Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
192168.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
192168.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 192168.ps1
- Size 265B
- Sample260728-ygbnpathkh
- SHA256 eb5d351e732cc52ea2f643be11dbfac564a18c1e7edf0838b2e6334153daead8
- MD5 afe4bbd45df0cee3fed947ad5ee63b61
- SHA1 a9b2ad431dda16ffa7a579aa6e030d991f62675f
- SHA512 b4e192152cf42018d36c1a9b542808cfcab799f445e88189561eadbc12a4f488b6033b988c916b3a94429830f42217529a51d43560feb2b14d22c342a351122b
- TLSH T1AED02BD371680AE192F34694F25AA250E9A390254487256AF9E893831A617632515C4A
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 4756 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4756 powershell.exe 4756 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4756 powershell.exe Token: SeIncreaseQuotaPrivilege 4756 powershell.exe Token: SeSecurityPrivilege 4756 powershell.exe Token: SeTakeOwnershipPrivilege 4756 powershell.exe Token: SeLoadDriverPrivilege 4756 powershell.exe Token: SeSystemProfilePrivilege 4756 powershell.exe Token: SeSystemtimePrivilege 4756 powershell.exe Token: SeProfSingleProcessPrivilege 4756 powershell.exe Token: SeIncBasePriorityPrivilege 4756 powershell.exe Token: SeCreatePagefilePrivilege 4756 powershell.exe Token: SeBackupPrivilege 4756 powershell.exe Token: SeRestorePrivilege 4756 powershell.exe Token: SeShutdownPrivilege 4756 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeSystemEnvironmentPrivilege 4756 powershell.exe Token: SeRemoteShutdownPrivilege 4756 powershell.exe Token: SeUndockPrivilege 4756 powershell.exe Token: SeManageVolumePrivilege 4756 powershell.exe Token: 33 4756 powershell.exe Token: 34 4756 powershell.exe Token: 35 4756 powershell.exe Token: 36 4756 powershell.exe Token: SeIncreaseQuotaPrivilege 4756 powershell.exe Token: SeSecurityPrivilege 4756 powershell.exe Token: SeTakeOwnershipPrivilege 4756 powershell.exe Token: SeLoadDriverPrivilege 4756 powershell.exe Token: SeSystemProfilePrivilege 4756 powershell.exe Token: SeSystemtimePrivilege 4756 powershell.exe Token: SeProfSingleProcessPrivilege 4756 powershell.exe Token: SeIncBasePriorityPrivilege 4756 powershell.exe Token: SeCreatePagefilePrivilege 4756 powershell.exe Token: SeBackupPrivilege 4756 powershell.exe Token: SeRestorePrivilege 4756 powershell.exe Token: SeShutdownPrivilege 4756 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeSystemEnvironmentPrivilege 4756 powershell.exe Token: SeRemoteShutdownPrivilege 4756 powershell.exe Token: SeUndockPrivilege 4756 powershell.exe Token: SeManageVolumePrivilege 4756 powershell.exe Token: 33 4756 powershell.exe Token: 34 4756 powershell.exe Token: 35 4756 powershell.exe Token: 36 4756 powershell.exe Token: SeIncreaseQuotaPrivilege 4756 powershell.exe Token: SeSecurityPrivilege 4756 powershell.exe Token: SeTakeOwnershipPrivilege 4756 powershell.exe Token: SeLoadDriverPrivilege 4756 powershell.exe Token: SeSystemProfilePrivilege 4756 powershell.exe Token: SeSystemtimePrivilege 4756 powershell.exe Token: SeProfSingleProcessPrivilege 4756 powershell.exe Token: SeIncBasePriorityPrivilege 4756 powershell.exe Token: SeCreatePagefilePrivilege 4756 powershell.exe Token: SeBackupPrivilege 4756 powershell.exe Token: SeRestorePrivilege 4756 powershell.exe Token: SeShutdownPrivilege 4756 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeSystemEnvironmentPrivilege 4756 powershell.exe Token: SeRemoteShutdownPrivilege 4756 powershell.exe Token: SeUndockPrivilege 4756 powershell.exe Token: SeManageVolumePrivilege 4756 powershell.exe Token: 33 4756 powershell.exe Token: 34 4756 powershell.exe Token: 35 4756 powershell.exe Token: 36 4756 powershell.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyjofxqf.dyq.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH