Analysis
- max time kernel
149s - max time network
114s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 16:23
General
- Target PO-05870-MQ-05868-QTN-1000-04-2026-PR08586.exe
- Size 1.3MB
- Sample260506-tvvaqset71
- SHA256 f82ba03e14d2cf4c3602478c465c3a10289b6169b6e58046a079637a10888652
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-05870-MQ-05868-QTN-1000-04-2026-PR08586.exe"C:\Users\Admin\AppData\Local\Temp\PO-05870-MQ-05868-QTN-1000-04-2026-PR08586.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-05870-MQ-05868-QTN-1000-04-2026-PR08586.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\1tyuej0u4pc.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AAqyJLB.exe"C:\Users\Admin\AppData\Roaming\AAqyJLB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AAqyJLB.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
1tyuej0u4pc.ps1
__PSScriptPolicyTest_jtmb5jdf.dqc.ps1
AAqyJLB.exe
LoginData
WebData
memory/1808-54-0x00000000070A0000-0x00000000070D4000-memory.dmp
memory/1808-65-0x0000000007210000-0x000000000722A000-memory.dmp
memory/1808-17-0x0000000002680000-0x00000000026B6000-memory.dmp
memory/1808-19-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/1808-85-0x00000000052C0000-0x00000000052D1000-memory.dmp
memory/1808-84-0x0000000000E70000-0x0000000000E89000-memory.dmp
memory/1808-16-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/1808-26-0x0000000005520000-0x0000000005B4A000-memory.dmp
memory/1808-86-0x0000000004ED0000-0x0000000004EDA000-memory.dmp
memory/1808-27-0x00000000050F0000-0x0000000005112000-memory.dmp
memory/1808-28-0x0000000005210000-0x0000000005276000-memory.dmp
memory/1808-29-0x0000000005330000-0x0000000005396000-memory.dmp
memory/1808-80-0x0000000007570000-0x0000000007578000-memory.dmp
memory/1808-36-0x0000000005B50000-0x0000000005EA7000-memory.dmp
memory/1808-79-0x0000000007580000-0x000000000759A000-memory.dmp
memory/1808-37-0x0000000005ED0000-0x0000000005EEE000-memory.dmp
memory/1808-38-0x0000000005F10000-0x0000000005F5C000-memory.dmp
memory/1808-78-0x00000000074A0000-0x00000000074B5000-memory.dmp
memory/1808-77-0x0000000007430000-0x000000000743E000-memory.dmp
memory/1808-76-0x0000000007440000-0x0000000007451000-memory.dmp
memory/1808-75-0x00000000074C0000-0x0000000007556000-memory.dmp
memory/1808-74-0x0000000007280000-0x000000000728A000-memory.dmp
memory/1808-55-0x0000000070E50000-0x0000000070E9C000-memory.dmp
memory/1808-64-0x0000000007860000-0x0000000007EDA000-memory.dmp
memory/1808-62-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/1808-63-0x00000000070E0000-0x0000000007184000-memory.dmp
memory/2604-39-0x00000160601C0000-0x00000160601E2000-memory.dmp
memory/2604-52-0x0000016060350000-0x000001606043A000-memory.dmp
memory/2604-53-0x0000016047F60000-0x0000016047F72000-memory.dmp
memory/2604-51-0x0000016047B50000-0x0000016047B5C000-memory.dmp
memory/3968-87-0x0000000000400000-0x0000000000479000-memory.dmp
memory/3968-21-0x0000000000400000-0x0000000000479000-memory.dmp
memory/3968-18-0x0000000000400000-0x0000000000479000-memory.dmp
memory/3980-4-0x0000000005010000-0x000000000501A000-memory.dmp
memory/3980-3-0x0000000005330000-0x0000000005340000-memory.dmp
memory/3980-5-0x0000000005340000-0x00000000053DC000-memory.dmp
memory/3980-25-0x0000000000E00000-0x0000000000E25000-memory.dmp
memory/3980-7-0x0000000000E00000-0x0000000000E25000-memory.dmp
memory/3980-6-0x0000000005640000-0x000000000565E000-memory.dmp
memory/3980-9-0x0000000007140000-0x0000000007252000-memory.dmp
memory/3980-0-0x00000000003E0000-0x0000000000536000-memory.dmp
memory/3980-1-0x0000000005680000-0x0000000005C26000-memory.dmp
memory/3980-2-0x00000000050D0000-0x0000000005162000-memory.dmp
memory/3980-8-0x0000000005330000-0x0000000005340000-memory.dmp
memory/4272-101-0x0000000005DD0000-0x0000000006127000-memory.dmp
memory/4272-104-0x0000000070E50000-0x0000000070E9C000-memory.dmp
memory/4272-111-0x00000000075A0000-0x0000000007644000-memory.dmp
memory/4272-112-0x0000000007910000-0x0000000007921000-memory.dmp
memory/4272-123-0x0000000007930000-0x0000000007945000-memory.dmp
memory/4272-126-0x0000000005570000-0x0000000005581000-memory.dmp
memory/4272-128-0x0000000007A00000-0x0000000007A22000-memory.dmp
memory/4272-127-0x0000000005590000-0x000000000559A000-memory.dmp
memory/4272-125-0x0000000002A30000-0x0000000002A49000-memory.dmp
memory/4380-95-0x000000000A2D0000-0x000000000A2ED000-memory.dmp
memory/4380-94-0x000000000A290000-0x000000000A2CB000-memory.dmp