Analysis
- user interaction
yes - max time kernel
270s - max time network
263s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 08:56
General
- Target script.ps1
- Size 11KB
- Sample260417-kwfpasas5m
- SHA256 f1edff0290afc18596ec5caf5dc6dc6069f28639ef606824e3a6948beb60027b
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /enum2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_gybxn0wm.izy.ps1
memory/3264-58-0x0000015EF0840000-0x0000015EF0850000-memory.dmp
memory/3264-67-0x0000015EF0650000-0x0000015EF06FF000-memory.dmp
memory/3264-68-0x0000015EF0150000-0x0000015EF0162000-memory.dmp
memory/3264-66-0x0000015EF00E0000-0x0000015EF00EC000-memory.dmp
memory/3264-57-0x0000015EF0840000-0x0000015EF0850000-memory.dmp
memory/5316-28-0x0000018D83840000-0x0000018D838EF000-memory.dmp
memory/5316-39-0x0000018D9C500000-0x0000018D9C50A000-memory.dmp
memory/5316-21-0x0000018D9C530000-0x0000018D9C554000-memory.dmp
memory/5316-20-0x0000018D9C530000-0x0000018D9C55A000-memory.dmp
memory/5316-22-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-24-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-23-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-25-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-26-0x00007FF48B950000-0x00007FF48B960000-memory.dmp
memory/5316-27-0x0000018D81F90000-0x0000018D81F9C000-memory.dmp
memory/5316-29-0x0000018D83780000-0x0000018D83792000-memory.dmp
memory/5316-1-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-30-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-31-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-38-0x0000018D9C520000-0x0000018D9C53C000-memory.dmp
memory/5316-19-0x0000018D9C3A0000-0x0000018D9C3AA000-memory.dmp
memory/5316-40-0x0000018D9C560000-0x0000018D9C57A000-memory.dmp
memory/5316-41-0x0000018D9C510000-0x0000018D9C518000-memory.dmp
memory/5316-42-0x0000018D9C540000-0x0000018D9C546000-memory.dmp
memory/5316-43-0x0000018D9C550000-0x0000018D9C55A000-memory.dmp
memory/5316-48-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-55-0x0000018D9CB00000-0x0000018D9CC76000-memory.dmp
memory/5316-56-0x0000018D9CE90000-0x0000018D9D09A000-memory.dmp
memory/5316-18-0x0000018D9C2E0000-0x0000018D9C393000-memory.dmp
memory/5316-17-0x0000018D9C2C0000-0x0000018D9C2DC000-memory.dmp
memory/5316-16-0x00007FF48B950000-0x00007FF48B960000-memory.dmp
memory/5316-9-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-7-0x0000018D9BEF0000-0x0000018D9BF12000-memory.dmp
memory/5316-0-0x0000018D837B0000-0x0000018D837C0000-memory.dmp
memory/5316-71-0x0000018D81F90000-0x0000018D81F9C000-memory.dmp
memory/5316-72-0x0000018D83840000-0x0000018D838EF000-memory.dmp