Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 11:27
General
- Target QTTRY - BXD-26V-0154-1.pif.exe
- Size 836KB
- Sample261014-nkh7tscs7v
- SHA256 e9ae2f17b2926e49768e787b1802282a32625244746713c32c7d6d32c225cf0e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QTTRY - BXD-26V-0154-1.pif.exe"C:\Users\Admin\AppData\Local\Temp\QTTRY - BXD-26V-0154-1.pif.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\QTTRY - BXD-26V-0154-1.pif.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\QTTRY - BXD-26V-0154-1.pif.exe"C:\Users\Admin\AppData\Local\Temp\QTTRY - BXD-26V-0154-1.pif.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_fzgjj5b5.3xd.psm1
memory/2964-18-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-1-0x00000265B7380000-0x00000265B7456000-memory.dmp
memory/2964-3-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-4-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-5-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-6-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-7-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-8-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-9-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-10-0x00000265B7960000-0x00000265B7970000-memory.dmp
memory/2964-11-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-12-0x00000265D50E0000-0x00000265D516A000-memory.dmp
memory/2964-13-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-14-0x00000265D56A0000-0x00000265D5BC8000-memory.dmp
memory/2964-15-0x00000265D5BD0000-0x00000265D609C000-memory.dmp
memory/2964-16-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-2-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/2964-0-0x00007FFF3E14F000-0x00007FFF3E150000-memory.dmp
memory/4152-17-0x0000000140000000-0x000000014004A000-memory.dmp
memory/4744-20-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-31-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-24-0x000001D2D45D0000-0x000001D2D45F2000-memory.dmp
memory/4744-25-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-26-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-27-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-28-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-29-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-30-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-19-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-32-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-33-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-36-0x000001D2D4690000-0x000001D2D46AE000-memory.dmp
memory/4744-21-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-38-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-39-0x000001D2ECBC0000-0x000001D2ECBCA000-memory.dmp
memory/4744-37-0x000001D2ECB00000-0x000001D2ECBB2000-memory.dmp
memory/4744-40-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/4744-42-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp