Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 02:38
General
- Target trigger.ps1
- Size 5KB
- Sample260416-c4txwset9r
- SHA256 28c1c704504015f0e8ffa9884eab52aab3d526abd30587c50f6564d32cd7bc6d
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Clipboard Data 1 TTPs 1 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Invoke-Expression(Get-Clipboard | Out-String | % { .Substring(200) });"2⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\424z4tt5\424z4tt5.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19DC.tmp" "c:\Users\Admin\AppData\Local\Temp\424z4tt5\CSC413AF9A67D542898941F73299F6C43E.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PowerShell.exe.log
StartupProfileData-NonInteractive
424z4tt5.dll
RES19DC.tmp
__PSScriptPolicyTest_sopavnf5.mzq.ps1
424z4tt5.0.cs
424z4tt5.cmdline
CSC413AF9A67D542898941F73299F6C43E.TMP
memory/492-65-0x000002C62AAD0000-0x000002C62AAF4000-memory.dmp
memory/492-56-0x000002C6122D0000-0x000002C6122D8000-memory.dmp
memory/492-78-0x000002C610A20000-0x000002C610A2C000-memory.dmp
memory/492-80-0x000002C62AA70000-0x000002C62AAC6000-memory.dmp
memory/492-0-0x000002C612240000-0x000002C612250000-memory.dmp
memory/492-2-0x000002C6122F0000-0x000002C612312000-memory.dmp
memory/492-72-0x000002C610A20000-0x000002C610A2C000-memory.dmp
memory/492-73-0x000002C612280000-0x000002C612292000-memory.dmp
memory/492-74-0x000002C62AA70000-0x000002C62AAC6000-memory.dmp
memory/492-71-0x000002C62B8B0000-0x000002C62BDD8000-memory.dmp
memory/492-70-0x000002C62B360000-0x000002C62B37A000-memory.dmp
memory/492-69-0x000002C62A990000-0x000002C62A9A0000-memory.dmp
memory/492-68-0x000002C612240000-0x000002C612250000-memory.dmp
memory/492-66-0x000002C612240000-0x000002C612250000-memory.dmp
memory/492-67-0x000002C612240000-0x000002C612250000-memory.dmp
memory/492-1-0x000002C612240000-0x000002C612250000-memory.dmp
memory/492-64-0x000002C62AAD0000-0x000002C62AAFA000-memory.dmp
memory/492-63-0x000002C62A9B0000-0x000002C62AA63000-memory.dmp
memory/492-9-0x000002C612240000-0x000002C612250000-memory.dmp
memory/2504-35-0x000002404F2E0000-0x000002404F2F0000-memory.dmp
memory/2504-39-0x0000024036BE0000-0x0000024036BF2000-memory.dmp
memory/2504-27-0x000002404F660000-0x000002404F713000-memory.dmp
memory/2504-10-0x000002404F2E0000-0x000002404F2F0000-memory.dmp
memory/2504-28-0x000002404F300000-0x000002404F30A000-memory.dmp
memory/2504-11-0x000002404F2E0000-0x000002404F2F0000-memory.dmp
memory/2504-18-0x000002404F2E0000-0x000002404F2F0000-memory.dmp
memory/2504-19-0x00007FF4E9480000-0x00007FF4E9490000-memory.dmp
memory/2504-38-0x0000024036B50000-0x0000024036B5C000-memory.dmp
memory/2504-29-0x000002404F8D0000-0x000002404F8EC000-memory.dmp
memory/2504-40-0x000002404F870000-0x000002404F8C6000-memory.dmp
memory/2504-26-0x000002404F310000-0x000002404F32C000-memory.dmp
memory/2504-34-0x000002404F900000-0x000002404F90A000-memory.dmp
memory/2504-33-0x000002404F8F0000-0x000002404F8F6000-memory.dmp
memory/2504-32-0x000002404F340000-0x000002404F348000-memory.dmp
memory/2504-31-0x000002404F910000-0x000002404F92A000-memory.dmp
memory/2504-30-0x000002404F330000-0x000002404F33A000-memory.dmp
memory/5460-54-0x0000012C81750000-0x0000012C8175C000-memory.dmp
memory/5460-53-0x0000012CFF3F0000-0x0000012CFF768000-memory.dmp
memory/5852-50-0x0000011FF3B00000-0x0000011FF3B0C000-memory.dmp