Analysis
- max time kernel
149s - max time network
161s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 08:28
General
- Target dbb7037739e18719252cfa1a63a76c12eb9a5ad6f3ae2d1e4d369ca0544a199d.exe
- Size 728KB
- Sample260706-kc4a9acw2x
- SHA256 dbb7037739e18719252cfa1a63a76c12eb9a5ad6f3ae2d1e4d369ca0544a199d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb7037739e18719252cfa1a63a76c12eb9a5ad6f3ae2d1e4d369ca0544a199d.exe"C:\Users\Admin\AppData\Local\Temp\dbb7037739e18719252cfa1a63a76c12eb9a5ad6f3ae2d1e4d369ca0544a199d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBLAEkAQwBIAE8ALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwASwBJAEMASABPAC4AZQB4AGUAJwApACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ATwBuAGMAZQAgAC0AQQB0ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAANQApACkAIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0AUwBlAGMAbwBuAGQAcwAgADAAKQAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAKQAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yfwamazh.zyp.ps1
memory/2044-6797-0x00000000083D0000-0x0000000008A4C000-memory.dmp
memory/2044-6771-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6801-0x0000000007F70000-0x0000000007F81000-memory.dmp
memory/2044-6800-0x0000000007FD0000-0x0000000008066000-memory.dmp
memory/2044-6799-0x0000000007DD0000-0x0000000007DDA000-memory.dmp
memory/2044-6768-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6798-0x0000000007D70000-0x0000000007D8A000-memory.dmp
memory/2044-6796-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6795-0x0000000007CA0000-0x0000000007D43000-memory.dmp
memory/2044-6794-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6793-0x00000000079C0000-0x00000000079E0000-memory.dmp
memory/2044-6791-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6802-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6783-0x0000000006A10000-0x0000000006A5C000-memory.dmp
memory/2044-6785-0x00000000710B0000-0x00000000710FC000-memory.dmp
memory/2044-6782-0x00000000069E0000-0x00000000069FE000-memory.dmp
memory/2044-6781-0x00000000064F0000-0x000000000684B000-memory.dmp
memory/2044-6804-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2044-6773-0x0000000006410000-0x0000000006476000-memory.dmp
memory/2044-6774-0x0000000006480000-0x00000000064E6000-memory.dmp
memory/2044-6772-0x0000000006370000-0x0000000006392000-memory.dmp
memory/2044-6784-0x00000000079E0000-0x0000000007A16000-memory.dmp
memory/2044-6770-0x0000000005D20000-0x000000000636A000-memory.dmp
memory/2044-6767-0x00000000034E0000-0x0000000003516000-memory.dmp
memory/2044-6769-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2228-91-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-25-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-93-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-89-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-87-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-85-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-81-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-80-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-75-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-74-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-71-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-69-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-67-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-66-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-63-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-61-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-59-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-58-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-47-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-45-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-43-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-39-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-35-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-33-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-29-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-55-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-54-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-52-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-49-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-41-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-37-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-23-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-21-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-15-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-27-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-107-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-19-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-9-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-13-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-7-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-5-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-4-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-1928-0x0000000074EC2000-0x0000000074EC3000-memory.dmp
memory/2228-2157-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2228-6766-0x0000000004E30000-0x0000000004E38000-memory.dmp
memory/2228-112-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-83-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-0-0x0000000074EC2000-0x0000000074EC3000-memory.dmp
memory/2228-95-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-97-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-100-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-101-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-103-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-105-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-109-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-115-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-117-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-119-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-121-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-125-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-127-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-129-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-123-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-113-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-77-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-31-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-18-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-11-0x0000000004F30000-0x00000000050CE000-memory.dmp
memory/2228-3-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/2228-2-0x0000000004F30000-0x00000000050D4000-memory.dmp
memory/2228-1-0x0000000000270000-0x000000000032C000-memory.dmp