Analysis
- max time kernel
148s - max time network
92s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 12:31
General
- Target Script.ps1
- Size 17KB
- Sample260620-pqcsnsgt21
- SHA256 4a3546dfd57e94af59312052d3cc7a52ab28ff49006c6e8254a5362b85dbb3e2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Script.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_cq30acdl.cue.ps1
memory/3416-24-0x000001B1D3040000-0x000001B1D3048000-memory.dmp
memory/3416-21-0x000001B1EC6F0000-0x000001B1EC8F4000-memory.dmp
memory/3416-5-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-6-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-7-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-8-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-9-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-10-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-11-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-12-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-13-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-14-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-18-0x000001B1EC320000-0x000001B1EC3D2000-memory.dmp
memory/3416-17-0x000001B1EB530000-0x000001B1EB54E000-memory.dmp
memory/3416-19-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-20-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-0-0x000001B1D2D1C000-0x000001B1D2D1D000-memory.dmp
memory/3416-22-0x000001B1EB570000-0x000001B1EB58A000-memory.dmp
memory/3416-1-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-23-0x000001B1EC520000-0x000001B1EC54A000-memory.dmp
memory/3416-28-0x000001B1EC4E0000-0x000001B1EC506000-memory.dmp
memory/3416-26-0x000001B1EB540000-0x000001B1EB54A000-memory.dmp
memory/3416-27-0x000001B1EB550000-0x000001B1EB558000-memory.dmp
memory/3416-25-0x000001B1EB530000-0x000001B1EB536000-memory.dmp
memory/3416-2-0x000001B1D2470000-0x000001B1D2492000-memory.dmp
memory/3416-31-0x000001B1EB590000-0x000001B1EB59A000-memory.dmp
memory/3416-32-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-33-0x000001B1EC550000-0x000001B1EC56E000-memory.dmp
memory/3416-34-0x000001B1EB560000-0x000001B1EB56A000-memory.dmp
memory/3416-35-0x000001B1ECE80000-0x000001B1ECE88000-memory.dmp
memory/3416-36-0x000001B1ED350000-0x000001B1ED38E000-memory.dmp
memory/3416-37-0x000001B1ECF20000-0x000001B1ECF2E000-memory.dmp
memory/3416-38-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-40-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-41-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-42-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-43-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-45-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp
memory/3416-46-0x000001B1D2580000-0x000001B1D2F24000-memory.dmp