of 1644	716	EUNIQ[1].tmp	81
PID 716 wrote to memory of 1644	716	EUNIQ[1].tmp	81
PID 1644 wrote to memory of 4080	1644	regsvr32.exe	82
PID 1644 wrote to memory of 4080	1644	regsvr32.exe	82
PID 1644 wrote to memory of 4080	1644	regsvr32.exe	82
PID 1644 wrote to memory of 3320	1644	regsvr32.exe	85
PID 1644 wrote to memory of 3320	1644	regsvr32.exe	85
PID 1644 wrote to memory of 3320	1644	regsvr32.exe	85
PID 3484 wrote to memory of 6084	3484	regsvr32.EXE	88
PID 3484 wrote to memory of 6084	3484	regsvr32.EXE	88
PID 3484 wrote to memory of 6084	3484	regsvr32.EXE	88
PID 5428 wrote to memory of 6048	5428	regsvr32.EXE	93
PID 5428 wrote to memory of 6048	5428	regsvr32.EXE	93
PID 5428 wrote to memory of 6048	5428	regsvr32.EXE	93

C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
"C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\is-9K0AB.tmp\EUNIQ[1].tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9K0AB.tmp\EUNIQ[1].tmp" /SL5="$4017E,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
    "C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\is-NDVRD.tmp\EUNIQ[1].tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NDVRD.tmp\EUNIQ[1].tmp" /SL5="$6026A,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx\"' }) { exit 0 } else { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 712
    3⤵
    - Program crash
    PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6084 -ip 6084
1⤵
PID:2384

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 700
    3⤵
    - Program crash
    PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6048 -ip 6048
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Admin:.repos

Path C:\Users\Admin:.repos
Size 1.2MB
SHA256 f749fc86c8782f884047162052e21f01e43bc40d331aa3e1efce1776f3d7f26a
MD5 e2ca48e51e20e2857da11a0eefa9b601
SHA1 179c8b8be2d86ef5ce15215c770c741809a9730f
SHA512 6b967f71642e31f7bb69797e97e22d1745da277e6cf683e287715c95b7e9c0f39a233901c43e4a2281b93633c22ef7ccb497ba1cd51bfb7f9a37075ca0998a97
SSDEEP 12288:7SSNb1Va6J0BNOjLAEOf3zxj2CR6caShedZthKm+/4WvYAq0frG3dr5YeBnFwYez:WE3J0POXAEOHaSEdZevvbCPBnFwYeerK
MD5 SHA1 SHA512 SSDEEP

Submit Download

9MediumVioletRed.pfx

Path C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx
Size 4.3MB
SHA256 f16cb9989af3303e14ee04f6e094cd6533e6bf9b0783dbf7b9e2024405b0a621
MD5 12177628dfbcd9f04372307405ae958c
SHA1 2a808366a146d162b00909b30593f6df8e697d64
SHA512 23ba0f27dec11a6cb79f566930d9cbe4e95427295cb7c1996216e34e21928ff39e84a4854efa0f9a8878b4b9a24cae0a318633bb5d685fcde7045ee12de002d1
SSDEEP 49152:dfk/1pDYD1SB3dXtCHjCCL/zZHtiz35wmAA5gp:Jk/lftSB/zZHtidwmAMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 3f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de
MD5 5dc9a9599fb11ee70f9164d8fea15abf
SHA1 85faf41a206f3fa8b469609333558cf817df2cda
SHA512 499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 300d5828cb931415a3a62923c34aa6e2b8c200876c37e56bdca23430f6beb934
MD5 2f65c488a151b5938fbc06ed7bf1684c
SHA1 29a06efd66252537310062d92806f61d2532a270
SHA512 2e556892ea21c8d7c347b8458188ec1f97837dbfe343506c5b9f1253b6187637feb9fabf12202b8c3e34822e209f2c43e94b608cf072dc4e7f0ae3a0012656ba
SSDEEP 384:3L3HThSS1Lt4g6pxdusKU4+HGXjjs2CFKIvk9BxEfDE1dTlsY4ccjb+cQ:bVSSJmgQduswe2jj7CFKIc9BxEfkdTlD
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ahq4rgaj.gg1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ahq4rgaj.gg1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

EUNIQ[1].tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9K0AB.tmp\EUNIQ[1].tmp
Size 2.6MB
SHA256 9467158bf60a31cbfdf60b4df84fe4b1e5afaa0e5016660265becce701a958f6
MD5 eeb922ede4d8cd7a87cf8273dab0fc10
SHA1 7b6ed244722b9ac0ff44948f03d6a41a799822e7
SHA512 d7c33a77be100011cbfd2110164b88706dcb61e43e44005140a551b9b6cfd5ad2cba85780987848470d9f87bec0e609ba4e93bc66ffa2ebde5dd634d7cfa6f5f
SSDEEP 49152:mfFRLtC2Y0SUQYZ4oVrbFoWmBOns67Be0j:mtRLtHVr9mBz6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/716-17-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/716-21-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/1644-83-0x0000000074E70000-0x00000000752B3000-memory.dmp

Download

memory/1644-219-0x0000000074E70000-0x00000000752B3000-memory.dmp

Download

memory/1644-167-0x0000000074E70000-0x00000000752B3000-memory.dmp

Download

memory/2820-23-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2820-8-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3192-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3192-13-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/3320-72-0x00000000706E0000-0x000000007072C000-memory.dmp

Download

memory/3320-70-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/4080-41-0x00000000065A0000-0x00000000065EC000-memory.dmp

Download

memory/4080-39-0x0000000006090000-0x00000000063E7000-memory.dmp

Download

memory/4080-42-0x0000000006B40000-0x0000000006B74000-memory.dmp

Download

memory/4080-43-0x00000000706E0000-0x000000007072C000-memory.dmp

Download

memory/4080-52-0x0000000007550000-0x000000000756E000-memory.dmp

Download

memory/4080-53-0x0000000007580000-0x0000000007624000-memory.dmp

Download

memory/4080-54-0x0000000007FB0000-0x000000000862A000-memory.dmp

Download

memory/4080-55-0x00000000076D0000-0x00000000076EA000-memory.dmp

Download

memory/4080-56-0x0000000007940000-0x000000000794A000-memory.dmp

Download

memory/4080-57-0x0000000007B70000-0x0000000007C06000-memory.dmp

Download

memory/4080-58-0x0000000007AF0000-0x0000000007B01000-memory.dmp

Download

memory/4080-40-0x0000000006570000-0x000000000658E000-memory.dmp

Download

memory/4080-30-0x0000000006020000-0x0000000006086000-memory.dmp

Download

memory/4080-29-0x0000000005FB0000-0x0000000006016000-memory.dmp

Download

memory/4080-28-0x0000000005E10000-0x0000000005E32000-memory.dmp

Download

memory/4080-27-0x00000000057E0000-0x0000000005E0A000-memory.dmp

Download

memory/4080-26-0x00000000050C0000-0x00000000050F6000-memory.dmp

Download

memory/6048-215-0x0000000074E70000-0x00000000752B3000-memory.dmp

Download

memory/6084-163-0x0000000074E70000-0x00000000752B3000-memory.dmp

Download

memory/6104-10-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/6104-5-0x0000000002760000-0x0000000002761000-memory.dmp

Download