Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 10:46
General
- Target 02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff.ps1
- Size 52KB
- Sample260415-mt2j4ab17l
- SHA256 02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_musk4hih.lsu.ps1
memory/3280-21-0x0000010DA0D10000-0x0000010DA0D34000-memory.dmp
memory/3280-23-0x0000010DA0BF0000-0x0000010DA0BFA000-memory.dmp
memory/3280-8-0x0000010DA08C0000-0x0000010DA08E2000-memory.dmp
memory/3280-9-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-10-0x00007FF45A8F0000-0x00007FF45A900000-memory.dmp
memory/3280-17-0x0000010DA0BF0000-0x0000010DA0C0C000-memory.dmp
memory/3280-18-0x0000010DA0C10000-0x0000010DA0CC3000-memory.dmp
memory/3280-19-0x0000010DA0CD0000-0x0000010DA0CDA000-memory.dmp
memory/3280-20-0x0000010DA0D10000-0x0000010DA0D3A000-memory.dmp
memory/3280-24-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-1-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-22-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-0-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-25-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-26-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-27-0x0000010D881A0000-0x0000010D881AC000-memory.dmp
memory/3280-29-0x0000010DA0930000-0x0000010DA0939000-memory.dmp
memory/3280-28-0x0000010D883F0000-0x0000010D88402000-memory.dmp
memory/3280-30-0x00007FF45A8F0000-0x00007FF45A900000-memory.dmp
memory/3280-32-0x0000010D881B0000-0x0000010D881C0000-memory.dmp
memory/3280-35-0x0000010D881A0000-0x0000010D881AC000-memory.dmp
memory/3280-37-0x0000010DA0930000-0x0000010DA0939000-memory.dmp