Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/08/2026, 12:26
General
- Target simulation_event_id.ps1
- Size 4KB
- Sample260814-pmd7bstwft
- SHA256 cc735e800737d730444128ef87983a716dcf97109ddd596598022378bd97a75e
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\simulation_event_id.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" create OrbitalTestSvc "binpath=%COMSPEC% /c powershell.exe -nop -w hidden -c exit" start=demand2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1168-0-0x00007FFF027AF000-0x00007FFF027B0000-memory.dmp
memory/1168-1-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-2-0x0000020B22310000-0x0000020B22332000-memory.dmp
memory/1168-5-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-6-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-7-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-8-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-9-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-10-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-11-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-14-0x0000020B22610000-0x0000020B2262E000-memory.dmp
memory/1168-16-0x0000020B22630000-0x0000020B226E2000-memory.dmp
memory/1168-15-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-17-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-18-0x0000020B223F0000-0x0000020B223FA000-memory.dmp
memory/1168-19-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-20-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-21-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-22-0x0000020B22960000-0x0000020B2297E000-memory.dmp
memory/1168-23-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-24-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-25-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-26-0x0000020B22940000-0x0000020B2294A000-memory.dmp
memory/1168-27-0x0000020B229A0000-0x0000020B229BC000-memory.dmp
memory/1168-28-0x0000020B22950000-0x0000020B22958000-memory.dmp
memory/1168-29-0x0000020B22980000-0x0000020B22986000-memory.dmp
memory/1168-30-0x0000020B22990000-0x0000020B2299A000-memory.dmp
memory/1168-31-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp
memory/1168-33-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp