Analysis
- max time kernel
300s - max time network
308s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
15/04/2026, 16:07
General
- Target fqhgxrqybri2aps9.exe
- Size 457KB
- Sample260415-tkpmhafv6t
- SHA256 9141f0dec62fa9c4d5fe7c0bd854bce3b21995d7af1798a544d9dc4345ea961b
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 9 IoCs
- Drops file in Windows directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fqhgxrqybri2aps9.exe"C:\Users\Admin\AppData\Local\Temp\fqhgxrqybri2aps9.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="wROKqJoEqO1Wq." dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\MalwareDef.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\MalwareDef.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Defender.exeC:\Windows\System32\Defender.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Web\MalwareDef.exeC:\Windows\Web\MalwareDef.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Defender.exe.log
Defender.exe
memory/572-103-0x0000000000F00000-0x0000000000F2F000-memory.dmp
memory/572-104-0x00000000010D0000-0x00000000010DC000-memory.dmp
memory/1476-144-0x0000000001620000-0x000000000162C000-memory.dmp
memory/1476-143-0x0000000001450000-0x000000000147F000-memory.dmp
memory/1868-98-0x0000000000B30000-0x0000000000B5F000-memory.dmp
memory/1868-99-0x00000000025B0000-0x00000000025BC000-memory.dmp
memory/2600-158-0x0000000001120000-0x000000000114F000-memory.dmp
memory/2600-159-0x0000000002BB0000-0x0000000002BBC000-memory.dmp
memory/3428-102-0x00000000031A0000-0x00000000031AC000-memory.dmp
memory/3428-101-0x0000000001810000-0x000000000183F000-memory.dmp
memory/4852-115-0x0000000001260000-0x000000000128F000-memory.dmp
memory/4852-116-0x0000000002BC0000-0x0000000002BCC000-memory.dmp
memory/5064-0-0x00000000005E0000-0x0000000000658000-memory.dmp
memory/5064-93-0x0000000002820000-0x000000000282C000-memory.dmp
memory/5064-1-0x000000001B720000-0x000000001B730000-memory.dmp
memory/5064-92-0x00000000010B0000-0x00000000010DF000-memory.dmp
memory/5684-131-0x0000000002AA0000-0x0000000002AAC000-memory.dmp
memory/5684-130-0x0000000001240000-0x000000000126F000-memory.dmp