Analysis
- max time kernel
155s - max time network
157s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
01/11/2026, 21:53
General
- Target run.ps1
- Size 8KB
- Sample261101-1rtclazy7q
- SHA256 8d06d0ec4e6aa9f4ee6a8dad57ad7b5f82a46e336414000babf1ec0e19f5e9ff
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 54 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\python_installer.exe"C:\Users\Admin\AppData\Local\Temp\python_installer.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_test=02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{763D3839-DCC8-4BE4-B778-6187085981FF}\.cr\python_installer.exe"C:\Windows\Temp\{763D3839-DCC8-4BE4-B778-6187085981FF}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python_installer.exe" -burn.filehandle.attached=536 -burn.filehandle.self=532 /quiet InstallAllUsers=1 PrependPath=1 Include_test=03⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F57EAF43-5941-4D24-B03E-7C5961E09FD3}\.be\python-3.11.7-amd64.exe"C:\Windows\Temp\{F57EAF43-5941-4D24-B03E-7C5961E09FD3}\.be\python-3.11.7-amd64.exe" -q -burn.elevated BurnPipe.{C138AF95-5517-4788-82EE-20E175421359} {134B017B-8E7B-44EF-9B0E-937E6CF03717} 29844⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kciokbdy.c3u.ps1
python_installer.exe
python_installer.exe
PythonBA.dll
SideBar.png
memory/2544-21-0x0000020C38A00000-0x0000020C38A0A000-memory.dmp
memory/2544-12-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-13-0x00007FF4F0950000-0x00007FF4F0960000-memory.dmp
memory/2544-0-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-22-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-23-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-24-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-25-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-26-0x00007FF4F0950000-0x00007FF4F0960000-memory.dmp
memory/2544-11-0x0000020C389F0000-0x0000020C38A14000-memory.dmp
memory/2544-10-0x0000020C389F0000-0x0000020C38A1A000-memory.dmp
memory/2544-9-0x0000020C37270000-0x0000020C37280000-memory.dmp
memory/2544-8-0x0000020C37E00000-0x0000020C37E22000-memory.dmp