Resubmissions
24/04/2026, 18:46
260424-xewemshz3m1024/04/2026, 11:26
260424-nj2yjsgt211024/04/2026, 11:21
260424-ngckwagy6m10Analysis
- max time kernel
149s - max time network
127s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 11:21
General
- Target malwa.ps1
- Size 2KB
- Sample260424-ngckwagy6m
- SHA256 c338f9bf85a973feea19d303c87457ac511a972d8c274bfb55902d76f9aa5d89
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malwa.ps11⤵
- Badlisted process makes network request
- Sets desktop wallpaper using registry
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\150oligb\150oligb.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67CD.tmp" "c:\Users\Admin\AppData\Local\Temp\150oligb\CSCD87D02A384BD4294A46059B62DDE1C6E.TMP"3⤵
-
-
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\System32\desk.cpl",2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\desk.cpl",3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ms-settings:display4⤵
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
150oligb.dll
RES67CD.tmp
__PSScriptPolicyTest_od0p2zrz.d3m.ps1
150oligb.0.cs
150oligb.cmdline
CSCD87D02A384BD4294A46059B62DDE1C6E.TMP
memory/428-44-0x00000000006E0000-0x0000000000711000-memory.dmp
memory/428-34-0x00000000006E0000-0x0000000000711000-memory.dmp
memory/908-23-0x000001D32ECA0000-0x000001D32ECAC000-memory.dmp
memory/908-22-0x000001D32E810000-0x000001D32EB88000-memory.dmp
memory/2388-35-0x00000233F2870000-0x00000233F290E000-memory.dmp
memory/2900-26-0x00000238A1F10000-0x00000238A2288000-memory.dmp
memory/3000-19-0x0000019FAA950000-0x0000019FAA95C000-memory.dmp
memory/3900-28-0x0000000000B40000-0x0000000000B71000-memory.dmp
memory/4436-25-0x0000023EB15D0000-0x0000023EB15D8000-memory.dmp
memory/4436-31-0x0000023E97570000-0x0000023E975CD000-memory.dmp
memory/4436-33-0x0000023E98EF0000-0x0000023E98F02000-memory.dmp
memory/4436-32-0x0000023E97610000-0x0000023E9761C000-memory.dmp
memory/4436-1-0x0000023E98F50000-0x0000023E98F60000-memory.dmp
memory/4436-4-0x0000023EB1540000-0x0000023EB1562000-memory.dmp
memory/4436-0-0x0000023E98F50000-0x0000023E98F60000-memory.dmp
memory/5008-27-0x000002903B3A0000-0x000002903B43E000-memory.dmp