Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
27/06/2026, 03:46
General
- Target The walking zombie Dead city/zk_Data/level14.ps1
- Size 3.0MB
- Sample260627-ebsv8sht2n
- SHA256 ce90b15b1e153c69cf2c2ea0469400e7bfb4bf4d2570db4a1aa230abbfe5a8a4
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\The walking zombie Dead city\zk_Data\level14.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4232-0-0x00007FFE646CF000-0x00007FFE646D0000-memory.dmp
memory/4232-1-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-4-0x000001BC6A470000-0x000001BC6A492000-memory.dmp
memory/4232-5-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-6-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-7-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-8-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-9-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-10-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-11-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-12-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-13-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-14-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-15-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp
memory/4232-17-0x00007FFE64540000-0x00007FFE64EE4000-memory.dmp