Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 08:18
General
- Target launch.ps1
- Size 61B
- Sample260808-j7m23sbr71
- SHA256 d9e965e8344819060a8db57a3f6dcfd883e0d5eb5511716f494c4a4b2997a6d5
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\launch.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uwpinject.exe"C:\Users\Admin\AppData\Local\Temp\uwpinject.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6256-0-0x00007FFB2846F000-0x00007FFB28470000-memory.dmp
memory/6256-4-0x00000275A2940000-0x00000275A2962000-memory.dmp
memory/6256-3-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-5-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-6-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-7-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-8-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-9-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-13-0x00000275BAE60000-0x00000275BAF12000-memory.dmp
memory/6256-12-0x00000275BAE40000-0x00000275BAE5E000-memory.dmp
memory/6256-15-0x00000275BAF40000-0x00000275BAF5A000-memory.dmp
memory/6256-14-0x00000275BB590000-0x00000275BB794000-memory.dmp
memory/6256-16-0x00000275BAFE0000-0x00000275BB00A000-memory.dmp
memory/6256-18-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-19-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-21-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-17-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-22-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp
memory/6256-23-0x00007FFB282E0000-0x00007FFB28C84000-memory.dmp