Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 12:58
General
- Target script.ps1
- Size 13KB
- Sample260822-p7tgrayzbx
- SHA256 09f5b72b8d02601ab0261753ef7593ac5b276c68ba51340ca186d2af67cfe47b
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4540-0-0x00007FFC1513F000-0x00007FFC15140000-memory.dmp
memory/4540-1-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-2-0x0000012A67910000-0x0000012A67932000-memory.dmp
memory/4540-5-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-6-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-7-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-8-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-11-0x0000012A002C0000-0x0000012A002DE000-memory.dmp
memory/4540-12-0x0000012A002E0000-0x0000012A00392000-memory.dmp
memory/4540-13-0x0000012A67770000-0x0000012A6777A000-memory.dmp
memory/4540-15-0x0000012A7FDE0000-0x0000012A7FE04000-memory.dmp
memory/4540-14-0x0000012A7FDE0000-0x0000012A7FE0A000-memory.dmp
memory/4540-16-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-17-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-18-0x0000012A7FF80000-0x0000012A80142000-memory.dmp
memory/4540-19-0x0000012A00B20000-0x0000012A01048000-memory.dmp
memory/4540-20-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-21-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-26-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-27-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-28-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-29-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-30-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-31-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-32-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-33-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-34-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-36-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-35-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-38-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-39-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-40-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-41-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-51-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4540-52-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp