Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 13:26
General
- Target 0abb2de0abdd5d2f31d316a21efc6648.exe
- Size 67KB
- Sample260604-qplvmaft6w
- SHA256 5f28446e9b5e1b6b8320defead4656909251cece99359838f1f094f6bd593944
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0abb2de0abdd5d2f31d316a21efc6648.exe"C:\Users\Admin\AppData\Local\Temp\0abb2de0abdd5d2f31d316a21efc6648.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\output_rj6c4kxw.jse"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -w h -nOp -nOnI -Command "&([scriptblock]::Create($env:Tha0NpE8uz))"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -w h -nOp -nOnI -Command &([scriptblock]::Create($env:Tha0NpE8uz))5⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3uxda1or.ad0.ps1
output_rj6c4kxw.jse
memory/1760-0-0x000002778A4C0000-0x000002778A4D4000-memory.dmp
memory/1760-1-0x00000277A48D0000-0x00000277A48E0000-memory.dmp
memory/2192-25-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-22-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-7-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-6-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-5-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-12-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-13-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-15-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-16-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-18-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-20-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-21-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-23-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-24-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-8-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-9-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-19-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-17-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-4-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-3-0x0000000140000000-0x000000014057E000-memory.dmp
memory/2192-41-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5112-36-0x0000027CBDE90000-0x0000027CBDEF0000-memory.dmp
memory/5112-37-0x0000027CBDE50000-0x0000027CBDE64000-memory.dmp
memory/5112-40-0x0000027CA4BF0000-0x0000027CA56B2000-memory.dmp
memory/5112-35-0x0000027CBDDC0000-0x0000027CBDDE2000-memory.dmp
memory/5112-43-0x0000027CA4BF0000-0x0000027CA56B2000-memory.dmp
memory/5112-45-0x0000027CA4BF0000-0x0000027CA56B2000-memory.dmp
memory/5112-47-0x0000027CBE860000-0x0000027CBEB4B000-memory.dmp
memory/5112-48-0x0000027CBE860000-0x0000027CBEB4B000-memory.dmp
memory/5112-49-0x0000027CBE860000-0x0000027CBEB4B000-memory.dmp
memory/5112-46-0x0000027CBE860000-0x0000027CBEB4B000-memory.dmp
memory/5112-50-0x0000027CA4BF0000-0x0000027CA56B2000-memory.dmp