Analysis
- max time kernel
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 08:04
General
- Target 3846806181eb06112166b68a9f9c85a11779d496556188c78b72badb1c417bc0.exe
- Size 5.0MB
- Sample260706-jypvbafx4k
- SHA256 3846806181eb06112166b68a9f9c85a11779d496556188c78b72badb1c417bc0
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3846806181eb06112166b68a9f9c85a11779d496556188c78b72badb1c417bc0.exe"C:\Users\Admin\AppData\Local\Temp\3846806181eb06112166b68a9f9c85a11779d496556188c78b72badb1c417bc0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
-
-
C:\Users\Admin\AppData\Local\Temp\3846806181eb06112166b68a9f9c85a11779d496556188c78b72badb1c417bc0.exe"C:\Users\Admin\AppData\Local\Temp\3846806181eb06112166b68a9f9c85a11779d496556188c78b72badb1c417bc0.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
-
-
C:\Users\Admin\AppData\Roaming\dllhost.exeC:\Users\Admin\AppData\Roaming\dllhost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MemberType\Item.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -Force ; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\MemberType\Item.exe' -Force"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_j2dsyjdp.oul.ps1
dllhost.exe
memory/2320-6038-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2320-6156-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2320-6035-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/2320-6036-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2320-14878-0x0000029DAF840000-0x0000029DAF894000-memory.dmp
memory/2320-14029-0x0000029DAF650000-0x0000029DAF6A6000-memory.dmp
memory/2320-13741-0x0000029DADD40000-0x0000029DADD48000-memory.dmp
memory/2320-6037-0x0000029DAF6E0000-0x0000029DAF7EE000-memory.dmp
memory/2320-7180-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2320-6588-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2320-6039-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-56-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-40-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-79-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-134-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-129-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-190-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-126-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-127-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-123-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-117-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-116-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-113-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-107-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-105-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-103-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-99-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-97-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-95-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-93-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-132-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-121-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-120-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-112-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-109-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-101-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-91-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-89-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-87-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-85-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-83-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-81-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-77-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-75-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-71-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-69-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-67-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-65-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-61-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-59-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-57-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-14-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-51-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-49-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-73-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-63-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-46-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-54-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-43-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-44-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-18-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-38-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-37-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-30-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-28-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-26-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-25-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-22-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-48-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-35-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-32-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-20-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-12-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-10-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-7-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-6019-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6020-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6021-0x000002307D9C0000-0x000002307DAC8000-memory.dmp
memory/2516-6022-0x000002307DAD0000-0x000002307DBD4000-memory.dmp
memory/2516-6023-0x000002307B330000-0x000002307B37C000-memory.dmp
memory/2516-6025-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6026-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6027-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-16-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-6-0x000002307D540000-0x000002307D8BB000-memory.dmp
memory/2516-9-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-5-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6028-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6029-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6030-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6031-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-6033-0x000002307CDF0000-0x000002307CE44000-memory.dmp
memory/2516-9866-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-4-0x000002307D540000-0x000002307D8C2000-memory.dmp
memory/2516-3-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-2-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp
memory/2516-0-0x000002307A8F0000-0x000002307ADEE000-memory.dmp
memory/2516-1-0x00007FFF18B8F000-0x00007FFF18B90000-memory.dmp
memory/4164-14893-0x0000020EE1C10000-0x0000020EE1C2E000-memory.dmp
memory/4164-14894-0x0000020EE16B0000-0x0000020EE16BA000-memory.dmp
memory/4164-14895-0x0000020EE1C30000-0x0000020EE1C4C000-memory.dmp
memory/4164-14896-0x0000020EE1BF0000-0x0000020EE1BF8000-memory.dmp
memory/4164-14897-0x0000020EE1C00000-0x0000020EE1C06000-memory.dmp
memory/4164-14898-0x0000020EE1C50000-0x0000020EE1C5A000-memory.dmp
memory/6140-14885-0x0000020D5BE60000-0x0000020D5BF12000-memory.dmp
memory/6140-14886-0x0000020D5BF20000-0x0000020D5BF2A000-memory.dmp
memory/6140-14884-0x0000020D43B30000-0x0000020D43B4E000-memory.dmp
memory/6140-14881-0x0000020D43AE0000-0x0000020D43B02000-memory.dmp