Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
06/07/2026, 18:20
General
- Target Get.ps1
- Size 8KB
- Sample260706-wyv3jsfv2l
- SHA256 c2a58a4c66e78dee36d373d5a4b80d7ea472fb44b19d3b9081ae1a4e67d09b12
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Get.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Win11Debloat\Win11Debloat.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
Features.json
Win11Debloat.ps1
__PSScriptPolicyTest_kbwcir5p.yz2.ps1
memory/2996-733-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-739-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-753-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-751-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-750-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-749-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-746-0x0000021245770000-0x0000021245776000-memory.dmp
memory/2996-748-0x00000212457A0000-0x00000212457AA000-memory.dmp
memory/2996-747-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-745-0x0000021245760000-0x0000021245768000-memory.dmp
memory/2996-744-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-743-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-742-0x0000021245780000-0x000002124579C000-memory.dmp
memory/2996-741-0x0000021245750000-0x000002124575A000-memory.dmp
memory/2996-734-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-740-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-720-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-737-0x0000021245730000-0x000002124574E000-memory.dmp
memory/2996-721-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-731-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-730-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-728-0x00000212455E0000-0x0000021245604000-memory.dmp
memory/2996-727-0x00000212455E0000-0x000002124560A000-memory.dmp
memory/2996-724-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-726-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-723-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-717-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-738-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/2996-732-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-23-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-17-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-363-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-4-0x0000018AEC770000-0x0000018AEC792000-memory.dmp
memory/5636-332-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-32-0x0000018AEC830000-0x0000018AEC842000-memory.dmp
memory/5636-33-0x0000018AEC820000-0x0000018AEC82A000-memory.dmp
memory/5636-31-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-30-0x0000018AEC840000-0x0000018AEC84A000-memory.dmp
memory/5636-1-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-29-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-28-0x0000018AECD20000-0x0000018AECDD2000-memory.dmp
memory/5636-0-0x00007FFC7637F000-0x00007FFC76380000-memory.dmp
memory/5636-7-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-6-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-27-0x0000018AEC820000-0x0000018AEC83E000-memory.dmp
memory/5636-16-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-5-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-19-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-18-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-20-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-15-0x0000018AED4F0000-0x0000018AEDA18000-memory.dmp
memory/5636-22-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-14-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-13-0x0000018AECDF0000-0x0000018AECFB2000-memory.dmp
memory/5636-12-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-11-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-10-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-9-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp
memory/5636-8-0x00007FFC761F0000-0x00007FFC76B94000-memory.dmp