Analysis
- max time kernel
149s - max time network
45s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/09/2026, 07:23
General
- Target 27aef349f8314a553330a62799d5f68940ae56274124d569768549d3ec549d90.exe
- Size 731KB
- Sample260909-h77aaatwex
- SHA256 27aef349f8314a553330a62799d5f68940ae56274124d569768549d3ec549d90
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27aef349f8314a553330a62799d5f68940ae56274124d569768549d3ec549d90.exe"C:\Users\Admin\AppData\Local\Temp\27aef349f8314a553330a62799d5f68940ae56274124d569768549d3ec549d90.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwA1ADQANABrAGsAZQAuAGUAeABlACcAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwANQA0ADQAawBrAGUALgBlAHgAZQAnACkAIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBSAGUAcABlAHQAaQB0AGkAbwBuAEkAbgB0AGUAcgB2AGEAbAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAE0AaQBuAHUAdABlAHMAIAA1ACkAKQAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAHMAZQByAE4AYQBtAGUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBTAGUAYwBvAG4AZABzACAAMAApACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwApACAALQBGAG8AcgBjAGUA2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2332-0-0x0000000074482000-0x0000000074483000-memory.dmp
memory/2332-1-0x0000000000650000-0x000000000070E000-memory.dmp
memory/2332-2-0x0000000005070000-0x0000000005216000-memory.dmp
memory/2332-3-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/2332-4-0x0000000005880000-0x0000000005E98000-memory.dmp
memory/2332-6-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-14-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-16-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-18-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-52-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-84-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-108-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-112-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-130-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-129-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-126-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-124-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-122-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-120-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-118-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-116-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-114-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-110-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-104-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-102-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-100-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-96-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-92-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-90-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-88-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-86-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-106-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-98-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-95-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-82-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-78-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-76-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-72-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-70-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-68-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-67-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-64-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-62-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-60-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-58-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-80-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-75-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-56-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-51-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-48-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-44-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-42-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-40-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-38-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-36-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-32-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-30-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-26-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-24-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-20-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-54-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-46-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-34-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-28-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-22-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-12-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-10-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-8-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-5-0x0000000005070000-0x000000000520F000-memory.dmp
memory/2332-1717-0x0000000074482000-0x0000000074483000-memory.dmp
memory/2332-1936-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/2332-6767-0x00000000056C0000-0x00000000056C8000-memory.dmp
memory/3892-6768-0x0000000004860000-0x0000000004896000-memory.dmp
memory/3892-6769-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6770-0x0000000005050000-0x000000000569A000-memory.dmp
memory/3892-6771-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6772-0x00000000056E0000-0x0000000005702000-memory.dmp
memory/3892-6773-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6775-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/3892-6774-0x0000000005780000-0x00000000057E6000-memory.dmp
memory/3892-6778-0x0000000005940000-0x0000000005C9B000-memory.dmp
memory/3892-6779-0x0000000005D20000-0x0000000005D3E000-memory.dmp
memory/3892-6780-0x0000000005DF0000-0x0000000005E3C000-memory.dmp
memory/3892-6781-0x0000000006D10000-0x0000000006D46000-memory.dmp
memory/3892-6782-0x00000000703C0000-0x000000007040C000-memory.dmp
memory/3892-6785-0x0000000006340000-0x0000000006360000-memory.dmp
memory/3892-6786-0x0000000007010000-0x00000000070B3000-memory.dmp
memory/3892-6787-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6788-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6789-0x0000000007770000-0x0000000007DEC000-memory.dmp
memory/3892-6790-0x0000000007130000-0x000000000714A000-memory.dmp
memory/3892-6791-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6792-0x00000000071A0000-0x00000000071AA000-memory.dmp
memory/3892-6793-0x00000000073A0000-0x0000000007436000-memory.dmp
memory/3892-6794-0x0000000007320000-0x0000000007331000-memory.dmp
memory/3892-6795-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/3892-6797-0x0000000074470000-0x0000000074C2C000-memory.dmp