Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 22:15
General
- Target 205973bec933a3388430ea2e09928122c64bc2b448dcd9c4cde8b43adc52d861.ps1
- Size 5KB
- Sample260511-158pfaey5p
- SHA256 205973bec933a3388430ea2e09928122c64bc2b448dcd9c4cde8b43adc52d861
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\205973bec933a3388430ea2e09928122c64bc2b448dcd9c4cde8b43adc52d861.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_y0kfx42v.xnt.ps1
memory/3828-29-0x0000020975EB0000-0x0000020975ECC000-memory.dmp
memory/3828-21-0x0000020975EC0000-0x0000020975EE4000-memory.dmp
memory/3828-0-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-9-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-10-0x00007FF41A9E0000-0x00007FF41A9F0000-memory.dmp
memory/3828-17-0x0000020975E50000-0x0000020975E6C000-memory.dmp
memory/3828-18-0x0000020976150000-0x0000020976203000-memory.dmp
memory/3828-30-0x0000020976A30000-0x0000020976BF2000-memory.dmp
memory/3828-1-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-20-0x0000020975EC0000-0x0000020975EEA000-memory.dmp
memory/3828-3-0x0000020975DC0000-0x0000020975DE2000-memory.dmp
memory/3828-22-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-19-0x0000020975E70000-0x0000020975E7A000-memory.dmp
memory/3828-31-0x0000020977130000-0x0000020977658000-memory.dmp
memory/3828-32-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-33-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-34-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-35-0x00007FF41A9E0000-0x00007FF41A9F0000-memory.dmp
memory/3828-36-0x0000020975E80000-0x0000020975E90000-memory.dmp
memory/3828-38-0x000002095BE90000-0x000002095BE9C000-memory.dmp
memory/3828-37-0x000002095BDA0000-0x000002095BDD1000-memory.dmp
memory/3828-39-0x000002095D7D0000-0x000002095D7E2000-memory.dmp
memory/3828-40-0x0000020975E80000-0x0000020975E90000-memory.dmp