Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 05:43
General
- Target data/ZgwenmEjpyoA.ps1
- Size 10.6MB
- Sample260814-gepdbsdn31
- SHA256 bfea8e7718b4c8417881d37053fd911cfb29cd1c58cb495e84eb06a7a4b29d8a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\data\ZgwenmEjpyoA.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5780-0-0x00007FF95053F000-0x00007FF950540000-memory.dmp
memory/5780-4-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-3-0x000001DD97B40000-0x000001DD97B62000-memory.dmp
memory/5780-5-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-6-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-7-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-8-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-9-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-10-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-11-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-12-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-13-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-14-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-15-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-16-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-17-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-18-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp
memory/5780-20-0x00007FF9503B0000-0x00007FF950D54000-memory.dmp