Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 03:48
General
- Target b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
- Size 2.7MB
- Sample260419-ec7qsab19p
- SHA256 b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe"C:\Users\Admin\AppData\Local\Temp\b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0beqczck.ydx.ps1
memory/2208-9-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/2208-42-0x0000000006380000-0x00000000063CC000-memory.dmp
memory/2208-8-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/2208-7-0x0000000005950000-0x0000000005972000-memory.dmp
memory/2208-74-0x0000000007310000-0x000000000732A000-memory.dmp
memory/2208-73-0x0000000007950000-0x0000000007FCA000-memory.dmp
memory/2208-40-0x0000000005FC0000-0x0000000005FDE000-memory.dmp
memory/2208-0-0x0000000004C10000-0x0000000004C20000-memory.dmp
memory/2208-3-0x0000000004C10000-0x0000000004C20000-memory.dmp
memory/2208-1-0x0000000004B20000-0x0000000004B56000-memory.dmp
memory/2208-100-0x0000000007560000-0x0000000007575000-memory.dmp
memory/2208-59-0x000000006F4B0000-0x000000006F4FC000-memory.dmp
memory/2716-129-0x0000000000F60000-0x0000000001214000-memory.dmp
memory/2716-116-0x0000000000F60000-0x0000000001214000-memory.dmp
memory/2736-92-0x000000006F4B0000-0x000000006F4FC000-memory.dmp
memory/3108-58-0x0000000007280000-0x0000000007324000-memory.dmp
memory/3108-10-0x0000000005BC0000-0x0000000005F17000-memory.dmp
memory/3108-82-0x0000000007450000-0x000000000745A000-memory.dmp
memory/3108-83-0x0000000007680000-0x0000000007716000-memory.dmp
memory/3108-84-0x00000000075F0000-0x0000000007601000-memory.dmp
memory/3108-6-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3108-57-0x0000000007250000-0x000000000726E000-memory.dmp
memory/3108-99-0x0000000007620000-0x000000000762E000-memory.dmp
memory/3108-5-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3108-104-0x0000000007720000-0x0000000007728000-memory.dmp
memory/3108-101-0x0000000007740000-0x000000000775A000-memory.dmp
memory/3108-49-0x0000000007210000-0x0000000007244000-memory.dmp
memory/3108-50-0x000000006F4B0000-0x000000006F4FC000-memory.dmp
memory/3888-75-0x000000006F4B0000-0x000000006F4FC000-memory.dmp
memory/4684-85-0x000000006F4B0000-0x000000006F4FC000-memory.dmp
memory/5048-66-0x000000006F4B0000-0x000000006F4FC000-memory.dmp
memory/5048-4-0x0000000005B30000-0x000000000615A000-memory.dmp
memory/5048-2-0x00000000033E0000-0x00000000033F0000-memory.dmp