Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
30/05/2026, 04:39
General
- Target shell.ps1
- Size 46KB
- Sample260530-e99lmsd121
- SHA256 83ca6569abe7a4f912cba89f2fd47bc08da22a1c0a75b574fb2964d31119e19c
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\shell.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L https://github.com/msys2/msys2-installer/releases/download/2024-05-07/msys2-base-x86_64-20240507.tar.xz -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MSYS2\msys2.tar.xz" --fail --silent --show-error --max-time 600 --retry 2 --retry-delay 52⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_j5gcjqlk.35p.ps1
memory/4608-20-0x000002017C630000-0x000002017C65A000-memory.dmp
memory/4608-22-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-9-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-10-0x00007FF480250000-0x00007FF480260000-memory.dmp
memory/4608-17-0x000002011A330000-0x000002011A34C000-memory.dmp
memory/4608-18-0x000002011A350000-0x000002011A403000-memory.dmp
memory/4608-19-0x000002017C460000-0x000002017C46A000-memory.dmp
memory/4608-21-0x000002017C630000-0x000002017C654000-memory.dmp
memory/4608-1-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-8-0x000002017C490000-0x000002017C4B2000-memory.dmp
memory/4608-26-0x000002017E210000-0x000002017E3D2000-memory.dmp
memory/4608-27-0x000002011ADF0000-0x000002011B318000-memory.dmp
memory/4608-28-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-36-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-35-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-37-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-38-0x00007FF480250000-0x00007FF480260000-memory.dmp
memory/4608-39-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-40-0x000002017C480000-0x000002017C490000-memory.dmp
memory/4608-0-0x000002017C480000-0x000002017C490000-memory.dmp