Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 06:55
General
- Target ZgTZ3L1tlr2M3fe.exe
- Size 3.2MB
- Sample260818-hpt71afp21
- SHA256 366e9dc605701e0f251fe27362975961c6da960f4da262eb9a1693bbd9bf318a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe"C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exeC:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$skunrj=$env:COMPUTERNAME;$n4bwek=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$skunrj=$env:COMPUTERNAME;$ksmczc=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHRTUFJtUFFDSS5leGU=')));$la050z=2886;& $n4bwek -FilePath $ksmczc"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe"C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exeC:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2pw1waic.zil.ps1
tSPRmPQCI.exe
memory/1108-37-0x000001A0AB6F0000-0x000001A0AB7A2000-memory.dmp
memory/1108-38-0x000001A0AB7B0000-0x000001A0AB7BA000-memory.dmp
memory/1108-44-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-36-0x000001A0AB6D0000-0x000001A0AB6EE000-memory.dmp
memory/1108-23-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-33-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-28-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-32-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-26-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-12-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-13-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-16-0x000001A092FE0000-0x000001A093002000-memory.dmp
memory/1108-17-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-18-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-30-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-20-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-29-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-21-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/1108-31-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2204-41-0x00000279B58C0000-0x00000279B58E4000-memory.dmp
memory/2204-52-0x00000279B6400000-0x00000279B65CA000-memory.dmp
memory/2204-49-0x00000279B6400000-0x00000279B65CA000-memory.dmp
memory/2204-45-0x00000279B6400000-0x00000279B65CA000-memory.dmp
memory/2512-19-0x0000000140000000-0x000000014025C000-memory.dmp
memory/2752-55-0x0000027E5E3B0000-0x0000027E5E462000-memory.dmp
memory/2812-10-0x000002379AD40000-0x000002379AF0A000-memory.dmp
memory/2812-1-0x00000237FEF90000-0x00000237FF2CC000-memory.dmp
memory/2812-0-0x00007FFD8D74F000-0x00007FFD8D750000-memory.dmp
memory/2812-22-0x000002379AD40000-0x000002379AF0A000-memory.dmp
memory/2812-6-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-7-0x000002379AD40000-0x000002379AF0A000-memory.dmp
memory/2812-2-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-8-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-5-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-9-0x000002379BCB0000-0x000002379BFAA000-memory.dmp
memory/2812-3-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-11-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-27-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/2812-4-0x0000023781A40000-0x0000023781A64000-memory.dmp