Analysis
- max time kernel
146s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 07:44
General
- Target 7837b33d2bf16023478d1aa11d42927c390940fcdf7861c955c79111afc5178d.exe
- Size 522KB
- Sample260630-jk9mkaas21
- SHA256 aebcd45162b7b1f8780c4d9fa030b58a906410bd75249590b054245607413be1
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7837b33d2bf16023478d1aa11d42927c390940fcdf7861c955c79111afc5178d.exe"C:\Users\Admin\AppData\Local\Temp\7837b33d2bf16023478d1aa11d42927c390940fcdf7861c955c79111afc5178d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -ex bypass -C "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.HardwareInterface -eq $true -and $_.InterfaceDescription -notmatch 'Nord|VPN|Virtual|TAP|TUN' } | ForEach-Object { Set-DnsClientServerAddress -InterfaceAlias $_.Name -ServerAddresses ('8.8.8.8','8.8.4.4') }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
mservice.exe
memory/3984-0-0x0000000000EE0000-0x0000000000F67000-memory.dmp
memory/4908-115-0x0000000007550000-0x0000000007586000-memory.dmp
memory/4908-128-0x0000000074B32000-0x0000000074B33000-memory.dmp
memory/4908-103-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-104-0x00000000058C0000-0x0000000005F0A000-memory.dmp
memory/4908-119-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-107-0x0000000006030000-0x0000000006096000-memory.dmp
memory/4908-106-0x0000000005F10000-0x0000000005F76000-memory.dmp
memory/4908-108-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-111-0x00000000060A0000-0x00000000063FB000-memory.dmp
memory/4908-112-0x0000000006510000-0x000000000652E000-memory.dmp
memory/4908-113-0x00000000065D0000-0x000000000661C000-memory.dmp
memory/4908-114-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-102-0x00000000030C0000-0x00000000030F6000-memory.dmp
memory/4908-101-0x0000000074B32000-0x0000000074B33000-memory.dmp
memory/4908-105-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/4908-120-0x0000000006B90000-0x0000000006BB0000-memory.dmp
memory/4908-121-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-122-0x0000000007790000-0x0000000007833000-memory.dmp
memory/4908-123-0x0000000007F10000-0x000000000858C000-memory.dmp
memory/4908-124-0x00000000078D0000-0x00000000078EA000-memory.dmp
memory/4908-125-0x0000000007940000-0x000000000794A000-memory.dmp
memory/4908-126-0x0000000007B40000-0x0000000007BD6000-memory.dmp
memory/4908-127-0x0000000007AC0000-0x0000000007AD1000-memory.dmp
memory/4908-116-0x0000000070E20000-0x0000000070E6C000-memory.dmp
memory/4908-129-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-130-0x0000000074B20000-0x00000000752DC000-memory.dmp
memory/4908-131-0x0000000007DE0000-0x0000000007DF0000-memory.dmp
memory/4908-132-0x0000000007E30000-0x0000000007E4A000-memory.dmp