Analysis
- max time kernel
38s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/06/2026, 08:00
General
- Target 33a7648c64588e855b411fe9bcdb51489d4a33e4ab86705661049bb9b65ceddb.ps1
- Size 443KB
- Sample260628-jv5rcsf14z
- SHA256 33a7648c64588e855b411fe9bcdb51489d4a33e4ab86705661049bb9b65ceddb
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\33a7648c64588e855b411fe9bcdb51489d4a33e4ab86705661049bb9b65ceddb.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Badlisted process makes network request
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4B3D.tmp
__PSScriptPolicyTest_m020o504.wet.ps1
memory/2324-80-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-93-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-15-0x0000000004F40000-0x0000000005568000-memory.dmp
memory/2324-269-0x0000000076E90000-0x0000000076F80000-memory.dmp
memory/2324-16-0x00000000055A0000-0x00000000055C2000-memory.dmp
memory/2324-18-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/2324-17-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/2324-26-0x0000000005830000-0x0000000005B84000-memory.dmp
memory/2324-268-0x0000000002880000-0x0000000002890000-memory.dmp
memory/2324-266-0x0000000002880000-0x0000000002890000-memory.dmp
memory/2324-265-0x0000000002880000-0x0000000002890000-memory.dmp
memory/2324-37-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-55-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-28-0x0000000005F40000-0x0000000005F5E000-memory.dmp
memory/2324-29-0x0000000006070000-0x00000000060BC000-memory.dmp
memory/2324-30-0x0000000006F20000-0x000000000759A000-memory.dmp
memory/2324-31-0x0000000006490000-0x00000000064AA000-memory.dmp
memory/2324-32-0x0000000002880000-0x0000000002890000-memory.dmp
memory/2324-13-0x0000000002800000-0x0000000002836000-memory.dmp
memory/2324-59-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-100-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-219-0x0000000076E90000-0x0000000076F80000-memory.dmp
memory/2324-218-0x0000000076EB0000-0x0000000076EB1000-memory.dmp
memory/2324-99-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-98-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-76-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-96-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-95-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-94-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-77-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-92-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-91-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-90-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-89-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-88-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-87-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-86-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-85-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-84-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-83-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-82-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-81-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-12-0x0000000002880000-0x0000000002890000-memory.dmp
memory/2324-79-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-14-0x0000000002880000-0x0000000002890000-memory.dmp
memory/2324-78-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-97-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-75-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-74-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-73-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-72-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-71-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-70-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-69-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-68-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-67-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-66-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-65-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-64-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-63-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-61-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-60-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-57-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-56-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-54-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-53-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-52-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-51-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-50-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-49-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-48-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-47-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-46-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-45-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-44-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-43-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-42-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-41-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-40-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-39-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-38-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-36-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/2324-58-0x00000000769F0000-0x00000000769F1000-memory.dmp
memory/4200-27-0x00000216C1E50000-0x00000216C1E60000-memory.dmp
memory/4200-11-0x00000216C47B0000-0x00000216C49BA000-memory.dmp
memory/4200-10-0x00000216C4420000-0x00000216C4596000-memory.dmp
memory/4200-9-0x00000216C4040000-0x00000216C4062000-memory.dmp
memory/4200-1-0x00000216C1E50000-0x00000216C1E60000-memory.dmp
memory/4200-0-0x00000216C1E50000-0x00000216C1E60000-memory.dmp