Overview

overview

8

Static

static

1

ABC.ps1

windows10-2004-x64

8

ABC.ps1

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/06/2026, 10:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ABC.ps1
  • Size 533B
  • Sample260625-mk8baaa18l
  • SHA256 9d4ef0ba07b8ba26d73bf153b39f9e04241aa1bd278b7d1f21896adbc54ce6f0
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ABC.ps1
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5376
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:120
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2628
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\config-chain\node_modules\proto-list\LICENSE
        • Size 780B
        • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .npmignore
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\fs-vacuum\.npmignore
        • Size 14B
        • SHA256 cd429484a9e55b1df61764740f7153c476037c791b9dabac344bcce552a45080
        • MD5 SHA1 SHA512
        Submit Download

        LICENSE
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\concat-map\LICENSE
        • Size 1KB
        • SHA256 a9ecf3da3825b3e7232f29c970a2869bb1752c900bd75ba7cbabeb69b8f032b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        README.md
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\README.md
        • Size 6KB
        • SHA256 608905c989f7e4fdcae7b27ab050caa7cb26e1d81f47bbbd25ab835fdc04750c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        minimatch.js
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\minimatch.js
        • Size 25KB
        • SHA256 15ff81144a9fe3e9ac9a7e138140a798c528acef0491b2076e0bf65ca09e1bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        README.md
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\README.md
        • Size 3KB
        • SHA256 e28b76862b362d6cb941d7af0c25c7ed3153a01dee16b926afecadb06ba58001
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.js
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\index.js
        • Size 4KB
        • SHA256 e9cc8bd6b40daefa7b85c18e446c89ce6cc5d23136bf001a92ccce301f866121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .npmignore
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\balanced-match\.npmignore
        • Size 53B
        • SHA256 bebaae32f1ade4f72d5b565c724affbe251d547c165198443d3f2e4d4563a044
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE.md
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\balanced-match\LICENSE.md
        • Size 1KB
        • SHA256 22309088dd86fcb367b5bf3ed8ccb135f047b5a9867a84ae2f4c9ea572b9e882
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        README.md
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\balanced-match\README.md
        • Size 3KB
        • SHA256 5043eba069b7365ebfc3923d2238e27a1a2ef07bc42d02a96fe9cd6cd7e96e01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.js
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\balanced-match\index.js
        • Size 1KB
        • SHA256 c67f664170fa4c627490e8c1435ea07208281325af895c037cfbca6b6b1547ea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .travis.yml
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\concat-map\.travis.yml
        • Size 47B
        • SHA256 57c0bdcbdabbd0f861f3f212144d478732d7a027852241722e924c793f7f64d6
        • MD5 SHA1 SHA512
        Submit Download

        README.markdown
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\concat-map\README.markdown
        • Size 1KB
        • SHA256 6abbee231ffeb1a0f19dc87f5f41fdb1b755d8bf73d59e96a8d20075986893f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        map.js
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\concat-map\example\map.js
        • Size 177B
        • SHA256 b38eb7549ccbf4d3f75d7c541c40009280fb4427b154b43d78242396fff6fff9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.js
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\concat-map\index.js
        • Size 358B
        • SHA256 62fc0346bfe455925f54e6ab4d77b08cb6b3c8aeeded924d31a7ea08c85089fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        map.js
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\minimatch\node_modules\brace-expansion\node_modules\concat-map\test\map.js
        • Size 1KB
        • SHA256 daf6cf1665532db59b90059a62632e5066cf11920ae5e6694971ff8c858644ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        license
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\glob\node_modules\path-is-absolute\license
        • Size 1KB
        • SHA256 6b18e4f3ea8443739a64c95ecf793b45e4a04748da67e4a1479c3f4bba520bd6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\init-package-json\node_modules\promzard\LICENSE
        • Size 763B
        • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE.txt
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\lodash._cacheindexof\LICENSE.txt
        • Size 1KB
        • SHA256 34c9e87365128252851b101ae194a31e3d019724b20c25fa66fd4521a326c818
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\lodash.uniq\LICENSE
        • Size 1KB
        • SHA256 3e0f669f0550e6101efcc81d9032af5498b72eec499df58cfbf63e24a61e2f75
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\mississippi\node_modules\pumpify\LICENSE
        • Size 1KB
        • SHA256 c222d7cd6879fb81d79a019383a6f651107d76f1f75b2632c438828b1a08c227
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .travis.yml
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\mississippi\node_modules\stream-each\node_modules\stream-shift\.travis.yml
        • Size 71B
        • SHA256 0d4fd76174b9d66cc494bd496556c7e7b0b20836f6a128c57ebabb94b5079af7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .npmignore
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\npm-package-arg\.npmignore
        • Size 15B
        • SHA256 853bdb9e4c430bb46f05289d0d2c37d6b99128f78ab80d4fa929c50af733be90
        • MD5 SHA1 SHA512
        Submit Download

        .travis.yml
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\npm-registry-client\node_modules\concat-stream\node_modules\readable-stream\node_modules\isarray\.travis.yml
        • Size 52B
        • SHA256 c450d2413f1716790b4fdadc009dccabcf0b1182cf5af954d9e24ead0b3d9b2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .travis.yml
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\osenv\.travis.yml
        • Size 143B
        • SHA256 5446aeec0650a1e739be8085519c7964b6ccd4f6a36d37a233f1b71256b34816
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .npmignore
        • Path C:\ProgramData\node-v7.10.1-win-x64\node_modules\npm\node_modules\read-installed\.npmignore
        • Size 115B
        • SHA256 d604ff7988edf9baeb6fa509e365f630839eed9a3d5daca0124d471607d3b23f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2628-88-0x000001A2141F0000-0x000001A214210000-memory.dmp
        Download

        memory/2628-42-0x000001A2001E0000-0x000001A2002E0000-memory.dmp
        Download

        memory/2628-54-0x000001A201A10000-0x000001A201A30000-memory.dmp
        Download

        memory/2628-66-0x000001A201C70000-0x000001A201C90000-memory.dmp
        Download

        memory/2628-55-0x000001A201E70000-0x000001A201F70000-memory.dmp
        Download

        memory/3780-213-0x000002C036670000-0x000002C036AA4000-memory.dmp
        Download

        memory/5376-17-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-223-0x0000022DFFA10000-0x0000022DFFA1A000-memory.dmp
        Download

        memory/5376-222-0x0000022DFFA20000-0x0000022DFFA32000-memory.dmp
        Download

        memory/5376-221-0x0000022DFFA10000-0x0000022DFFA1A000-memory.dmp
        Download

        memory/5376-220-0x0000022DFFF10000-0x0000022DFFFC2000-memory.dmp
        Download

        memory/5376-219-0x0000022DFFA20000-0x0000022DFFA3E000-memory.dmp
        Download

        memory/5376-21-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-20-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-19-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-18-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-0-0x00007FFF8802F000-0x00007FFF88030000-memory.dmp
        Download

        memory/5376-15-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-14-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-13-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-12-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-11-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-10-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-9-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-8-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-7-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-6-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-5-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-4-0x00007FFF87EA0000-0x00007FFF88844000-memory.dmp
        Download

        memory/5376-3-0x0000022DFF9D0000-0x0000022DFF9F2000-memory.dmp
        Download