Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 12:33
General
- Target 717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll
- Size 99KB
- Sample260427-pre97abs6t
- SHA256 717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\client'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'Utility.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\717a144867e9ccc75a2c6e7cb85001a453f9230d34b8b969dcc585cf20d4317a.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Utility.dll'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lr4cex5t.qcs.ps1
memory/2948-101-0x0000000000BE0000-0x0000000000E6B000-memory.dmp
memory/2948-103-0x0000000005BD0000-0x0000000005BE8000-memory.dmp
memory/2948-102-0x00000000050E0000-0x00000000051CA000-memory.dmp
memory/2948-92-0x0000000070790000-0x00000000707DC000-memory.dmp
memory/3188-35-0x0000000008110000-0x000000000811E000-memory.dmp
memory/3188-41-0x00000000059C0000-0x0000000005AAA000-memory.dmp
memory/3188-14-0x00000000065E0000-0x0000000006937000-memory.dmp
memory/3188-15-0x0000000006B00000-0x0000000006B1E000-memory.dmp
memory/3188-16-0x0000000006B30000-0x0000000006B7C000-memory.dmp
memory/3188-17-0x000000007F680000-0x000000007F690000-memory.dmp
memory/3188-18-0x00000000070C0000-0x00000000070F4000-memory.dmp
memory/3188-19-0x0000000070790000-0x00000000707DC000-memory.dmp
memory/3188-25-0x0000000003300000-0x0000000003310000-memory.dmp
memory/3188-22-0x0000000003300000-0x0000000003310000-memory.dmp
memory/3188-28-0x0000000007CE0000-0x0000000007CFE000-memory.dmp
memory/3188-29-0x0000000007D90000-0x0000000007E34000-memory.dmp
memory/3188-30-0x0000000008510000-0x0000000008B8A000-memory.dmp
memory/3188-31-0x0000000007ED0000-0x0000000007EEA000-memory.dmp
memory/3188-32-0x0000000007F50000-0x0000000007F5A000-memory.dmp
memory/3188-33-0x0000000008160000-0x00000000081F6000-memory.dmp
memory/3188-34-0x00000000080E0000-0x00000000080F1000-memory.dmp
memory/3188-6-0x0000000006500000-0x0000000006566000-memory.dmp
memory/3188-36-0x0000000008120000-0x0000000008135000-memory.dmp
memory/3188-37-0x0000000008220000-0x000000000823A000-memory.dmp
memory/3188-38-0x0000000008210000-0x0000000008218000-memory.dmp
memory/3188-7-0x0000000006570000-0x00000000065D6000-memory.dmp
memory/3188-43-0x0000000006220000-0x0000000006238000-memory.dmp
memory/3188-42-0x0000000006290000-0x000000000638E000-memory.dmp
memory/3188-1-0x0000000003300000-0x0000000003310000-memory.dmp
memory/3188-2-0x0000000005450000-0x0000000005486000-memory.dmp
memory/3188-3-0x0000000003300000-0x0000000003310000-memory.dmp
memory/3188-4-0x0000000005AC0000-0x00000000060EA000-memory.dmp
memory/3188-5-0x0000000006260000-0x0000000006282000-memory.dmp
memory/3196-63-0x0000000004F00000-0x0000000004FEA000-memory.dmp
memory/3196-65-0x0000000005F00000-0x0000000005F18000-memory.dmp
memory/3196-46-0x0000000004AD0000-0x0000000004AE0000-memory.dmp
memory/3196-45-0x0000000004AD0000-0x0000000004AE0000-memory.dmp
memory/3196-47-0x0000000005B20000-0x0000000005E77000-memory.dmp
memory/3196-64-0x0000000005920000-0x0000000005A1E000-memory.dmp
memory/3196-55-0x0000000070790000-0x00000000707DC000-memory.dmp
memory/3980-99-0x0000000003130000-0x00000000033BB000-memory.dmp
memory/3980-0-0x0000000074F61000-0x0000000074F62000-memory.dmp
memory/3980-104-0x0000000003130000-0x00000000033BB000-memory.dmp
memory/4224-66-0x0000000006120000-0x0000000006477000-memory.dmp
memory/4224-82-0x0000000005C60000-0x0000000005D4A000-memory.dmp
memory/4224-83-0x0000000005F00000-0x0000000005FFE000-memory.dmp
memory/4224-84-0x0000000006550000-0x0000000006568000-memory.dmp
memory/4224-74-0x0000000070790000-0x00000000707DC000-memory.dmp