Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251229-en - resource tags
- submitted
16/01/2026, 11:52
General
- Target SİPARİŞ FORMU 16-01-2026_xlsx.exe
- Size 1.0MB
- Sample260116-n14hpsft4f
- SHA256 9a0d20eec0a1e89a656a76aee82bf0619d8b83a0b445e095de190436dd110f42
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SİPARİŞ FORMU 16-01-2026_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\SİPARİŞ FORMU 16-01-2026_xlsx.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SİPARİŞ FORMU 16-01-2026_xlsx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 18042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4872 -ip 48721⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1j5lzaxg.npy.ps1
memory/2108-28-0x0000000005AC0000-0x0000000005ADE000-memory.dmp
memory/2108-51-0x0000000006E10000-0x0000000006E2A000-memory.dmp
memory/2108-58-0x0000000007150000-0x0000000007158000-memory.dmp
memory/2108-57-0x0000000007160000-0x000000000717A000-memory.dmp
memory/2108-56-0x0000000007060000-0x0000000007075000-memory.dmp
memory/2108-55-0x0000000007050000-0x000000000705E000-memory.dmp
memory/2108-54-0x0000000007020000-0x0000000007031000-memory.dmp
memory/2108-53-0x00000000070A0000-0x0000000007136000-memory.dmp
memory/2108-15-0x00000000022A0000-0x00000000022B0000-memory.dmp
memory/2108-52-0x0000000006E90000-0x0000000006E9A000-memory.dmp
memory/2108-14-0x0000000002320000-0x0000000002356000-memory.dmp
memory/2108-17-0x0000000004DF0000-0x000000000541A000-memory.dmp
memory/2108-18-0x0000000004D20000-0x0000000004D42000-memory.dmp
memory/2108-19-0x0000000005510000-0x0000000005576000-memory.dmp
memory/2108-20-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/2108-29-0x0000000005B10000-0x0000000005B5C000-memory.dmp
memory/2108-27-0x00000000056E0000-0x0000000005A37000-memory.dmp
memory/2108-50-0x0000000007460000-0x0000000007ADA000-memory.dmp
memory/2108-49-0x0000000006AE0000-0x0000000006B84000-memory.dmp
memory/2108-41-0x000000006F620000-0x000000006F66C000-memory.dmp
memory/2108-16-0x00000000022A0000-0x00000000022B0000-memory.dmp
memory/2108-48-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/2108-40-0x0000000006A90000-0x0000000006AC4000-memory.dmp
memory/3120-31-0x00000278C91A0000-0x00000278C91B0000-memory.dmp
memory/3120-38-0x00000278C9140000-0x00000278C9162000-memory.dmp
memory/3120-30-0x00000278C91A0000-0x00000278C91B0000-memory.dmp
memory/3120-62-0x00000278C91A0000-0x00000278C91B0000-memory.dmp
memory/3120-61-0x00000278C91A0000-0x00000278C91B0000-memory.dmp
memory/3120-39-0x00000278E1690000-0x00000278E16D6000-memory.dmp
memory/4872-8-0x0000000007000000-0x00000000070D8000-memory.dmp
memory/4872-9-0x00000000071B0000-0x000000000724C000-memory.dmp
memory/4872-1-0x0000000005DF0000-0x0000000006396000-memory.dmp
memory/4872-6-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/4872-5-0x0000000006F90000-0x0000000006FB4000-memory.dmp
memory/4872-4-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/4872-3-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/4872-0-0x0000000000D80000-0x0000000000E8C000-memory.dmp
memory/4872-2-0x0000000005920000-0x00000000059B2000-memory.dmp