Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
24/08/2025, 07:29
General
- Target SecuriteInfo.com.Win32.MalwareX-gen.47757812.exe
- Size 1.6MB
- Sample250824-ja882seq2z
- SHA256 3e62c839ff25262272f603a089ecccf728a43183bf31459c834f36c71ab8b0cc
Malware Config
Signatures
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.47757812.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.47757812.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAE0AYQBsAHcAYQByAGUAWAAtAGcAZQBuAC4ANAA3ADcANQA3ADgAMQAyAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQBjAHUAcgBpAHQAZQBJAG4AZgBvAC4AYwBvAG0ALgBXAGkAbgAzADIALgBNAGEAbAB3AGEAcgBlAFgALQBnAGUAbgAuADQANwA3ADUANwA4ADEAMgAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAG0AYgBlAHIATgBhAG0AZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGUAbQBiAGUAcgBOAGEAbQBlAC4AZQB4AGUA2⤵
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ptxog1ct.h2h.ps1
memory/3304-2331-0x0000000005680000-0x0000000005688000-memory.dmp
memory/3304-2330-0x00000000059E0000-0x0000000005B22000-memory.dmp
memory/3304-2329-0x0000000005810000-0x000000000589E000-memory.dmp
memory/3304-2328-0x0000000005690000-0x00000000056A0000-memory.dmp
memory/3304-2326-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/3796-115-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-49-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-117-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-83-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-81-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-79-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-77-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-75-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-73-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-71-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-69-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-67-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-65-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-61-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-59-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-55-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-53-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-51-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-109-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-47-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-45-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-43-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-63-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-39-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-37-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-35-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-31-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-29-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-27-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-23-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-21-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-19-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-17-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-13-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-111-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-9-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-7-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-5-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-4-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-25-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-15-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-123-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-129-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-127-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-121-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-119-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-0-0x0000000000330000-0x00000000004DA000-memory.dmp
memory/3796-113-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-11-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-125-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-1-0x0000000004FD0000-0x0000000005174000-memory.dmp
memory/3796-105-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-103-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-101-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-99-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-97-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-95-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-93-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-91-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-89-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-87-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-85-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-2274-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/3796-2275-0x00000000053D0000-0x0000000005496000-memory.dmp
memory/3796-2276-0x0000000005300000-0x00000000053C4000-memory.dmp
memory/3796-2277-0x00000000054F0000-0x000000000553C000-memory.dmp
memory/3796-2-0x0000000005720000-0x0000000005CC4000-memory.dmp
memory/3796-3-0x0000000005220000-0x00000000052B2000-memory.dmp
memory/3796-2327-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/3796-33-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-41-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-107-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/3796-57-0x0000000004FD0000-0x000000000516E000-memory.dmp
memory/4692-2280-0x00000000050B0000-0x00000000056D8000-memory.dmp
memory/4692-2314-0x0000000007180000-0x000000000718A000-memory.dmp
memory/4692-2295-0x0000000005E20000-0x0000000005E6C000-memory.dmp
memory/4692-2296-0x000000007F7B0000-0x000000007F7C0000-memory.dmp
memory/4692-2297-0x0000000006DB0000-0x0000000006DE2000-memory.dmp
memory/4692-2298-0x0000000070710000-0x000000007075C000-memory.dmp
memory/4692-2309-0x0000000004A70000-0x0000000004A80000-memory.dmp
memory/4692-2308-0x0000000004A70000-0x0000000004A80000-memory.dmp
memory/4692-2310-0x00000000063C0000-0x00000000063DE000-memory.dmp
memory/4692-2311-0x0000000006FF0000-0x0000000007093000-memory.dmp
memory/4692-2312-0x0000000007760000-0x0000000007DDA000-memory.dmp
memory/4692-2293-0x0000000005830000-0x0000000005B84000-memory.dmp
memory/4692-2283-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/4692-2316-0x0000000007310000-0x0000000007321000-memory.dmp
memory/4692-2313-0x0000000007110000-0x000000000712A000-memory.dmp
memory/4692-2317-0x0000000007340000-0x000000000734E000-memory.dmp
memory/4692-2318-0x0000000007350000-0x0000000007364000-memory.dmp
memory/4692-2315-0x0000000007390000-0x0000000007426000-memory.dmp
memory/4692-2320-0x0000000007430000-0x0000000007438000-memory.dmp
memory/4692-2282-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/4692-2281-0x0000000004F20000-0x0000000004F42000-memory.dmp
memory/4692-2319-0x0000000007450000-0x000000000746A000-memory.dmp
memory/4692-2279-0x00000000024B0000-0x00000000024E6000-memory.dmp
memory/4692-2278-0x0000000004A70000-0x0000000004A80000-memory.dmp
memory/4692-2294-0x0000000005DF0000-0x0000000005E0E000-memory.dmp