Analysis
- max time kernel
149s - max time network
181s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 10:27
General
- Target Granny Turkey Mod Remake PC V1.0.5/Granny_Data/level1.ps1
- Size 150KB
- Sample260809-mhdnwsdn8t
- SHA256 b117d1ae2b857e5bdd7be273489d94cc570c8dd760af3f46c54e35b6af3da9fc
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Granny Turkey Mod Remake PC V1.0.5\Granny_Data\level1.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004981⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3672-0-0x00007FF8B85AF000-0x00007FF8B85B0000-memory.dmp
memory/3672-1-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-4-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-5-0x000002CDA3300000-0x000002CDA3322000-memory.dmp
memory/3672-6-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-7-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-8-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-9-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-10-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-11-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-13-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/3672-14-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp