Analysis
- max time kernel
149s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 12:27
General
- Target $1/MGS/RemoveUWP.ps1
- Size 160B
- Sample260802-pm286asgre
- SHA256 209777a1fd2a3a43c877072b308a2a9e0861acd4a5c4e5834b1b241b015d0373
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$1\MGS\RemoveUWP.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3800-0-0x00007FFAFD4FF000-0x00007FFAFD500000-memory.dmp
memory/3800-3-0x00000236EB9C0000-0x00000236EB9E2000-memory.dmp
memory/3800-4-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-5-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-6-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-7-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-11-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-12-0x00000236EBD20000-0x00000236EBDD2000-memory.dmp
memory/3800-10-0x00000236EBA70000-0x00000236EBA8E000-memory.dmp
memory/3800-14-0x00000236EBAB0000-0x00000236EBACA000-memory.dmp
memory/3800-13-0x00000236EC140000-0x00000236EC344000-memory.dmp
memory/3800-15-0x00000236EBF70000-0x00000236EBF9A000-memory.dmp
memory/3800-18-0x00000236EBA90000-0x00000236EBA9A000-memory.dmp
memory/3800-19-0x00000236EBAA0000-0x00000236EBAA8000-memory.dmp
memory/3800-20-0x00000236EBF30000-0x00000236EBF56000-memory.dmp
memory/3800-17-0x00000236EBA80000-0x00000236EBA86000-memory.dmp
memory/3800-22-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-16-0x00000236EBA70000-0x00000236EBA78000-memory.dmp
memory/3800-23-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/3800-24-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp