Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:20
General
- Target install.ps1
- Size 10KB
- Sample260727-phrxmael2y
- SHA256 5aabb4606bb856ad7432ea39818237cebbb392aab42b1f5ff12e4796b43c4561
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/908-0-0x00007FFB195CF000-0x00007FFB195D0000-memory.dmp
memory/908-3-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-4-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-5-0x000001D9A5B50000-0x000001D9A5B72000-memory.dmp
memory/908-6-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-7-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-8-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-9-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-10-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-11-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-12-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-13-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-14-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-15-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-16-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-17-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-21-0x000001D9A5CD0000-0x000001D9A5D82000-memory.dmp
memory/908-22-0x000001D9A5CA0000-0x000001D9A5CAA000-memory.dmp
memory/908-20-0x000001D9A5CB0000-0x000001D9A5CCE000-memory.dmp
memory/908-23-0x000001D9A5DB0000-0x000001D9A5DCE000-memory.dmp
memory/908-24-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-25-0x000001D9A5D90000-0x000001D9A5D9A000-memory.dmp
memory/908-26-0x000001D9A5DF0000-0x000001D9A5E0C000-memory.dmp
memory/908-27-0x000001D9A5DA0000-0x000001D9A5DA8000-memory.dmp
memory/908-28-0x000001D9A5DD0000-0x000001D9A5DD6000-memory.dmp
memory/908-29-0x000001D9A5DE0000-0x000001D9A5DEA000-memory.dmp
memory/908-30-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp
memory/908-32-0x00007FFB19440000-0x00007FFB19DE4000-memory.dmp