Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 10:44
General
- Target 手机号反查个人信息-1r.exe
- Size 310KB
- Sample260506-ms2hpsbv4p
- SHA256 ae3ff26fadd67b2c3659c8f0d591edc60bef7cea7d0c915219d567e73c1a745b
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\手机号反查个人信息-1r.exe"C:\Users\Admin\AppData\Local\Temp\手机号反查个人信息-1r.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\手机号反查个人信息-1r.exeC:\Users\Admin\AppData\Local\Temp\手机号反查个人信息-1r.exe1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
msxml
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
__PSScriptPolicyTest_fg30f5ro.4n3.ps1
d32f4a45da3f8c7de6b62dda2692fb84
d32f4a45da3f8c7de6b62dda2692fb84
fce5656b680d0e99e621f34ec699753e
fce5656b680d0e99e621f34ec699753e
memory/1056-113-0x0000000002C90000-0x0000000002CDA000-memory.dmp
memory/1056-89-0x000000006FBE0000-0x000000006FC2C000-memory.dmp
memory/1056-90-0x000000006FDD0000-0x0000000070127000-memory.dmp
memory/1252-178-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-182-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-220-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-218-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-206-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-208-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-200-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-202-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-188-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-190-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-184-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-176-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-170-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-172-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-158-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-160-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-147-0x00000000049B0000-0x00000000049FA000-memory.dmp
memory/1252-148-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1252-146-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-62-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1252-67-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-167-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-221-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-223-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-215-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-104-0x0000000004510000-0x0000000004559000-memory.dmp
memory/1964-217-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-209-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-211-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-197-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-199-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-110-0x0000000002A00000-0x0000000002A49000-memory.dmp
memory/1964-185-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-187-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-3-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-179-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-2-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-130-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-132-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-131-0x0000000004660000-0x00000000046AA000-memory.dmp
memory/1964-1-0x0000000002A00000-0x0000000002A49000-memory.dmp
memory/1964-181-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-0-0x0000000004510000-0x0000000004559000-memory.dmp
memory/1964-169-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-151-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-149-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/1964-157-0x00000000744B0000-0x0000000074763000-memory.dmp
memory/1964-155-0x0000000075D10000-0x000000007614B000-memory.dmp
memory/2468-42-0x000000006FBE0000-0x000000006FC2C000-memory.dmp
memory/2468-12-0x0000000002860000-0x0000000002896000-memory.dmp
memory/2468-31-0x00000000060D0000-0x000000000611C000-memory.dmp
memory/2468-32-0x0000000006610000-0x0000000006656000-memory.dmp
memory/2468-51-0x000000006FDD0000-0x0000000070127000-memory.dmp
memory/2468-13-0x0000000005410000-0x0000000005A3A000-memory.dmp
memory/2468-109-0x0000000000E40000-0x0000000000E8A000-memory.dmp
memory/2468-10-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/2468-61-0x00000000078D0000-0x00000000078E1000-memory.dmp
memory/2468-30-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/3496-88-0x000000006FBE0000-0x000000006FC2C000-memory.dmp
memory/3496-116-0x0000000001350000-0x000000000139A000-memory.dmp
memory/3496-91-0x000000006FDD0000-0x0000000070127000-memory.dmp
memory/3880-23-0x0000000005AE0000-0x0000000005E37000-memory.dmp
memory/3880-50-0x0000000007660000-0x000000000767E000-memory.dmp
memory/3880-41-0x000000006FBE0000-0x000000006FC2C000-memory.dmp
memory/3880-60-0x0000000007800000-0x000000000780A000-memory.dmp
memory/3880-108-0x0000000000FD0000-0x000000000101A000-memory.dmp
memory/3880-36-0x0000000007A90000-0x0000000008036000-memory.dmp
memory/3880-35-0x00000000073F0000-0x0000000007412000-memory.dmp
memory/3880-34-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/3880-33-0x0000000007440000-0x00000000074D6000-memory.dmp
memory/3880-40-0x0000000007600000-0x0000000007634000-memory.dmp
memory/3880-43-0x000000006FDD0000-0x0000000070127000-memory.dmp
memory/3880-57-0x0000000007680000-0x0000000007724000-memory.dmp
memory/3880-11-0x0000000002920000-0x0000000002930000-memory.dmp
memory/3880-59-0x00000000086C0000-0x0000000008D3A000-memory.dmp
memory/3880-15-0x0000000005240000-0x00000000052A6000-memory.dmp
memory/3880-14-0x00000000051A0000-0x00000000051C2000-memory.dmp
memory/3880-16-0x00000000058F0000-0x0000000005956000-memory.dmp