Analysis
- user interaction
yes - max time kernel
4s - max time network
3s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 11:33
Errors
Reason
Machine shutdown
General
- Target malwa.ps1
- Size 2KB
- Sample260424-nn7plagv2x
- SHA256 6762bb560ee0b32053e870f91cb229ec8c8f54fc2d130e10848a932d07c0bc39
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malwa.ps11⤵
- Badlisted process makes network request
- Sets desktop wallpaper using registry
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5qnhe1yo\5qnhe1yo.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14BC.tmp" "c:\Users\Admin\AppData\Local\Temp\5qnhe1yo\CSCAEC997C172E744819D127B73B7537825.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5qnhe1yo.dll
RES14BC.tmp
__PSScriptPolicyTest_gov2pw3c.qhr.ps1
5qnhe1yo.0.cs
5qnhe1yo.cmdline
CSCAEC997C172E744819D127B73B7537825.TMP
memory/4276-20-0x0000024C45FD0000-0x0000024C45FDC000-memory.dmp
memory/5048-9-0x000001A4F4920000-0x000001A4F4930000-memory.dmp
memory/5048-1-0x000001A4F4920000-0x000001A4F4930000-memory.dmp
memory/5048-7-0x000001A4F4A30000-0x000001A4F4A52000-memory.dmp
memory/5048-0-0x000001A4F4920000-0x000001A4F4930000-memory.dmp
memory/5048-25-0x000001A4F4AB0000-0x000001A4F4AB8000-memory.dmp
memory/5988-23-0x000001F4A91B0000-0x000001F4A91BC000-memory.dmp