Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 04:58
General
- Target no way train/(同人ゲーム)[260516][みどりノひばかり] ヒロイン捕まえてナニも��.ps1
- Size 165KB
- Sample260629-fl2fssdv8s
- SHA256 781baf2a04fb1737b6dcd930644da0af595d79cb5781b40162cc21e0d7734371
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\no way train\(同人ゲーム)[260516][みどりノひばかり] ヒロイン捕まえてナニも��.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2240-0-0x00007FFBBB47F000-0x00007FFBBB480000-memory.dmp
memory/2240-1-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-4-0x000001F8A9310000-0x000001F8A9332000-memory.dmp
memory/2240-5-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-6-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-7-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-9-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-8-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-10-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-11-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-12-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-13-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-16-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp
memory/2240-15-0x00007FFBBB2F0000-0x00007FFBBBC94000-memory.dmp