Resubmissions
02/07/2026, 17:07
260702-vm2khsav4t802/07/2026, 16:29
260702-ty9vlaex9n801/07/2026, 16:23
260701-tvy9pabx4w8Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 17:07
General
- Target ComIntRep v11.1.3/Source/Includes/Icons.ps1
- Size 32KB
- Sample260702-vm2khsav4t
- SHA256 a08e097e9e39e824e6b1c20d4d79649a7b1414ceefcebf1fbf56c12a924dcc22
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\Source\Includes\Icons.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3068-0-0x00007FFA5790F000-0x00007FFA57910000-memory.dmp
memory/3068-1-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-4-0x000002319A710000-0x000002319A732000-memory.dmp
memory/3068-5-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-6-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-7-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-8-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-9-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-10-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-11-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-12-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-13-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-14-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-15-0x00007FFA57780000-0x00007FFA58124000-memory.dmp
memory/3068-17-0x00007FFA57780000-0x00007FFA58124000-memory.dmp