Analysis
- user interaction
yes - max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 23:09
General
- Target code.ps1
- Size 12B
- Sample260820-25acbaxard
- SHA256 f55cfd18c22dddee93a985b9f421525c4f0f30965112e2ebeb89dd3241347fb9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4276-0-0x00007FFCC536F000-0x00007FFCC5370000-memory.dmp
memory/4276-1-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-4-0x000002959E030000-0x000002959E052000-memory.dmp
memory/4276-5-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-6-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-7-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-8-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-11-0x000002959E390000-0x000002959E3AE000-memory.dmp
memory/4276-12-0x00000295B6700000-0x00000295B67B2000-memory.dmp
memory/4276-13-0x000002959E230000-0x000002959E23A000-memory.dmp
memory/4276-14-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-15-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-16-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-17-0x00000295B67E0000-0x00000295B67FE000-memory.dmp
memory/4276-18-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-19-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-20-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-21-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-22-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-23-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-24-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-25-0x00000295B67C0000-0x00000295B67CA000-memory.dmp
memory/4276-26-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-27-0x00000295B6820000-0x00000295B683C000-memory.dmp
memory/4276-29-0x00000295B6800000-0x00000295B6806000-memory.dmp
memory/4276-28-0x00000295B67D0000-0x00000295B67D8000-memory.dmp
memory/4276-30-0x00000295B6810000-0x00000295B681A000-memory.dmp
memory/4276-31-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/4276-33-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp