Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 18:12
General
- Target Get.ps1
- Size 8KB
- Sample260423-wtlnbaew4x
- SHA256 115299a23b94d57bcf64e60117cf8f17e5cda21b3b8c69d062e968f6863c1227
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Get.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Win11Debloat\Win11Debloat.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
Features.json
Win11Debloat.ps1
__PSScriptPolicyTest_qbrjyqfm.lt1.ps1
memory/2428-24-0x000001C8407A0000-0x000001C8407AA000-memory.dmp
memory/2428-265-0x000001C840080000-0x000001C840090000-memory.dmp
memory/2428-11-0x000001C840F20000-0x000001C841448000-memory.dmp
memory/2428-13-0x00007FF4BB470000-0x00007FF4BB480000-memory.dmp
memory/2428-20-0x000001C8407B0000-0x000001C8407CC000-memory.dmp
memory/2428-21-0x000001C8409F0000-0x000001C840AA3000-memory.dmp
memory/2428-22-0x000001C8407A0000-0x000001C8407AA000-memory.dmp
memory/2428-23-0x000001C8407B0000-0x000001C8407C2000-memory.dmp
memory/2428-669-0x00007FF4BB470000-0x00007FF4BB480000-memory.dmp
memory/2428-10-0x000001C840820000-0x000001C8409E2000-memory.dmp
memory/2428-370-0x000001C840080000-0x000001C840090000-memory.dmp
memory/2428-471-0x000001C840080000-0x000001C840090000-memory.dmp
memory/2428-580-0x000001C8262A0000-0x000001C8262AC000-memory.dmp
memory/2428-582-0x000001C840200000-0x000001C840212000-memory.dmp
memory/2428-581-0x000001C83FFD0000-0x000001C84007F000-memory.dmp
memory/2428-9-0x000001C840080000-0x000001C840090000-memory.dmp
memory/2428-0-0x000001C840080000-0x000001C840090000-memory.dmp
memory/2428-694-0x000001C83FFD0000-0x000001C84007F000-memory.dmp
memory/2428-7-0x000001C840250000-0x000001C840272000-memory.dmp
memory/2428-1-0x000001C840080000-0x000001C840090000-memory.dmp
memory/3644-659-0x000001FA613B0000-0x000001FA613C0000-memory.dmp
memory/3644-670-0x00007FF438710000-0x00007FF438720000-memory.dmp
memory/3644-684-0x000001FA7A070000-0x000001FA7A08C000-memory.dmp
memory/3644-685-0x000001FA7A060000-0x000001FA7A06A000-memory.dmp
memory/3644-686-0x000001FA7A0B0000-0x000001FA7A0CA000-memory.dmp
memory/3644-687-0x000001FA7A090000-0x000001FA7A098000-memory.dmp
memory/3644-688-0x000001FA7A0A0000-0x000001FA7A0A6000-memory.dmp
memory/3644-689-0x000001FA7A0D0000-0x000001FA7A0DA000-memory.dmp
memory/3644-691-0x000001FA613B0000-0x000001FA613C0000-memory.dmp
memory/3644-692-0x000001FA613B0000-0x000001FA613C0000-memory.dmp
memory/3644-667-0x000001FA613B0000-0x000001FA613C0000-memory.dmp
memory/3644-696-0x000001FA613B0000-0x000001FA613C0000-memory.dmp
memory/3644-698-0x000001FA61380000-0x000001FA6138C000-memory.dmp
memory/3644-699-0x000001FA613C0000-0x000001FA613D2000-memory.dmp
memory/3644-700-0x00007FF438710000-0x00007FF438720000-memory.dmp
memory/3644-697-0x000001FA5F9D0000-0x000001FA5FA7F000-memory.dmp
memory/3644-660-0x000001FA613B0000-0x000001FA613C0000-memory.dmp