Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 12:11
General
- Target install.ps1
- Size 10KB
- Sample260529-pc33psa19v
- SHA256 8ea0b52fbda713bf8b51b4661d9df867b2a6e5cf1307fbead46c52f36e8942e4
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bw2rg1on.nnb.ps1
memory/4144-19-0x00000212BF460000-0x00000212BF46A000-memory.dmp
memory/4144-21-0x00000212BF8E0000-0x00000212BF8FC000-memory.dmp
memory/4144-8-0x00000212A4110000-0x00000212A4BD2000-memory.dmp
memory/4144-9-0x00000212A4110000-0x00000212A4BD2000-memory.dmp
memory/4144-10-0x00000212A4110000-0x00000212A4BD2000-memory.dmp
memory/4144-17-0x00000212BF480000-0x00000212BF49C000-memory.dmp
memory/4144-18-0x00000212BF6B0000-0x00000212BF763000-memory.dmp
memory/4144-0-0x00000212A48DA000-0x00000212A48DB000-memory.dmp
memory/4144-7-0x00000212BF3F0000-0x00000212BF412000-memory.dmp
memory/4144-22-0x00000212BF470000-0x00000212BF47A000-memory.dmp
memory/4144-20-0x00000212A4110000-0x00000212A4BD2000-memory.dmp
memory/4144-23-0x00000212BFA00000-0x00000212BFA1A000-memory.dmp
memory/4144-24-0x00000212BF8C0000-0x00000212BF8C8000-memory.dmp
memory/4144-25-0x00000212BF8D0000-0x00000212BF8D6000-memory.dmp
memory/4144-26-0x00000212BFA20000-0x00000212BFA2A000-memory.dmp
memory/4144-27-0x00000212A4110000-0x00000212A4BD2000-memory.dmp
memory/4144-31-0x00000212A4110000-0x00000212A4BD2000-memory.dmp