9333da19e474e99fcf6d75230c8bc90b07ab2cbc13165b6d94ace9ae754edcff

Analysis

max time kernel
299s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/04/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
II-3.exe
Size 18.3MB
Sample260424-3a76jaft7j
SHA256 9333da19e474e99fcf6d75230c8bc90b07ab2cbc13165b6d94ace9ae754edcff
MD5 5ca0b94f86781d820ba721a3ebf271ef
SHA1 5e8376b39a3f83115bafa4893ceb23e6f431e007
SHA512 9acd8bd8d4d64ad8607984c2e73e62b857fa629d232caf4f4fa34e3a75f18a5e9a2a9bda609540bb7b212649f3b828ab5380e74b7ac2d14eb9e403a69938bb21
SSDEEP 393216:F+ZKdzNMLpVDkUS2iqZ4LQ9YclY+jXbOq4DD8ADgsQDYBbMwlV:oINNMp1k6iv09YJgXbOqM8ADgHDqIwf
TLSH
T10D173362B6CFE43DF05A4B374572E24484FB7B656633AD2286E884ACDF691542D3E303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2644	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5092	II-3.tmp
4968	Dgq4n.exe

Loads dropped DLL 1 IoCs

pid	Process
4968	Dgq4n.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4156	icacls.exe
1640	icacls.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	II-3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	II-3.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4680-0-0x0000000000C70000-0x0000000000D57000-memory.dmp	innosetup
behavioral2/memory/4680-20-0x0000000000C70000-0x0000000000D57000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2644	powershell.exe
2644	powershell.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
4968	Dgq4n.exe
4968	Dgq4n.exe
4968	Dgq4n.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe
5604	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	Dgq4n.exe
Token: SeDebugPrivilege	4968	Dgq4n.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeIncreaseQuotaPrivilege	2644	powershell.exe
Token: SeSecurityPrivilege	2644	powershell.exe
Token: SeTakeOwnershipPrivilege	2644	powershell.exe
Token: SeLoadDriverPrivilege	2644	powershell.exe
Token: SeSystemProfilePrivilege	2644	powershell.exe
Token: SeSystemtimePrivilege	2644	powershell.exe
Token: SeProfSingleProcessPrivilege	2644	powershell.exe
Token: SeIncBasePriorityPrivilege	2644	powershell.exe
Token: SeCreatePagefilePrivilege	2644	powershell.exe
Token: SeBackupPrivilege	2644	powershell.exe
Token: SeRestorePrivilege	2644	powershell.exe
Token: SeShutdownPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeSystemEnvironmentPrivilege	2644	powershell.exe
Token: SeRemoteShutdownPrivilege	2644	powershell.exe
Token: SeUndockPrivilege	2644	powershell.exe
Token: SeManageVolumePrivilege	2644	powershell.exe
Token: 33	2644	powershell.exe
Token: 34	2644	powershell.exe
Token: 35	2644	powershell.exe
Token: 36	2644	powershell.exe
Token: SeDebugPrivilege	5604	elevation_service.exe
Token: SeDebugPrivilege	5604	elevation_service.exe
Token: SeDebugPrivilege	5604	elevation_service.exe
Token: SeDebugPrivilege	5604	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5092	II-3.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 5092	4680	II-3.exe	82
PID 5092 wrote to memory of 4968	5092	II-3.tmp	84
PID 4968 wrote to memory of 2644	4968	Dgq4n.exe	90
PID 5604 wrote to memory of 1396	5604	elevation_service.exe	95
PID 1396 wrote to memory of 4156	1396	cmd.exe	97
PID 1396 wrote to memory of 1640	1396	cmd.exe	98
PID 5604 wrote to memory of 3164	5604	elevation_service.exe	52
PID 5604 wrote to memory of 3164	5604	elevation_service.exe	52
PID 5604 wrote to memory of 3164	5604	elevation_service.exe	52

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3164

C:\Users\Admin\AppData\Local\Temp\II-3.exe
"C:\Users\Admin\AppData\Local\Temp\II-3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\is-1C111.tmp\II-3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1C111.tmp\II-3.tmp" /SL5="$90036,18229654,888320,C:\Users\Admin\AppData\Local\Temp\II-3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\dell\QCpC\NWFlOq\5boFno\t7yGo\Dgq4n.exe
    "C:\dell\QCpC\NWFlOq\5boFno\t7yGo\Dgq4n.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\dell\QCpC\NWFlOq\5boFno\t7yGo\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c icacls "C:\dell\QCpC\NWFlOq\5boFno\t7yGo\." /deny "Users":(D) & icacls "C:\dell\QCpC\NWFlOq\5boFno\t7yGo\." /grant "Users":(OI)(CI)(RX)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\icacls.exe
    icacls "C:\dell\QCpC\NWFlOq\5boFno\t7yGo\." /deny "Users":(D)
    3⤵
    - Modifies file permissions
    PID:4156
- - C:\Windows\system32\icacls.exe
    icacls "C:\dell\QCpC\NWFlOq\5boFno\t7yGo\." /grant "Users":(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_r4x4hadk.pcj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4x4hadk.pcj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

II-3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1C111.tmp\II-3.tmp
Size 3.4MB
SHA256 4cde31c94db2d3e0669fc63a4948cb4bd7c404287aacb3cdfffe087bd94b0c4e
MD5 78782369b49e75e7ca3768da51114e58
SHA1 8907930c2da51d7ac74871be30f0414f3a0b2986
SHA512 ddc49b10a68dd271ed7084ae6150109281b1fa839fa6ee062f96d7e1a5037a998d38b7df2451b1c4421e35b1c7b4537084e040eff60d9fe5aa62865976ffa369
SSDEEP 49152:riE8NvQCX7lF4RQSxPodbxsl7IwDksRinJwj9LaDjppz0ooh9333fZ:riE8OQMlIwDkZqBLZ333B
TLSH
T1A8F55C23F34D603EF06A1A39DD379648987B7A606916CC5797FC3A4C8F361402E2A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgq4n.exe

Path C:\dell\QCpC\NWFlOq\5boFno\t7yGo\Dgq4n.exe
Size 572KB
SHA256 963874b932149def6925da89948a3fc424eece367c0086c5a303db5e34f2bdca
MD5 bcee3a7456366752a7cb94c9f961e1ab
SHA1 2bb7ac0bc773775499989a354d359038bdf72892
SHA512 a60c4bc64930bc45afc80dd47c6a94bba117aab53775e8857ae937ddd6df36547a7c8181675407f8f09ab5acb74cf7f81f7a4f459a9f35f7c59bd17e708cf44f
SSDEEP 12288:Yd4T6luWKctc1pXFDPtni9lq2G0OEA2147vcBTzXo49J2:Yd4SuRPtnilEoIEBTzXjJ2
TLSH
T1B5C40297F3805FD5E0A38934985187303677AA9117B2DA7B1244E23F3E2B29B4F35DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vr.H

Path C:\dell\QCpC\NWFlOq\5boFno\t7yGo\Vr.H
Size 2.9MB
SHA256 51365a956e7f83d7d5a3cd297d4645cbe13e982a44b67febc5c2879b9c900819
MD5 34218a4574c7ed0301b52ab4c5154723
SHA1 08e68d4ca7c9bbaf34e2af77c21c22b661ac7133
SHA512 b1b6d858d3219916cf721143d0c9108599fb8c627f17f1a7ea61fd2c4c052af9b8585b0cab67c8fa2b2ffd73f7f031d7ff067cad532b19af4b0f61704b5048cd
SSDEEP 49152:YOyeVy9f0E3erFN34K6s8upVI1eCCj2LxV/XKAxCoR2FYR:bfVymeerb3474VuBxxKAHlR
TLSH
T12AE512A91890407DE4B28734D98D5EE6E78634456B740C1F6F9600C522F4BF7EEE2B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp46F.Ot

Path C:\dell\QCpC\NWFlOq\5boFno\t7yGo\mp46F.Ot
Size 13.7MB
SHA256 9fc5463b3a8dcff1dcc0c093b8f1d2ddc05657781773069d0fa5b92785a4878f
MD5 4b845aa7a0a67389858b6a6d4074dafe
SHA1 372fd6037ec18da12ba2a1cbf29228494e7c6a67
SHA512 5b98ac4af348bb499efd0ad27cc7b4da9375bfc14a9dee1cfadb8ab7162bab317eb77d3a89cbab7e0f0fa8773c280fb9c98677543ea9e6f43c87d031df9ea492
SSDEEP 393216:LVRQSNuLiiZy1A9au0h/hiacCrPjVVEf7Mkmg:LndN4i4yiaz5iaLrVVEffmg
TLSH
T10FE633A0E9CEC5FCE01794B977162A02C4D33EA993790130641BD7BA73EC5A825ED772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-34-0x00000201EA070000-0x00000201EA092000-memory.dmp

Download

memory/4680-0-0x0000000000C70000-0x0000000000D57000-memory.dmp

Download

memory/4680-20-0x0000000000C70000-0x0000000000D57000-memory.dmp

Download

memory/4968-22-0x000001C565A60000-0x000001C566807000-memory.dmp

Download

memory/4968-24-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/4968-26-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/4968-30-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/4968-31-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/4968-33-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/4968-32-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/4968-60-0x000001C5675D0000-0x000001C569233000-memory.dmp

Download

memory/5092-19-0x0000000000E00000-0x000000000116E000-memory.dmp

Download

memory/5092-5-0x0000000001B20000-0x0000000001B21000-memory.dmp

Download

memory/5604-42-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download

memory/5604-46-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download

memory/5604-50-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download

memory/5604-52-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download

memory/5604-51-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download

memory/5604-53-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download

memory/5604-57-0x000001F68B150000-0x000001F68CDB3000-memory.dmp

Download