Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
trackerjacker.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
trackerjacker.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target trackerjacker.ps1
- Size 5KB
- Sample260720-pkpv2sct2v
- SHA256 a0dc03e431f4829cc675722c21af4b0266e8334842d29ffd42a0130776dc0b5f
- MD5 28d4daeb07b4b57b975c34b701e1e059
- SHA1 a07d69aa50ee4cdf232d671e6053f04e2455ccdd
- SHA512 f37b8415351a1529b511be1e30dccfe0fc3b33f93ecb798ac0e467a31e0742f59c6dca9dbc59fb729558e450501cd7ac7bfcdfaf5fde47ae556f7f808fffb059
- SSDEEP 96:4ZqurDNKZBrWQZuwvMoOVOyiZIXbHsQoKHHRu/Vfsz7QYQslqYvi2EXF4mmOfjAR:6DN6BqQEwUohxyMQdutf7YQUXqHVEIjA
- TLSH T1F4C19F51E62F86721A8881DA05739192EB3E2143B2CCCCBF73ECA9364435F5B84B3674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
-
pid Process 2164 PowerShell.exe 4912 powershell.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_eswyl2ce.yki.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ulqfda1n.mig.psm1 powershell.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2164 PowerShell.exe 2164 PowerShell.exe 4912 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2164 PowerShell.exe Token: SeIncreaseQuotaPrivilege 2164 PowerShell.exe Token: SeSecurityPrivilege 2164 PowerShell.exe Token: SeTakeOwnershipPrivilege 2164 PowerShell.exe Token: SeLoadDriverPrivilege 2164 PowerShell.exe Token: SeSystemProfilePrivilege 2164 PowerShell.exe Token: SeSystemtimePrivilege 2164 PowerShell.exe Token: SeProfSingleProcessPrivilege 2164 PowerShell.exe Token: SeIncBasePriorityPrivilege 2164 PowerShell.exe Token: SeCreatePagefilePrivilege 2164 PowerShell.exe Token: SeBackupPrivilege 2164 PowerShell.exe Token: SeRestorePrivilege 2164 PowerShell.exe Token: SeShutdownPrivilege 2164 PowerShell.exe Token: SeDebugPrivilege 2164 PowerShell.exe Token: SeSystemEnvironmentPrivilege 2164 PowerShell.exe Token: SeRemoteShutdownPrivilege 2164 PowerShell.exe Token: SeUndockPrivilege 2164 PowerShell.exe Token: SeManageVolumePrivilege 2164 PowerShell.exe Token: 33 2164 PowerShell.exe Token: 34 2164 PowerShell.exe Token: 35 2164 PowerShell.exe Token: 36 2164 PowerShell.exe Token: SeIncreaseQuotaPrivilege 2164 PowerShell.exe Token: SeSecurityPrivilege 2164 PowerShell.exe Token: SeTakeOwnershipPrivilege 2164 PowerShell.exe Token: SeLoadDriverPrivilege 2164 PowerShell.exe Token: SeSystemProfilePrivilege 2164 PowerShell.exe Token: SeSystemtimePrivilege 2164 PowerShell.exe Token: SeProfSingleProcessPrivilege 2164 PowerShell.exe Token: SeIncBasePriorityPrivilege 2164 PowerShell.exe Token: SeCreatePagefilePrivilege 2164 PowerShell.exe Token: SeBackupPrivilege 2164 PowerShell.exe Token: SeRestorePrivilege 2164 PowerShell.exe Token: SeShutdownPrivilege 2164 PowerShell.exe Token: SeDebugPrivilege 2164 PowerShell.exe Token: SeSystemEnvironmentPrivilege 2164 PowerShell.exe Token: SeRemoteShutdownPrivilege 2164 PowerShell.exe Token: SeUndockPrivilege 2164 PowerShell.exe Token: SeManageVolumePrivilege 2164 PowerShell.exe Token: 33 2164 PowerShell.exe Token: 34 2164 PowerShell.exe Token: 35 2164 PowerShell.exe Token: 36 2164 PowerShell.exe Token: SeIncreaseQuotaPrivilege 2164 PowerShell.exe Token: SeSecurityPrivilege 2164 PowerShell.exe Token: SeTakeOwnershipPrivilege 2164 PowerShell.exe Token: SeLoadDriverPrivilege 2164 PowerShell.exe Token: SeSystemProfilePrivilege 2164 PowerShell.exe Token: SeSystemtimePrivilege 2164 PowerShell.exe Token: SeProfSingleProcessPrivilege 2164 PowerShell.exe Token: SeIncBasePriorityPrivilege 2164 PowerShell.exe Token: SeCreatePagefilePrivilege 2164 PowerShell.exe Token: SeBackupPrivilege 2164 PowerShell.exe Token: SeRestorePrivilege 2164 PowerShell.exe Token: SeShutdownPrivilege 2164 PowerShell.exe Token: SeDebugPrivilege 2164 PowerShell.exe Token: SeSystemEnvironmentPrivilege 2164 PowerShell.exe Token: SeRemoteShutdownPrivilege 2164 PowerShell.exe Token: SeUndockPrivilege 2164 PowerShell.exe Token: SeManageVolumePrivilege 2164 PowerShell.exe Token: 33 2164 PowerShell.exe Token: 34 2164 PowerShell.exe Token: 35 2164 PowerShell.exe Token: 36 2164 PowerShell.exe
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trackerjacker.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File ""1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_eswyl2ce.yki.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH