Resubmissions
02/07/2026, 17:07
260702-vm2khsav4t802/07/2026, 16:29
260702-ty9vlaex9n801/07/2026, 16:23
260701-tvy9pabx4w8Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 17:07
General
- Target ComIntRep v11.1.3/Source/Includes/AutoIt3Script.ps1
- Size 7KB
- Sample260702-vm2khsav4t
- SHA256 9e3da3de63468e6380f34cb610cd41ab6e10f22031500a8fc1312445fe28fc53
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\Source\Includes\AutoIt3Script.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jynoe2hs.nkk.ps1
memory/1560-0-0x00007FF9050AF000-0x00007FF9050B0000-memory.dmp
memory/1560-7-0x000001F921E80000-0x000001F921EA2000-memory.dmp
memory/1560-6-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp
memory/1560-9-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp
memory/1560-10-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp
memory/1560-11-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp
memory/1560-12-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp
memory/1560-13-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp
memory/1560-15-0x00007FF904F20000-0x00007FF9058C4000-memory.dmp