Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 17:43
General
- Target 79396dfd4e035f5a8f624a997e674ba543d43cb77e775db2bf1d0c858d3764d9.dll
- Size 97KB
- Sample260423-wax71ab12p
- SHA256 79396dfd4e035f5a8f624a997e674ba543d43cb77e775db2bf1d0c858d3764d9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79396dfd4e035f5a8f624a997e674ba543d43cb77e775db2bf1d0c858d3764d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79396dfd4e035f5a8f624a997e674ba543d43cb77e775db2bf1d0c858d3764d9.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\79396dfd4e035f5a8f624a997e674ba543d43cb77e775db2bf1d0c858d3764d9.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vuvixvdo.5nv.ps1
memory/1984-97-0x0000000005F70000-0x0000000005F88000-memory.dmp
memory/1984-96-0x0000000005160000-0x000000000524A000-memory.dmp
memory/1984-88-0x0000000070C40000-0x0000000070C8C000-memory.dmp
memory/1984-80-0x0000000005B40000-0x0000000005E97000-memory.dmp
memory/2188-79-0x0000000005040000-0x0000000005058000-memory.dmp
memory/2188-70-0x0000000070C40000-0x0000000070C8C000-memory.dmp
memory/2188-68-0x00000000058F0000-0x0000000005C47000-memory.dmp
memory/2188-78-0x0000000004DC0000-0x0000000004EAA000-memory.dmp
memory/3536-61-0x0000000005B60000-0x0000000005B78000-memory.dmp
memory/3536-60-0x0000000004FF0000-0x00000000050DA000-memory.dmp
memory/3536-52-0x0000000070C40000-0x0000000070C8C000-memory.dmp
memory/3536-50-0x0000000005C80000-0x0000000005FD7000-memory.dmp
memory/3536-42-0x0000000004C10000-0x0000000004C20000-memory.dmp
memory/3536-43-0x0000000004C10000-0x0000000004C20000-memory.dmp
memory/4860-16-0x000000007FC60000-0x000000007FC70000-memory.dmp
memory/4860-25-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/4860-32-0x00000000075E0000-0x00000000075F1000-memory.dmp
memory/4860-33-0x0000000007610000-0x000000000761E000-memory.dmp
memory/4860-34-0x0000000007620000-0x0000000007635000-memory.dmp
memory/4860-35-0x0000000007720000-0x000000000773A000-memory.dmp
memory/4860-36-0x0000000007710000-0x0000000007718000-memory.dmp
memory/4860-40-0x0000000005EF0000-0x0000000005F08000-memory.dmp
memory/4860-39-0x0000000004F50000-0x000000000503A000-memory.dmp
memory/4860-30-0x0000000007450000-0x000000000745A000-memory.dmp
memory/4860-29-0x00000000073D0000-0x00000000073EA000-memory.dmp
memory/4860-28-0x0000000007A10000-0x000000000808A000-memory.dmp
memory/4860-27-0x0000000007290000-0x0000000007334000-memory.dmp
memory/4860-31-0x0000000007660000-0x00000000076F6000-memory.dmp
memory/4860-26-0x0000000007270000-0x000000000728E000-memory.dmp
memory/4860-18-0x0000000070C40000-0x0000000070C8C000-memory.dmp
memory/4860-17-0x0000000007230000-0x0000000007264000-memory.dmp
memory/4860-0-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/4860-15-0x00000000060B0000-0x00000000060FC000-memory.dmp
memory/4860-14-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/4860-13-0x0000000005B40000-0x0000000005E97000-memory.dmp
memory/4860-6-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/4860-5-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/4860-4-0x0000000005900000-0x0000000005922000-memory.dmp
memory/4860-3-0x00000000052D0000-0x00000000058FA000-memory.dmp
memory/4860-2-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/4860-1-0x0000000002A90000-0x0000000002AC6000-memory.dmp