Analysis
- max time kernel
149s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 12:09
General
- Target install.ps1
- Size 10KB
- Sample260710-pbqe8act81
- SHA256 089a05134cc7bbc743fb99371e8076946be37cfd32cda54936b548b7f7f8043d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5024-0-0x00007FFBCAD1F000-0x00007FFBCAD20000-memory.dmp
memory/5024-3-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-4-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-5-0x00000279E0560000-0x00000279E0582000-memory.dmp
memory/5024-6-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-7-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-8-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-10-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-9-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-11-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-15-0x00000279F8C80000-0x00000279F8D32000-memory.dmp
memory/5024-14-0x00000279E05E0000-0x00000279E05FE000-memory.dmp
memory/5024-16-0x00000279E05D0000-0x00000279E05DA000-memory.dmp
memory/5024-17-0x00000279F8EB0000-0x00000279F8ECE000-memory.dmp
memory/5024-18-0x00000279E0600000-0x00000279E060A000-memory.dmp
memory/5024-19-0x00000279F8ED0000-0x00000279F8EEC000-memory.dmp
memory/5024-21-0x00000279F8EA0000-0x00000279F8EA6000-memory.dmp
memory/5024-22-0x00000279F8EF0000-0x00000279F8EFA000-memory.dmp
memory/5024-23-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-24-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-20-0x00000279F8E90000-0x00000279F8E98000-memory.dmp
memory/5024-25-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-26-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-28-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-29-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp
memory/5024-30-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp