Analysis
- max time kernel
148s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 15:55
General
- Target run.ps1
- Size 445B
- Sample260528-tc7s4sd17j
- SHA256 b2200a6985fd79b5a74984fd721a26bffb5e146420cb1367321d3db155838902
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 27 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\automation_video.mov"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hpvptrtl.s5g.ps1
automation_video.mov
memory/4768-48-0x00007FFE25E30000-0x00007FFE25EAC000-memory.dmp
memory/4768-29-0x00007FFE2F930000-0x00007FFE2F947000-memory.dmp
memory/4768-337-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-16-0x00007FFE0F89D000-0x00007FFE0F89F000-memory.dmp
memory/4768-17-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-19-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-24-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-26-0x00007FFE256B0000-0x00007FFE256E4000-memory.dmp
memory/4768-25-0x00007FF7BA1B0000-0x00007FF7BA2A8000-memory.dmp
memory/4768-33-0x00007FFE2F730000-0x00007FFE2F74D000-memory.dmp
memory/4768-34-0x00007FFE2E4A0000-0x00007FFE2E4B1000-memory.dmp
memory/4768-35-0x00007FFE25EB0000-0x00007FFE260BB000-memory.dmp
memory/4768-32-0x00007FFE2F8C0000-0x00007FFE2F8D1000-memory.dmp
memory/4768-44-0x00007FFE265A0000-0x00007FFE265B1000-memory.dmp
memory/4768-27-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-45-0x00007FFE26580000-0x00007FFE26598000-memory.dmp
memory/4768-30-0x00007FFE2F910000-0x00007FFE2F921000-memory.dmp
memory/4768-28-0x00007FFE2F950000-0x00007FFE2F968000-memory.dmp
memory/4768-43-0x00007FFE265C0000-0x00007FFE265DB000-memory.dmp
memory/4768-47-0x00007FFE26320000-0x00007FFE26387000-memory.dmp
memory/4768-287-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-46-0x00007FFE26550000-0x00007FFE26580000-memory.dmp
memory/4768-262-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-50-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-31-0x00007FFE2F8F0000-0x00007FFE2F907000-memory.dmp
memory/4768-49-0x0000023F534D0000-0x0000023F53780000-memory.dmp
memory/4768-41-0x00007FFE297E0000-0x00007FFE297F1000-memory.dmp
memory/4768-37-0x00007FFE29840000-0x00007FFE29881000-memory.dmp
memory/4768-42-0x00007FFE26670000-0x00007FFE26681000-memory.dmp
memory/4768-40-0x00007FFE29800000-0x00007FFE29811000-memory.dmp
memory/4768-39-0x00007FFE29820000-0x00007FFE29838000-memory.dmp
memory/4768-38-0x00007FFE2AF50000-0x00007FFE2AF71000-memory.dmp
memory/4768-36-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-53-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-62-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-87-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-103-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-112-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-128-0x00007FFE0F5F0000-0x00007FFE0F8A6000-memory.dmp
memory/4768-137-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-187-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/4768-237-0x00007FFE14D50000-0x00007FFE15E00000-memory.dmp
memory/5028-4-0x0000024ACC440000-0x0000024ACC462000-memory.dmp
memory/5028-0-0x0000024ACC0E0000-0x0000024ACC0F0000-memory.dmp
memory/5028-1-0x0000024ACC0E0000-0x0000024ACC0F0000-memory.dmp