Resubmissions
23/06/2026, 17:25
260623-vzhceaex9s1023/06/2026, 17:22
260623-vxtbwsex611023/06/2026, 17:19
260623-vv261sev4p10Analysis
- user interaction
yes - max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 17:19
General
- Target file01.ps1
- Size 499B
- Sample260623-vv261sev4p
- SHA256 0fc4cad0a6b35d79d0563011abfc62498b8c11522db433386a5417e396ae4513
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1088-21-0x0000000073B12000-0x0000000073B13000-memory.dmp
memory/1088-35-0x0000000073B00000-0x00000000742BC000-memory.dmp
memory/1088-34-0x0000000073B12000-0x0000000073B13000-memory.dmp
memory/1088-33-0x00000000076C0000-0x0000000007708000-memory.dmp
memory/1088-32-0x0000000006580000-0x00000000065CC000-memory.dmp
memory/1088-31-0x0000000006540000-0x000000000655E000-memory.dmp
memory/1088-30-0x0000000006070000-0x00000000063CB000-memory.dmp
memory/1088-29-0x0000000006000000-0x0000000006066000-memory.dmp
memory/1088-25-0x0000000005880000-0x00000000058A2000-memory.dmp
memory/1088-28-0x0000000005F90000-0x0000000005FF6000-memory.dmp
memory/1088-24-0x0000000005940000-0x0000000005F8A000-memory.dmp
memory/1088-23-0x0000000073B00000-0x00000000742BC000-memory.dmp
memory/1088-22-0x0000000003180000-0x00000000031B6000-memory.dmp
memory/2860-9-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-10-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-18-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-15-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-14-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-13-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-12-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-16-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-11-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-0-0x00007FFABA59F000-0x00007FFABA5A0000-memory.dmp
memory/2860-8-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-7-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-6-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-5-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp
memory/2860-3-0x00000244A22B0000-0x00000244A22D2000-memory.dmp
memory/2860-4-0x00007FFABA410000-0x00007FFABADB4000-memory.dmp