Analysis
- user interaction
yes - max time kernel
16s - max time network
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 09:06
General
- Target fix-st.ps1
- Size 12KB
- Sample260805-k24cjstdqf
- SHA256 41d42e05095f4d087d7f253f2180e441fdb390df8711b0a72123acef5fd8cc38
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix-st.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/476-21-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/476-25-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/476-24-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-12-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-14-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-7-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-8-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-9-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-10-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-11-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-0-0x00007FFE1914F000-0x00007FFE19150000-memory.dmp
memory/3264-13-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-6-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-15-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-16-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-17-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-18-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-19-0x000001A57ECC0000-0x000001A57EE36000-memory.dmp
memory/3264-20-0x000001A57F050000-0x000001A57F25A000-memory.dmp
memory/3264-5-0x000001A57E860000-0x000001A57E882000-memory.dmp
memory/3264-4-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-1-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
memory/3264-28-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp