392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2025, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EUNIQ[1].exe
Size 3.0MB
Sample250809-bf1j4az1dw
SHA256 392f0069054e6f7e1a7a6bbf6128c7bb03833fc87083fac04c1154cdca133b72
MD5 12be42cf0a58e850f4989b6f58c93e7e
SHA1 b62b0210af7ace1bc61702006ef29c6e419c5f7d
SHA512 e6a58206c448ed3030170a4d7df8a98a8db27123116733db08d10b9cf05d31f249908e7c76d45946ec2e701cc5a13d922ece3a7277442eb633b56432d4700135
SSDEEP 49152:dcW4fbnyLhseO405FOdbdGESKMlye417u491bKICzmJUPZfPgneVgA:dX4ulsv5oBdFaIe4ph3KIu7VgA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
276	EUNIQ[1].tmp
5276	EUNIQ[1].tmp

Loads dropped DLL 3 IoCs

pid	Process
1344	regsvr32.exe
5332	regsvr32.exe
1544	regsvr32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to execute payload.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe
4936	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2000	5332	WerFault.exe	88
1668	1544	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EUNIQ[1].tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5276	EUNIQ[1].tmp
5276	EUNIQ[1].tmp
1344	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe
1180	powershell.exe
1180	powershell.exe
4936	PowerShell.exe
4936	PowerShell.exe
5332	regsvr32.exe
5332	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeIncreaseQuotaPrivilege	1180	powershell.exe
Token: SeSecurityPrivilege	1180	powershell.exe
Token: SeTakeOwnershipPrivilege	1180	powershell.exe
Token: SeLoadDriverPrivilege	1180	powershell.exe
Token: SeSystemProfilePrivilege	1180	powershell.exe
Token: SeSystemtimePrivilege	1180	powershell.exe
Token: SeProfSingleProcessPrivilege	1180	powershell.exe
Token: SeIncBasePriorityPrivilege	1180	powershell.exe
Token: SeCreatePagefilePrivilege	1180	powershell.exe
Token: SeBackupPrivilege	1180	powershell.exe
Token: SeRestorePrivilege	1180	powershell.exe
Token: SeShutdownPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeSystemEnvironmentPrivilege	1180	powershell.exe
Token: SeRemoteShutdownPrivilege	1180	powershell.exe
Token: SeUndockPrivilege	1180	powershell.exe
Token: SeManageVolumePrivilege	1180	powershell.exe
Token: 33	1180	powershell.exe
Token: 34	1180	powershell.exe
Token: 35	1180	powershell.exe
Token: 36	1180	powershell.exe
Token: SeDebugPrivilege	4936	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4936	PowerShell.exe
Token: SeSecurityPrivilege	4936	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4936	PowerShell.exe
Token: SeLoadDriverPrivilege	4936	PowerShell.exe
Token: SeSystemProfilePrivilege	4936	PowerShell.exe
Token: SeSystemtimePrivilege	4936	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4936	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4936	PowerShell.exe
Token: SeCreatePagefilePrivilege	4936	PowerShell.exe
Token: SeBackupPrivilege	4936	PowerShell.exe
Token: SeRestorePrivilege	4936	PowerShell.exe
Token: SeShutdownPrivilege	4936	PowerShell.exe
Token: SeDebugPrivilege	4936	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4936	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4936	PowerShell.exe
Token: SeUndockPrivilege	4936	PowerShell.exe
Token: SeManageVolumePrivilege	4936	PowerShell.exe
Token: 33	4936	PowerShell.exe
Token: 34	4936	PowerShell.exe
Token: 35	4936	PowerShell.exe
Token: 36	4936	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4936	PowerShell.exe
Token: SeSecurityPrivilege	4936	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4936	PowerShell.exe
Token: SeLoadDriverPrivilege	4936	PowerShell.exe
Token: SeSystemProfilePrivilege	4936	PowerShell.exe
Token: SeSystemtimePrivilege	4936	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4936	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4936	PowerShell.exe
Token: SeCreatePagefilePrivilege	4936	PowerShell.exe
Token: SeBackupPrivilege	4936	PowerShell.exe
Token: SeRestorePrivilege	4936	PowerShell.exe
Token: SeShutdownPrivilege	4936	PowerShell.exe
Token: SeDebugPrivilege	4936	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4936	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4936	PowerShell.exe
Token: SeUndockPrivilege	4936	PowerShell.exe
Token: SeManageVolumePrivilege	4936	PowerShell.exe
Token: 33	4936	PowerShell.exe
Token: 34	4936	PowerShell.exe
Token: 35	4936	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5276	EUNIQ[1].tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5440 wrote to memory of 276	5440	EUNIQ[1].exe	78
PID 5440 wrote to memory of 276	5440	EUNIQ[1].exe	78
PID 5440 wrote to memory of 276	5440	EUNIQ[1].exe	78
PID 276 wrote to memory of 4444	276	EUNIQ[1].tmp	79
PID 276 wrote to memory of 4444	276	EUNIQ[1].tmp	79
PID 276 wrote to memory of 4444	276	EUNIQ[1].tmp	79
PID 4444 wrote to memory of 5276	4444	EUNIQ[1].exe	80
PID 4444 wrote to memory of 5276	4444	EUNIQ[1].exe	80
PID 4444 wrote to memory of 5276	4444	EUNIQ[1].exe	80
PID 5276 wrote to memory of 1344	5276	EUNIQ[1].tmp	81
PID 5276 wrote to memory of 1344	5276	EUNIQ[1].tmp	81
PID 5276 wrote to memory of 1344	5276	EUNIQ[1].tmp	81
PID 1344 wrote to memory of 1180	1344	regsvr32.exe	82
PID 1344 wrote to memory of 1180	1344	regsvr32.exe	82
PID 1344 wrote to memory of 1180	1344	regsvr32.exe	82
PID 1344 wrote to memory of 4936	1344	regsvr32.exe	85
PID 1344 wrote to memory of 4936	1344	regsvr32.exe	85
PID 1344 wrote to memory of 4936	1344	regsvr32.exe	85
PID 3260 wrote to memory of 5332	3260	regsvr32.EXE	88
PID 3260 wrote to memory of 5332	3260	regsvr32.EXE	88
PID 3260 wrote to memory of 5332	3260	regsvr32.EXE	88
PID 5484 wrote to memory of 1544	5484	regsvr32.EXE	93
PID 5484 wrote to memory of 1544	5484	regsvr32.EXE	93
PID 5484 wrote to memory of 1544	5484	regsvr32.EXE	93

C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
"C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Users\Admin\AppData\Local\Temp\is-DM29R.tmp\EUNIQ[1].tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DM29R.tmp\EUNIQ[1].tmp" /SL5="$5006C,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe
    "C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\is-BBVMF.tmp\EUNIQ[1].tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BBVMF.tmp\EUNIQ[1].tmp" /SL5="$6006C,2403327,909824,C:\Users\Admin\AppData\Local\Temp\EUNIQ[1].exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx\"' }) { exit 0 } else { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 700
    3⤵
    - Program crash
    PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5332 -ip 5332
1⤵
PID:844

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 704
    3⤵
    - Program crash
    PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1544 -ip 1544
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Admin:.repos

Path C:\Users\Admin:.repos
Size 1.2MB
SHA256 5a23f2ca8ae5cbc1d4fa6a38774681d03a26e402a088efd477c5565ce87db422
MD5 60cc33f19b893540d6bf3b62113f10f3
SHA1 511a2d730801426f05675545faff87686c5c59a7
SHA512 7b97d3c398802488c06420ffedcd1fa7b86f40891eacdb57ca1ef11220e5a304891f9769f1fb8cf431e92f16c249075ed481db0924dcbd4ab7ab48bb6b4dc30e
SSDEEP 12288:YScNb12a6J0BNOULAEOf3zxj2CR6caShedZthKm+/4WvYAq0frG3dr5YednFwIeq:F6MJ0POkAEOHaSEdZevvbCvdnFwIeerV
MD5 SHA1 SHA512 SSDEEP

Submit Download

9MediumVioletRed.pfx

Path C:\Users\Admin\AppData\Local\9MediumVioletRed.pfx
Size 4.3MB
SHA256 f16cb9989af3303e14ee04f6e094cd6533e6bf9b0783dbf7b9e2024405b0a621
MD5 12177628dfbcd9f04372307405ae958c
SHA1 2a808366a146d162b00909b30593f6df8e697d64
SHA512 23ba0f27dec11a6cb79f566930d9cbe4e95427295cb7c1996216e34e21928ff39e84a4854efa0f9a8878b4b9a24cae0a318633bb5d685fcde7045ee12de002d1
SSDEEP 49152:dfk/1pDYD1SB3dXtCHjCCL/zZHtiz35wmAA5gp:Jk/lftSB/zZHtidwmAMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 3f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de
MD5 5dc9a9599fb11ee70f9164d8fea15abf
SHA1 85faf41a206f3fa8b469609333558cf817df2cda
SHA512 499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 d5a58aabe413efbf4324c93c7cf93a3cc486637e86d1d287a0664f42984bf4cb
MD5 43508a8cf80419c6ed44edd437894608
SHA1 58b1e5747262fe0b8e2d2cb2c6d82dc46188e841
SHA512 3d17cf6668fe0ec8661ad9855d058d7ecda2f3bf555a2be2c2fb26fdc49686f1d01a7bc50739dafe4bf4b32c72bb8bc00b699c3a8375156334ca9e2986ac8ff1
SSDEEP 384:PL3HTa1SS11B3X/6FRHEMElqnEW9aisjs2CFK8vk9BhEfDE1dTZsYMccjb5Q:zSSS9/6RPEOEVtj7CFK8c9BhEfUdTZhV
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_y2iuz0fc.45d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2iuz0fc.45d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

EUNIQ[1].tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DM29R.tmp\EUNIQ[1].tmp
Size 2.6MB
SHA256 9467158bf60a31cbfdf60b4df84fe4b1e5afaa0e5016660265becce701a958f6
MD5 eeb922ede4d8cd7a87cf8273dab0fc10
SHA1 7b6ed244722b9ac0ff44948f03d6a41a799822e7
SHA512 d7c33a77be100011cbfd2110164b88706dcb61e43e44005140a551b9b6cfd5ad2cba85780987848470d9f87bec0e609ba4e93bc66ffa2ebde5dd634d7cfa6f5f
SSDEEP 49152:mfFRLtC2Y0SUQYZ4oVrbFoWmBOns67Be0j:mtRLtHVr9mBz6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/276-5-0x0000000002770000-0x0000000002771000-memory.dmp

Download

memory/276-10-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/1180-41-0x0000000005C00000-0x0000000005C4C000-memory.dmp

Download

memory/1180-54-0x0000000007570000-0x0000000007BEA000-memory.dmp

Download

memory/1180-26-0x0000000004710000-0x0000000004746000-memory.dmp

Download

memory/1180-27-0x0000000004ED0000-0x00000000054FA000-memory.dmp

Download

memory/1180-28-0x0000000004D00000-0x0000000004D22000-memory.dmp

Download

memory/1180-29-0x0000000004DB0000-0x0000000004E16000-memory.dmp

Download

memory/1180-30-0x0000000004E20000-0x0000000004E86000-memory.dmp

Download

memory/1180-58-0x0000000007140000-0x0000000007151000-memory.dmp

Download

memory/1180-39-0x00000000056A0000-0x00000000059F7000-memory.dmp

Download

memory/1180-40-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

Download

memory/1180-57-0x00000000071D0000-0x0000000007266000-memory.dmp

Download

memory/1180-42-0x0000000006BA0000-0x0000000006BD4000-memory.dmp

Download

memory/1180-43-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/1180-52-0x00000000061B0000-0x00000000061CE000-memory.dmp

Download

memory/1180-53-0x0000000006BE0000-0x0000000006C84000-memory.dmp

Download

memory/1180-56-0x0000000006FA0000-0x0000000006FAA000-memory.dmp

Download

memory/1180-55-0x0000000006F30000-0x0000000006F4A000-memory.dmp

Download

memory/1344-227-0x0000000074D30000-0x0000000075173000-memory.dmp

Download

memory/1344-171-0x0000000074D30000-0x0000000075173000-memory.dmp

Download

memory/1344-83-0x0000000074D30000-0x0000000075173000-memory.dmp

Download

memory/1544-223-0x0000000074D30000-0x0000000075173000-memory.dmp

Download

memory/4444-8-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4444-23-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4936-67-0x00000000054E0000-0x0000000005837000-memory.dmp

Download

memory/4936-72-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/5276-16-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/5276-21-0x0000000000400000-0x00000000006A6000-memory.dmp

Download

memory/5332-166-0x0000000074D30000-0x0000000075173000-memory.dmp

Download

memory/5440-12-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5440-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download