Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 11:02
General
- Target clifix.ps1
- Size 1KB
- Sample260708-m43vxaev8t
- SHA256 e6b1a9539e90c37f1c13daddf36d1e699e793459db8b1c82189a49bc4818108e
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\clifix.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6056-0-0x00007FFAD696F000-0x00007FFAD6970000-memory.dmp
memory/6056-3-0x000001A8EDEA0000-0x000001A8EDEC2000-memory.dmp
memory/6056-4-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-5-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-6-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-7-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-8-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-9-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-10-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp
memory/6056-12-0x00007FFAD67E0000-0x00007FFAD7184000-memory.dmp