Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
gf-revshell.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
gf-revshell.ps1
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target gf-revshell.ps1
- Size 642B
- Sample260602-1danbses7w
- SHA256 b823b4accdf175774b39d0a3670b9fb3a2b1b5b602a12e5d1e256ee3826d0722
- MD5 d3d04bded8a853462ae4a9022910ea00
- SHA1 57d4a2a9f0ea66a0736de307cf057c5a6baecc56
- SHA512 9ec6b94c1260570e010e5a8eca92be70615a331b1fa207dd5369a08234dde828ef09c1a0b219a6c2719b18da3d4f0004477951e690e137367aaecc254c07c828
- TLSH T157F049546DD988B8132138FBCA09EF44E0B05A93C43FEF5097C9C52ED0E355CB574169
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 1 4932 PowerShell.exe -
pid Process 4932 PowerShell.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3576 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4932 PowerShell.exe 4932 PowerShell.exe 4932 PowerShell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4932 PowerShell.exe Token: SeDebugPrivilege 3324 whoami.exe Token: SeIncreaseQuotaPrivilege 1968 WMIC.exe Token: SeSecurityPrivilege 1968 WMIC.exe Token: SeTakeOwnershipPrivilege 1968 WMIC.exe Token: SeLoadDriverPrivilege 1968 WMIC.exe Token: SeSystemProfilePrivilege 1968 WMIC.exe Token: SeSystemtimePrivilege 1968 WMIC.exe Token: SeProfSingleProcessPrivilege 1968 WMIC.exe Token: SeIncBasePriorityPrivilege 1968 WMIC.exe Token: SeCreatePagefilePrivilege 1968 WMIC.exe Token: SeBackupPrivilege 1968 WMIC.exe Token: SeRestorePrivilege 1968 WMIC.exe Token: SeShutdownPrivilege 1968 WMIC.exe Token: SeDebugPrivilege 1968 WMIC.exe Token: SeSystemEnvironmentPrivilege 1968 WMIC.exe Token: SeRemoteShutdownPrivilege 1968 WMIC.exe Token: SeUndockPrivilege 1968 WMIC.exe Token: SeManageVolumePrivilege 1968 WMIC.exe Token: 33 1968 WMIC.exe Token: 34 1968 WMIC.exe Token: 35 1968 WMIC.exe Token: 36 1968 WMIC.exe Token: SeIncreaseQuotaPrivilege 1968 WMIC.exe Token: SeSecurityPrivilege 1968 WMIC.exe Token: SeTakeOwnershipPrivilege 1968 WMIC.exe Token: SeLoadDriverPrivilege 1968 WMIC.exe Token: SeSystemProfilePrivilege 1968 WMIC.exe Token: SeSystemtimePrivilege 1968 WMIC.exe Token: SeProfSingleProcessPrivilege 1968 WMIC.exe Token: SeIncBasePriorityPrivilege 1968 WMIC.exe Token: SeCreatePagefilePrivilege 1968 WMIC.exe Token: SeBackupPrivilege 1968 WMIC.exe Token: SeRestorePrivilege 1968 WMIC.exe Token: SeShutdownPrivilege 1968 WMIC.exe Token: SeDebugPrivilege 1968 WMIC.exe Token: SeSystemEnvironmentPrivilege 1968 WMIC.exe Token: SeRemoteShutdownPrivilege 1968 WMIC.exe Token: SeUndockPrivilege 1968 WMIC.exe Token: SeManageVolumePrivilege 1968 WMIC.exe Token: 33 1968 WMIC.exe Token: 34 1968 WMIC.exe Token: 35 1968 WMIC.exe Token: 36 1968 WMIC.exe Token: SeIncreaseQuotaPrivilege 1032 WMIC.exe Token: SeSecurityPrivilege 1032 WMIC.exe Token: SeTakeOwnershipPrivilege 1032 WMIC.exe Token: SeLoadDriverPrivilege 1032 WMIC.exe Token: SeSystemProfilePrivilege 1032 WMIC.exe Token: SeSystemtimePrivilege 1032 WMIC.exe Token: SeProfSingleProcessPrivilege 1032 WMIC.exe Token: SeIncBasePriorityPrivilege 1032 WMIC.exe Token: SeCreatePagefilePrivilege 1032 WMIC.exe Token: SeBackupPrivilege 1032 WMIC.exe Token: SeRestorePrivilege 1032 WMIC.exe Token: SeShutdownPrivilege 1032 WMIC.exe Token: SeDebugPrivilege 1032 WMIC.exe Token: SeSystemEnvironmentPrivilege 1032 WMIC.exe Token: SeRemoteShutdownPrivilege 1032 WMIC.exe Token: SeUndockPrivilege 1032 WMIC.exe Token: SeManageVolumePrivilege 1032 WMIC.exe Token: 33 1032 WMIC.exe Token: 34 1032 WMIC.exe Token: 35 1032 WMIC.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4932 wrote to memory of 3324 4932 PowerShell.exe 84 PID 4932 wrote to memory of 1776 4932 PowerShell.exe 85 PID 4932 wrote to memory of 1968 4932 PowerShell.exe 86 PID 4932 wrote to memory of 1032 4932 PowerShell.exe 88 PID 4932 wrote to memory of 3576 4932 PowerShell.exe 89
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\gf-revshell.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\whoami.exe"C:\Windows\system32\whoami.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"2⤵PID:1776
-
-
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" computersystem get manufacturer,model,domain,name /format:list2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" bios get manufacturer,serialnumber,version /format:list2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /all2⤵
- Gathers network information
PID:3576
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txyte0w2.bni.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH