Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 00:14
General
- Target install.ps1
- Size 29KB
- Sample260604-ajksdagy8k
- SHA256 ab7d7864801e62f92aa3abf878e3b0aaa8b9f7de03120bc81b029f67281c1842
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4pd0mf5d.0hg.ps1
memory/3828-21-0x000002BABDB40000-0x000002BABDB5C000-memory.dmp
memory/3828-23-0x000002BABDB80000-0x000002BABDB9A000-memory.dmp
memory/3828-1-0x000002BABA670000-0x000002BABA680000-memory.dmp
memory/3828-9-0x000002BABD970000-0x000002BABDB32000-memory.dmp
memory/3828-10-0x000002BABE070000-0x000002BABE598000-memory.dmp
memory/3828-11-0x00007FF4B09F0000-0x00007FF4B0A00000-memory.dmp
memory/3828-18-0x000002BABD3F0000-0x000002BABD40C000-memory.dmp
memory/3828-19-0x000002BABD8A0000-0x000002BABD953000-memory.dmp
memory/3828-20-0x000002BABD410000-0x000002BABD41A000-memory.dmp
memory/3828-0-0x000002BABA670000-0x000002BABA680000-memory.dmp
memory/3828-2-0x000002BABA620000-0x000002BABA642000-memory.dmp
memory/3828-24-0x000002BABD430000-0x000002BABD438000-memory.dmp
memory/3828-22-0x000002BABD420000-0x000002BABD42A000-memory.dmp
memory/3828-25-0x000002BABD960000-0x000002BABD966000-memory.dmp
memory/3828-26-0x000002BABDB60000-0x000002BABDB6A000-memory.dmp
memory/3828-29-0x000002BABA670000-0x000002BABA680000-memory.dmp
memory/3828-28-0x000002BABA670000-0x000002BABA680000-memory.dmp
memory/3828-32-0x000002BABA670000-0x000002BABA680000-memory.dmp
memory/3828-33-0x000002BABA670000-0x000002BABA680000-memory.dmp
memory/3828-34-0x00007FF4B09F0000-0x00007FF4B0A00000-memory.dmp
memory/3828-36-0x000002BABA670000-0x000002BABA680000-memory.dmp