Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 14:58
General
- Target code.ps1
- Size 196B
- Sample260803-sb7w2sbc46
- SHA256 782bbb19361aa5b566a32d16e852de1d75e323181ed9e7be3cbb6fef58c5213f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4348-0-0x00007FF82623F000-0x00007FF826240000-memory.dmp
memory/4348-1-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-4-0x000001B984330000-0x000001B984352000-memory.dmp
memory/4348-5-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-6-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-7-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-8-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-13-0x000001B99C740000-0x000001B99C7F2000-memory.dmp
memory/4348-12-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-11-0x000001B99C720000-0x000001B99C73E000-memory.dmp
memory/4348-15-0x000001B99C800000-0x000001B99C80A000-memory.dmp
memory/4348-14-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-16-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-17-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-18-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-19-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-20-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-21-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-22-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-23-0x000001B99C830000-0x000001B99C84E000-memory.dmp
memory/4348-24-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-25-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-26-0x000001B99C810000-0x000001B99C81A000-memory.dmp
memory/4348-27-0x000001B99CBD0000-0x000001B99CBEC000-memory.dmp
memory/4348-28-0x000001B99C820000-0x000001B99C828000-memory.dmp
memory/4348-29-0x000001B99C850000-0x000001B99C856000-memory.dmp
memory/4348-30-0x000001B99C860000-0x000001B99C86A000-memory.dmp
memory/4348-31-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/4348-33-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp