Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
06/07/2026, 00:16
General
- Target vendor/roots/wp-password-bcrypt/wp-password-bcrypt.ps1
- Size 3KB
- Sample260706-aky2dscv4p
- SHA256 477b7c0a3144dda065d5ebd4e0c8f3a02e714c484f02567aa29a41a5a06ad407
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\vendor\roots\wp-password-bcrypt\wp-password-bcrypt.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_llh232gi.g54.ps1
memory/5544-0-0x00007FF9AE0FF000-0x00007FF9AE100000-memory.dmp
memory/5544-1-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp
memory/5544-7-0x000001F868040000-0x000001F868062000-memory.dmp
memory/5544-8-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp
memory/5544-10-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp
memory/5544-11-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp
memory/5544-12-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp
memory/5544-14-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp
memory/5544-15-0x00007FF9ADF70000-0x00007FF9AE914000-memory.dmp