Analysis
- max time kernel
149s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 08:53
General
- Target jensydesign.com.ps1
- Size 18KB
- Sample260510-ktfxaact9s
- SHA256 ec39ccc54182ff595b683f542d08951a62b765bf6efa8d59dc5ae16ec7d27bae
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jensydesign.com.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\nencpmxrc__upd_awep_\psl.exe"C:\Users\Admin\AppData\Local\nencpmxrc__upd_awep_\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\nencpmxrc__upd_awep_\psl.exe"C:\Users\Admin\AppData\Local\nencpmxrc__upd_awep_\psl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\xkpsm.sysC:\Windows\Temp\xkpsm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Roaming\SystemsContrcheck" & "C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe"C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AddInProcess32.exe.log
1c01ae8484db55e7.tmp
__PSScriptPolicyTest_2wqiqqmd.byv.ps1
npmbxgrlq_orctb_ptsub.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msys-2.0.dll
msys-iconv-2.dll
msys-idn2-0.dll
msys-intl-8.dll
msys-psl-5.dll
msys-unistring-5.dll
psl.exe
xkpsm.sys
memory/232-108-0x0000000000010000-0x0000000000018000-memory.dmp
memory/392-25-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-0-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-31-0x00007FF40AF80000-0x00007FF40AF90000-memory.dmp
memory/392-32-0x000001C4ECD00000-0x000001C4ECD0A000-memory.dmp
memory/392-33-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-34-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-41-0x000001C4ECD30000-0x000001C4ECD42000-memory.dmp
memory/392-29-0x000001C4EC4D0000-0x000001C4EC4E2000-memory.dmp
memory/392-27-0x000001C4EAD50000-0x000001C4EAD81000-memory.dmp
memory/392-28-0x000001C4EC430000-0x000001C4EC43C000-memory.dmp
memory/392-102-0x000001C4EAD50000-0x000001C4EAD81000-memory.dmp
memory/392-105-0x000001C4ECBA0000-0x000001C4ECBA9000-memory.dmp
memory/392-103-0x000001C4EC430000-0x000001C4EC43C000-memory.dmp
memory/392-26-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-1-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-24-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-23-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-22-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-21-0x000001C4ED190000-0x000001C4ED1B4000-memory.dmp
memory/392-7-0x000001C4ECB10000-0x000001C4ECB32000-memory.dmp
memory/392-9-0x000001C4EC4B0000-0x000001C4EC4C0000-memory.dmp
memory/392-30-0x000001C4ECBA0000-0x000001C4ECBA9000-memory.dmp
memory/392-10-0x00007FF40AF80000-0x00007FF40AF90000-memory.dmp
memory/392-20-0x000001C4ED190000-0x000001C4ED1BA000-memory.dmp
memory/392-19-0x000001C4ECCF0000-0x000001C4ECCFA000-memory.dmp
memory/392-18-0x000001C4ECF80000-0x000001C4ED033000-memory.dmp
memory/392-17-0x000001C4ECD00000-0x000001C4ECD1C000-memory.dmp
memory/2172-164-0x00007FF90B900000-0x00007FF90BB09000-memory.dmp
memory/2172-170-0x00007FF90A970000-0x00007FF90ACE8000-memory.dmp
memory/2172-183-0x000001F8933F0000-0x000001F893421000-memory.dmp
memory/2172-166-0x00007FF9097C0000-0x00007FF90986E000-memory.dmp
memory/2172-182-0x00007FF6D46B0000-0x00007FF6D46C5000-memory.dmp
memory/2172-165-0x00007FF90AE40000-0x00007FF90AEFD000-memory.dmp
memory/2172-167-0x00007FF90A720000-0x00007FF90A8BA000-memory.dmp
memory/2272-184-0x00007FF90B900000-0x00007FF90BB09000-memory.dmp
memory/2272-197-0x000002D87E690000-0x000002D87E6C1000-memory.dmp
memory/2272-185-0x00007FF90AE40000-0x00007FF90AEFD000-memory.dmp
memory/2272-188-0x00007FF90A970000-0x00007FF90ACE8000-memory.dmp
memory/2272-187-0x00007FF90A720000-0x00007FF90A8BA000-memory.dmp
memory/2272-186-0x00007FF9097C0000-0x00007FF90986E000-memory.dmp
memory/2272-196-0x00007FF74D7E0000-0x00007FF74D7F5000-memory.dmp
memory/3332-135-0x00007FF90AE40000-0x00007FF90AEFD000-memory.dmp
memory/3332-138-0x00007FF90A970000-0x00007FF90ACE8000-memory.dmp
memory/3332-179-0x000001DD316C0000-0x000001DD316F1000-memory.dmp
memory/3332-136-0x00007FF9097C0000-0x00007FF90986E000-memory.dmp
memory/3332-178-0x00007FF6D46B0000-0x00007FF6D46C5000-memory.dmp
memory/3332-137-0x00007FF90A720000-0x00007FF90A8BA000-memory.dmp
memory/3332-134-0x00007FF90B900000-0x00007FF90BB09000-memory.dmp
memory/3360-177-0x0000000004CE0000-0x0000000004D12000-memory.dmp
memory/3360-206-0x0000000004EA0000-0x0000000004F61000-memory.dmp
memory/3360-199-0x0000000004EA0000-0x0000000004F61000-memory.dmp
memory/4200-173-0x0000000005210000-0x00000000052D8000-memory.dmp
memory/4200-194-0x0000000006490000-0x0000000006522000-memory.dmp
memory/4200-195-0x0000000006AE0000-0x0000000007086000-memory.dmp
memory/4200-190-0x00000000055E0000-0x0000000005646000-memory.dmp
memory/4200-169-0x0000000000720000-0x00000000007AC000-memory.dmp
memory/4200-198-0x0000000005140000-0x0000000005201000-memory.dmp
memory/4200-171-0x00000000050C0000-0x0000000005136000-memory.dmp
memory/4200-174-0x0000000005300000-0x0000000005332000-memory.dmp
memory/4200-176-0x0000000005520000-0x000000000556C000-memory.dmp
memory/4912-204-0x00000000054B0000-0x0000000005571000-memory.dmp
memory/4912-211-0x00000000054B0000-0x0000000005571000-memory.dmp