Resubmissions
20/07/2026, 17:12
260720-vq5fksaz4y120/07/2026, 17:12
260720-vqy9kaaz31120/07/2026, 17:08
260720-vnqveaay3y320/07/2026, 17:05
260720-vls7ragz6n6Analysis
- user interaction
yes - max time kernel
103s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 17:05
General
- Target run.ps1
- Size 116B
- Sample260720-vls7ragz6n
- SHA256 9c8b52286994a343441fc1187318b94599254ad4218b26f61cf925ed399f9b17
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4848-0-0x00007FFF84B0F000-0x00007FFF84B10000-memory.dmp
memory/4848-1-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-4-0x0000024C354B0000-0x0000024C354D2000-memory.dmp
memory/4848-5-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-6-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-7-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-8-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-9-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-10-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-14-0x0000024C358C0000-0x0000024C35972000-memory.dmp
memory/4848-13-0x0000024C35550000-0x0000024C3556E000-memory.dmp
memory/4848-15-0x0000024C35980000-0x0000024C3598A000-memory.dmp
memory/4848-16-0x0000024C35C00000-0x0000024C35C1E000-memory.dmp
memory/4848-17-0x0000024C35BE0000-0x0000024C35BEA000-memory.dmp
memory/4848-18-0x0000024C35C40000-0x0000024C35C5C000-memory.dmp
memory/4848-19-0x0000024C35BF0000-0x0000024C35BF8000-memory.dmp
memory/4848-20-0x0000024C35C20000-0x0000024C35C26000-memory.dmp
memory/4848-21-0x0000024C35C30000-0x0000024C35C3A000-memory.dmp
memory/4848-23-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4848-24-0x00007FFF84980000-0x00007FFF85324000-memory.dmp