Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 18:00
General
- Target _fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe
- Size 1.2MB
- Sample260511-wlk2tabv4j
- SHA256 fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe"C:\Users\Admin\AppData\Local\Temp\_fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\_fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\zmw1uuuved1.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lHIAgZkXAesiW.exe"C:\Users\Admin\AppData\Roaming\lHIAgZkXAesiW.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lHIAgZkXAesiW.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2u31z5cs.bhk.ps1
zmw1uuuved1.ps1
LoginData
WebData
lHIAgZkXAesiW.exe
memory/1736-61-0x000002BF03270000-0x000002BF0327C000-memory.dmp
memory/1736-62-0x000002BF036E0000-0x000002BF036F2000-memory.dmp
memory/1736-47-0x000002BF1B9D0000-0x000002BF1B9F2000-memory.dmp
memory/2384-140-0x00000000064E0000-0x0000000006520000-memory.dmp
memory/2384-126-0x00000000709E0000-0x0000000070A2C000-memory.dmp
memory/2384-138-0x0000000005940000-0x0000000005A3E000-memory.dmp
memory/2384-133-0x0000000007C70000-0x0000000007D14000-memory.dmp
memory/2384-137-0x0000000002FD0000-0x0000000002FE9000-memory.dmp
memory/2384-135-0x0000000008270000-0x0000000008285000-memory.dmp
memory/2384-139-0x0000000006390000-0x00000000063C7000-memory.dmp
memory/2384-143-0x0000000006AE0000-0x0000000006AEA000-memory.dmp
memory/2384-134-0x0000000007FC0000-0x0000000007FD1000-memory.dmp
memory/2384-123-0x00000000066C0000-0x0000000006A17000-memory.dmp
memory/2384-125-0x0000000006B40000-0x0000000006B8C000-memory.dmp
memory/2384-141-0x00000000063E0000-0x00000000063EA000-memory.dmp
memory/2384-142-0x00000000065E0000-0x00000000065F8000-memory.dmp
memory/2628-93-0x0000000000400000-0x0000000000581000-memory.dmp
memory/2628-92-0x0000000001490000-0x00000000015DD000-memory.dmp
memory/2628-20-0x0000000000400000-0x0000000000581000-memory.dmp
memory/2628-22-0x0000000000400000-0x0000000000581000-memory.dmp
memory/3704-27-0x00000000058E0000-0x0000000005A2D000-memory.dmp
memory/3704-7-0x0000000005BE0000-0x0000000005CA1000-memory.dmp
memory/3704-8-0x0000000005D00000-0x0000000005D10000-memory.dmp
memory/3704-6-0x00000000058E0000-0x0000000005A2D000-memory.dmp
memory/3704-5-0x0000000007AE0000-0x0000000007AF8000-memory.dmp
memory/3704-4-0x0000000005BB0000-0x0000000005BBA000-memory.dmp
memory/3704-9-0x00000000084E0000-0x00000000086FA000-memory.dmp
memory/3704-10-0x00000000087A0000-0x000000000883C000-memory.dmp
memory/3704-28-0x0000000005BE0000-0x0000000005CA1000-memory.dmp
memory/3704-3-0x0000000005D00000-0x0000000005D10000-memory.dmp
memory/3704-2-0x0000000005B10000-0x0000000005BA2000-memory.dmp
memory/3704-0-0x0000000000DD0000-0x0000000000F04000-memory.dmp
memory/3704-1-0x0000000006190000-0x0000000006736000-memory.dmp
memory/3704-16-0x00000000058E0000-0x0000000005A2D000-memory.dmp
memory/3704-17-0x0000000005BE0000-0x0000000005CA1000-memory.dmp
memory/3904-74-0x0000000007B90000-0x0000000007BAA000-memory.dmp
memory/3904-46-0x00000000062E0000-0x0000000006637000-memory.dmp
memory/3904-80-0x0000000007EE0000-0x0000000007EFA000-memory.dmp
memory/3904-81-0x0000000007ED0000-0x0000000007ED8000-memory.dmp
memory/3904-78-0x0000000007DD0000-0x0000000007DDE000-memory.dmp
memory/3904-85-0x0000000005160000-0x0000000005179000-memory.dmp
memory/3904-86-0x0000000005E70000-0x0000000005F6E000-memory.dmp
memory/3904-90-0x0000000006680000-0x0000000006698000-memory.dmp
memory/3904-91-0x0000000006900000-0x000000000690A000-memory.dmp
memory/3904-88-0x00000000062A0000-0x00000000062E0000-memory.dmp
memory/3904-87-0x0000000006160000-0x0000000006197000-memory.dmp
memory/3904-89-0x00000000060D0000-0x00000000060DA000-memory.dmp
memory/3904-77-0x0000000007DA0000-0x0000000007DB1000-memory.dmp
memory/3904-76-0x0000000007E20000-0x0000000007EB6000-memory.dmp
memory/3904-19-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/3904-23-0x0000000005840000-0x0000000005E6A000-memory.dmp
memory/3904-75-0x0000000007C10000-0x0000000007C1A000-memory.dmp
memory/3904-73-0x00000000081D0000-0x000000000884A000-memory.dmp
memory/3904-72-0x0000000007A50000-0x0000000007AF4000-memory.dmp
memory/3904-18-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/3904-71-0x0000000006E70000-0x0000000006E8E000-memory.dmp
memory/3904-15-0x00000000051D0000-0x0000000005206000-memory.dmp
memory/3904-39-0x0000000006220000-0x0000000006286000-memory.dmp
memory/3904-38-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/3904-64-0x0000000070680000-0x00000000706CC000-memory.dmp
memory/3904-63-0x0000000006E10000-0x0000000006E44000-memory.dmp
memory/3904-55-0x0000000006870000-0x00000000068BC000-memory.dmp
memory/3904-54-0x0000000006820000-0x000000000683E000-memory.dmp
memory/3904-79-0x0000000007DE0000-0x0000000007DF5000-memory.dmp
memory/3904-37-0x0000000006110000-0x0000000006132000-memory.dmp
memory/4488-101-0x0000000004B70000-0x0000000004CBD000-memory.dmp
memory/4488-103-0x0000000006D90000-0x0000000006DC7000-memory.dmp
memory/4488-104-0x00000000075C0000-0x0000000007691000-memory.dmp
memory/4488-105-0x0000000009EF0000-0x0000000009F0D000-memory.dmp
memory/4488-94-0x0000000004B70000-0x0000000004CBD000-memory.dmp
memory/4488-95-0x0000000006D90000-0x0000000006DC7000-memory.dmp
memory/4808-145-0x0000000001070000-0x00000000011BD000-memory.dmp