Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
27/06/2026, 03:46
General
- Target The walking zombie Dead city/zk_Data/level4.ps1
- Size 2.1MB
- Sample260627-ebsv8sht2n
- SHA256 781cad63ba9c8556e413f57da0ebdefcb50474260813e1136ac6eb4e8638da3f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\The walking zombie Dead city\zk_Data\level4.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004B01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-0-0x00007FF9F02AF000-0x00007FF9F02B0000-memory.dmp
memory/1584-3-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-4-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-5-0x000002446A390000-0x000002446A3B2000-memory.dmp
memory/1584-6-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-7-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-8-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-10-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-9-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-12-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-11-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-13-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-14-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-15-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-16-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-17-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-18-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/1584-20-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp