Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 23:59
General
- Target 9202ff232cfbfffc1993057f2e43764b4caabc74bf5deaf5181aa4001b2865a7.exe
- Size 3.2MB
- Sample260910-31qzyaxfmc
- SHA256 9202ff232cfbfffc1993057f2e43764b4caabc74bf5deaf5181aa4001b2865a7
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9202ff232cfbfffc1993057f2e43764b4caabc74bf5deaf5181aa4001b2865a7.exe"C:\Users\Admin\AppData\Local\Temp\9202ff232cfbfffc1993057f2e43764b4caabc74bf5deaf5181aa4001b2865a7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p2570826261393729398112238164 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "installer.exe"3⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\installer.exe"installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\StackTrace\IsCompleted.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -Force ; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\StackTrace\IsCompleted.exe' -Force"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\StackTrace\IsCompleted.exeC:\Users\Admin\AppData\Roaming\StackTrace\IsCompleted.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\StackTrace\IsCompleted.exe"C:\Users\Admin\AppData\Roaming\StackTrace\IsCompleted.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_jtczryxt.l4h.ps1
7z.dll
7z.exe
ANTIAV~1.DAT
file_1.zip
file_2.zip
file.bin
installer.exe
main.bat
memory/468-2881-0x00000197B4980000-0x00000197B498A000-memory.dmp
memory/468-2880-0x00000197B4BB0000-0x00000197B4C62000-memory.dmp
memory/468-2879-0x00000197B4B90000-0x00000197B4BAE000-memory.dmp
memory/468-2876-0x00000197B48F0000-0x00000197B4912000-memory.dmp
memory/1156-98-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-84-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-189-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-186-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-180-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-179-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-176-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-172-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-170-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-158-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-154-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-141-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-138-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-134-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-133-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-130-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-128-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-126-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-124-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-122-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-118-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-116-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-114-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-112-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-111-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-108-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-106-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-104-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-102-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-100-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-197-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-96-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-94-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-92-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-90-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-88-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-86-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-192-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-83-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-77-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-75-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-72-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-70-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-66-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-64-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-62-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-60-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-58-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-56-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-54-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-52-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-50-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-49-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-46-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-44-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-137-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-120-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-80-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-78-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-68-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-2871-0x0000000003300000-0x0000000003356000-memory.dmp
memory/1156-2872-0x00000000034A0000-0x00000000034EC000-memory.dmp
memory/1156-2873-0x0000000003510000-0x0000000003564000-memory.dmp
memory/1156-198-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-201-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-160-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-43-0x0000000003390000-0x000000000349B000-memory.dmp
memory/1156-42-0x0000000003390000-0x000000000349E000-memory.dmp
memory/1156-41-0x00000000009C0000-0x0000000000A70000-memory.dmp
memory/4280-2888-0x000001A82CE40000-0x000001A82CE5E000-memory.dmp
memory/4280-2889-0x000001A82C860000-0x000001A82C86A000-memory.dmp
memory/4280-2890-0x000001A82CE60000-0x000001A82CE7C000-memory.dmp
memory/4280-2891-0x000001A82CE20000-0x000001A82CE28000-memory.dmp
memory/4280-2892-0x000001A82CE30000-0x000001A82CE36000-memory.dmp
memory/4280-2893-0x000001A82CE80000-0x000001A82CE8A000-memory.dmp