Analysis
- user interaction
yes - max time kernel
749s - max time network
473s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 12:50
General
- Target target.ps1
- Size 9B
- Sample260623-p3a5lscy8p
- SHA256 b1ebafcd0def5f5a44cbb1c104fcd8c979262821d87a7e3ecc20f3dc844d10ac
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-0-0x00007FFE78E3F000-0x00007FFE78E40000-memory.dmp
memory/2092-3-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-4-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-6-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-5-0x0000027C39EC0000-0x0000027C39EE2000-memory.dmp
memory/2092-7-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-10-0x0000027C39F20000-0x0000027C39F3E000-memory.dmp
memory/2092-11-0x0000027C39F40000-0x0000027C39FF2000-memory.dmp
memory/2092-12-0x0000027C3A000000-0x0000027C3A00A000-memory.dmp
memory/2092-13-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-14-0x0000027C3A700000-0x0000027C3A71E000-memory.dmp
memory/2092-15-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-16-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-17-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-18-0x0000027C3A6E0000-0x0000027C3A6EA000-memory.dmp
memory/2092-19-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-20-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-21-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-22-0x0000027C3A740000-0x0000027C3A75C000-memory.dmp
memory/2092-24-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-23-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-27-0x0000027C3A730000-0x0000027C3A73A000-memory.dmp
memory/2092-26-0x0000027C3A720000-0x0000027C3A726000-memory.dmp
memory/2092-25-0x0000027C3A6F0000-0x0000027C3A6F8000-memory.dmp
memory/2092-30-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp
memory/2092-29-0x00007FFE78CB0000-0x00007FFE79654000-memory.dmp