Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 12:34
General
- Target 304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe
- Size 1.2MB
- Sample260508-prrm8ag14v
- SHA256 304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"C:\Users\Admin\AppData\Local\Temp\304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lq0tttry.ykv.ps1
memory/1300-1-0x0000000005800000-0x0000000005DA6000-memory.dmp
memory/1300-2-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/1300-3-0x0000000005DB0000-0x0000000006107000-memory.dmp
memory/1300-4-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/1300-5-0x0000000005520000-0x000000000552A000-memory.dmp
memory/1300-6-0x0000000005660000-0x00000000056FC000-memory.dmp
memory/1300-7-0x0000000006910000-0x0000000006934000-memory.dmp
memory/1300-8-0x00000000012B0000-0x000000000132B000-memory.dmp
memory/1300-10-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/1300-9-0x0000000005180000-0x00000000051E4000-memory.dmp
memory/1300-11-0x00000000088F0000-0x00000000089D0000-memory.dmp
memory/1300-13-0x00000000012B0000-0x000000000132B000-memory.dmp
memory/1300-14-0x0000000005180000-0x00000000051E4000-memory.dmp
memory/1300-0-0x0000000000650000-0x000000000078A000-memory.dmp
memory/1676-28-0x0000000005E40000-0x0000000006197000-memory.dmp
memory/1676-43-0x0000000007520000-0x00000000075C4000-memory.dmp
memory/1676-15-0x0000000002B30000-0x0000000002B40000-memory.dmp
memory/1676-19-0x0000000005450000-0x0000000005472000-memory.dmp
memory/1676-21-0x0000000005DD0000-0x0000000005E36000-memory.dmp
memory/1676-18-0x0000000002B30000-0x0000000002B40000-memory.dmp
memory/1676-20-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/1676-16-0x0000000002A60000-0x0000000002A96000-memory.dmp
memory/1676-29-0x00000000062D0000-0x00000000062EE000-memory.dmp
memory/1676-30-0x0000000006360000-0x00000000063AC000-memory.dmp
memory/1676-31-0x000000007FA10000-0x000000007FA20000-memory.dmp
memory/1676-32-0x00000000068F0000-0x0000000006924000-memory.dmp
memory/1676-33-0x0000000070F50000-0x0000000070F9C000-memory.dmp
memory/1676-42-0x00000000072E0000-0x00000000072FE000-memory.dmp
memory/1676-41-0x0000000002B30000-0x0000000002B40000-memory.dmp
memory/1676-17-0x00000000054D0000-0x0000000005AFA000-memory.dmp
memory/1676-40-0x0000000002B30000-0x0000000002B40000-memory.dmp
memory/1676-45-0x0000000007650000-0x000000000766A000-memory.dmp
memory/1676-44-0x0000000007CA0000-0x000000000831A000-memory.dmp
memory/1676-46-0x00000000076D0000-0x00000000076DA000-memory.dmp
memory/1676-47-0x00000000078E0000-0x0000000007976000-memory.dmp
memory/1676-48-0x0000000007860000-0x0000000007871000-memory.dmp
memory/1676-49-0x0000000007890000-0x000000000789E000-memory.dmp
memory/1676-50-0x00000000078A0000-0x00000000078B5000-memory.dmp
memory/1676-51-0x00000000079A0000-0x00000000079BA000-memory.dmp
memory/1676-52-0x0000000007990000-0x0000000007998000-memory.dmp
memory/1676-56-0x00000000010E0000-0x00000000010F9000-memory.dmp
memory/1676-58-0x00000000068C0000-0x00000000068CB000-memory.dmp
memory/1676-55-0x00000000029B0000-0x0000000002A14000-memory.dmp
memory/1676-57-0x00000000063E0000-0x0000000006405000-memory.dmp