Analysis
- max time kernel
39s - max time network
36s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 22:45
General
- Target target.ps1
- Size 5KB
- Sample260802-2pstqagg96
- SHA256 3962ad7152e05ade5149dd1d6c3c8073e4ba378cc79676f262716b067dd08203
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps11⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {6AE2E04C-8765-4227-A1B7-96ABAD43FE8F}2⤵
- Drops file in Windows directory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dism.log
dism.log
memory/3620-11-0x0000019C527F0000-0x0000019C528A2000-memory.dmp
memory/3620-42-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-6-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-7-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-10-0x0000019C527D0000-0x0000019C527EE000-memory.dmp
memory/3620-0-0x00007FFB7C5AF000-0x00007FFB7C5B0000-memory.dmp
memory/3620-12-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-14-0x0000019C528B0000-0x0000019C528BA000-memory.dmp
memory/3620-13-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-15-0x0000019C52A30000-0x0000019C52A4E000-memory.dmp
memory/3620-16-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-17-0x0000019C52A10000-0x0000019C52A1A000-memory.dmp
memory/3620-5-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-18-0x0000019C52A70000-0x0000019C52A8C000-memory.dmp
memory/3620-4-0x0000019C52580000-0x0000019C525A2000-memory.dmp
memory/3620-22-0x0000019C52A60000-0x0000019C52A6A000-memory.dmp
memory/3620-20-0x0000019C52A20000-0x0000019C52A28000-memory.dmp
memory/3620-23-0x0000019C52A20000-0x0000019C52A48000-memory.dmp
memory/3620-21-0x0000019C52A50000-0x0000019C52A56000-memory.dmp
memory/3620-1-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-30-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-41-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-19-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-43-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-44-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp
memory/3620-46-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp