Analysis
- max time kernel
298s - max time network
122s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
31/10/2026, 23:26
General
- Target task_354.exe
- Size 2.2MB
- Sample261031-3ettpsey8w
- SHA256 d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\task_354.exe"C:\Users\Admin\AppData\Local\Temp\task_354.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ScpIKWJZQ0ag\MicrosoftEdgeUpdate.exe"C:\ProgramData\ScpIKWJZQ0ag\MicrosoftEdgeUpdate.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ScpIKWJZQ0ag'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\ScpIKWJZQ0ag\MicrosoftEdgeUpdate.exeC:\ProgramData\ScpIKWJZQ0ag\MicrosoftEdgeUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\ScpIKWJZQ0ag\MicrosoftEdgeUpdate.exeC:\ProgramData\ScpIKWJZQ0ag\MicrosoftEdgeUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MicrosoftEdgeUpdate.exe
__PSScriptPolicyTest_s03pqx4e.2no.ps1
memory/2492-31-0x0000016D55860000-0x0000016D5586A000-memory.dmp
memory/2492-41-0x0000016D55880000-0x0000016D55888000-memory.dmp
memory/2492-14-0x0000016D38DB0000-0x0000016D38DC0000-memory.dmp
memory/2492-15-0x0000016D38DB0000-0x0000016D38DC0000-memory.dmp
memory/2492-22-0x0000016D556D0000-0x0000016D556F2000-memory.dmp
memory/2492-43-0x0000016D558C0000-0x0000016D558CA000-memory.dmp
memory/2492-29-0x0000016D55780000-0x0000016D5579C000-memory.dmp
memory/2492-30-0x0000016D557A0000-0x0000016D55853000-memory.dmp
memory/2492-42-0x0000016D558B0000-0x0000016D558B6000-memory.dmp
memory/2492-33-0x0000016D55890000-0x0000016D558AC000-memory.dmp
memory/2492-40-0x0000016D558D0000-0x0000016D558EA000-memory.dmp
memory/2492-39-0x0000016D55870000-0x0000016D5587A000-memory.dmp
memory/3988-72-0x0000000000400000-0x0000000000635000-memory.dmp
memory/5212-38-0x0000000000400000-0x0000000000635000-memory.dmp
memory/5380-13-0x0000000002360000-0x0000000002402000-memory.dmp
memory/5380-47-0x0000000000400000-0x0000000000635000-memory.dmp
memory/5536-4-0x0000000000CF0000-0x0000000000D92000-memory.dmp
memory/5536-1-0x0000000000400000-0x0000000000635000-memory.dmp
memory/5536-46-0x0000000000400000-0x0000000000635000-memory.dmp