6b5dff424f99fd5078f2c8c801b462f44666879432c1f14272631597669fee0f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hyper-V/FreeRDP.ps1
Size 3KB
Sample260809-gx2rdaha99
SHA256 6b5dff424f99fd5078f2c8c801b462f44666879432c1f14272631597669fee0f
MD5 2d096576de63adaaf0d9fbae0c9aa7ce
SHA1 b15b44f8c4682ad6ccefe35658c7742e41e28fc5
SHA512 cc69227e89197e4a441b2beb601163c421a7a86f6d5b00eeec9910a394dc533fab8240afa43349de091d6a710693caf6386f1ed2ed54919162f249b379937d3c
TLSH
T16661657CA749976031B1A7AB6E19D05EF72B846F244A1210FC8C80841F3661692BCFB9
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5540	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5540	PowerShell.exe
5540	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5540	PowerShell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Hyper-V\FreeRDP.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5540-0-0x00007FF8489FF000-0x00007FF848A00000-memory.dmp

Download

memory/5540-1-0x0000023CF9240000-0x0000023CF9262000-memory.dmp

Download

memory/5540-4-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/5540-5-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/5540-7-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/5540-8-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download