General
- Target deepseek_powershell_20260714_baa28f.ps1
- Size 7KB
- Sample260714-px8tpafx61
- SHA256 c9549fc48f5b114c639f8beaad6a95eab9fb023ccc28ce03bb6f3b3655e5a982
Score
10/10
Malware Config
Targets
-
- Target deepseek_powershell_20260714_baa28f.ps1
- Size 7KB
- SHA256 c9549fc48f5b114c639f8beaad6a95eab9fb023ccc28ce03bb6f3b3655e5a982
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Drops startup file
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1