Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 13:26
General
- Target _5f28446e9b5e1b6b8320defead4656909251cece99359838f1f094f6bd593944.exe
- Size 67KB
- Sample260604-qpyjesft7s
- SHA256 5f28446e9b5e1b6b8320defead4656909251cece99359838f1f094f6bd593944
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\_5f28446e9b5e1b6b8320defead4656909251cece99359838f1f094f6bd593944.exe"C:\Users\Admin\AppData\Local\Temp\_5f28446e9b5e1b6b8320defead4656909251cece99359838f1f094f6bd593944.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\output_rj6c4kxw.jse"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -w h -nOp -nOnI -Command "&([scriptblock]::Create($env:Tha0NpE8uz))"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -w h -nOp -nOnI -Command &([scriptblock]::Create($env:Tha0NpE8uz))5⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_esya4gcy.p3x.ps1
output_rj6c4kxw.jse
memory/1308-1-0x000002A4B4480000-0x000002A4B4490000-memory.dmp
memory/1308-0-0x000002A4988A0000-0x000002A4988B4000-memory.dmp
memory/2424-43-0x0000013FD06F0000-0x0000013FD09DB000-memory.dmp
memory/2424-44-0x0000013FD06F0000-0x0000013FD09DB000-memory.dmp
memory/2424-45-0x0000013FD06F0000-0x0000013FD09DB000-memory.dmp
memory/2424-42-0x0000013FD06F0000-0x0000013FD09DB000-memory.dmp
memory/2424-37-0x0000013FCFD00000-0x0000013FCFD14000-memory.dmp
memory/2424-36-0x0000013FCFCA0000-0x0000013FCFD00000-memory.dmp
memory/2424-34-0x0000013FCF360000-0x0000013FCF382000-memory.dmp
memory/3884-5-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-15-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-17-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-18-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-19-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-20-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-22-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-21-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-25-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-26-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-27-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-16-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-13-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-11-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-4-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-6-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-40-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-9-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-8-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-7-0x0000000140000000-0x000000014057E000-memory.dmp
memory/3884-3-0x0000000140000000-0x000000014057E000-memory.dmp