Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 12:17
General
- Target HealthChecker.ps1
- Size 1013KB
- Sample260706-pf3lcaay6p
- SHA256 5751b839dfd0b18940b05ab634b7325899d5c50e1949bef43aea2afee5b17c18
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\HealthChecker.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HealthChecker-Debug_20260706131716.txt
HealthChecker-Debug_20260706131716.txt
__PSScriptPolicyTest_zd5abzcv.bie.ps1
memory/5784-22-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-74-0x0000018041920000-0x000001804193E000-memory.dmp
memory/5784-10-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-11-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-14-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-15-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-16-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-17-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-18-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-19-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-20-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-21-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-23-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-0-0x00007FF98F94F000-0x00007FF98F950000-memory.dmp
memory/5784-9-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-24-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-76-0x0000018041960000-0x000001804197C000-memory.dmp
memory/5784-48-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-52-0x00000180417C0000-0x00000180417CA000-memory.dmp
memory/5784-7-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5784-50-0x00000180416E0000-0x00000180416FE000-memory.dmp
memory/5784-75-0x00000180416E0000-0x00000180416EA000-memory.dmp
memory/5784-51-0x0000018041700000-0x00000180417B2000-memory.dmp
memory/5784-77-0x00000180416F0000-0x00000180416F8000-memory.dmp
memory/5784-78-0x00000180417C0000-0x00000180417C6000-memory.dmp
memory/5784-79-0x0000018041940000-0x000001804194A000-memory.dmp
memory/5784-6-0x0000018028A20000-0x0000018028A42000-memory.dmp
memory/5784-90-0x0000018041F50000-0x0000018042112000-memory.dmp
memory/5784-91-0x0000018042650000-0x0000018042B78000-memory.dmp
memory/5784-111-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp