Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 19:37
General
- Target 9333c323c3fe82695c58625412e5163cf0db4804e3740b941bde6aef4375999a.exe
- Size 176KB
- Sample260415-yb4saag19j
- SHA256 9333c323c3fe82695c58625412e5163cf0db4804e3740b941bde6aef4375999a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9333c323c3fe82695c58625412e5163cf0db4804e3740b941bde6aef4375999a.exe"C:\Users\Admin\AppData\Local\Temp\9333c323c3fe82695c58625412e5163cf0db4804e3740b941bde6aef4375999a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Expand-Archive -Force -Path '' -DestinationPath 'C:\Users\Admin\AppData\Roaming\MICROS~2'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_h2yqwhzr.i2h.ps1
memory/4884-15-0x00000214099D0000-0x00000214099DC000-memory.dmp
memory/4884-14-0x0000021409890000-0x000002140993F000-memory.dmp
memory/5008-25-0x0000022DD0030000-0x0000022DD0040000-memory.dmp
memory/5008-16-0x0000022DD0030000-0x0000022DD0040000-memory.dmp
memory/5008-23-0x0000022DE8700000-0x0000022DE8722000-memory.dmp
memory/5008-17-0x0000022DD0030000-0x0000022DD0040000-memory.dmp
memory/5008-26-0x00007FF4557B0000-0x00007FF4557C0000-memory.dmp
memory/5008-33-0x0000022DE89A0000-0x0000022DE89BC000-memory.dmp
memory/5008-34-0x0000022DE89C0000-0x0000022DE8A73000-memory.dmp
memory/5008-35-0x0000022DE8A80000-0x0000022DE8A8A000-memory.dmp
memory/5008-38-0x0000022DD0030000-0x0000022DD0040000-memory.dmp
memory/5008-42-0x0000022DE84B0000-0x0000022DE855F000-memory.dmp
memory/5008-41-0x0000022DCE720000-0x0000022DCE72C000-memory.dmp
memory/5008-43-0x0000022DD0000000-0x0000022DD0012000-memory.dmp