Analysis
- max time kernel
34s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
Game.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Game.ps1
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Game.ps1
- Size 11KB
- Sample260822-psfmcathqe
- SHA256 f8e7d1461714bf2759392b61e5ade016fd236775a78da7506a2989dbe7f6cc84
- MD5 bb079c703303754f182175d11d2a131e
- SHA1 8700e4bf75e219ba694ed6fd03cc021960c32fec
- SHA512 1a6b954152ad1183afd7f7dcc017769c9bd0a7b60d425bac99fd59ea395e77422877de42219e433778d59883a46fe4a60e5326e6b0741c6b3b93df0f4c397369
- SSDEEP 192:SIIAqgnXnniynXxtaF8qJP91pW6rU6paqw0Q2QbyJw0CFp/yiQkSCyiFQVqQeP+y:Cfw3/7aF9TpnrTwSmrGIYvzHpM
- TLSH T15742E9BDBA96C0B48287A1F598ADE5483438852F000E6E04BADDD7D8BF55634C7F92CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 4808 powershell.exe 14 4808 powershell.exe - Deletes itself 1 IoCs
pid Process 4808 powershell.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 13 discord.com 14 discord.com - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.ipify.org 12 api.ipify.org -
pid Process 4808 powershell.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 5780 netsh.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4808 powershell.exe 4808 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4808 powershell.exe Token: SeIncreaseQuotaPrivilege 4808 powershell.exe Token: SeSecurityPrivilege 4808 powershell.exe Token: SeTakeOwnershipPrivilege 4808 powershell.exe Token: SeLoadDriverPrivilege 4808 powershell.exe Token: SeSystemProfilePrivilege 4808 powershell.exe Token: SeSystemtimePrivilege 4808 powershell.exe Token: SeProfSingleProcessPrivilege 4808 powershell.exe Token: SeIncBasePriorityPrivilege 4808 powershell.exe Token: SeCreatePagefilePrivilege 4808 powershell.exe Token: SeBackupPrivilege 4808 powershell.exe Token: SeRestorePrivilege 4808 powershell.exe Token: SeShutdownPrivilege 4808 powershell.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeSystemEnvironmentPrivilege 4808 powershell.exe Token: SeRemoteShutdownPrivilege 4808 powershell.exe Token: SeUndockPrivilege 4808 powershell.exe Token: SeManageVolumePrivilege 4808 powershell.exe Token: 33 4808 powershell.exe Token: 34 4808 powershell.exe Token: 35 4808 powershell.exe Token: 36 4808 powershell.exe Token: SeIncreaseQuotaPrivilege 4808 powershell.exe Token: SeSecurityPrivilege 4808 powershell.exe Token: SeTakeOwnershipPrivilege 4808 powershell.exe Token: SeLoadDriverPrivilege 4808 powershell.exe Token: SeSystemProfilePrivilege 4808 powershell.exe Token: SeSystemtimePrivilege 4808 powershell.exe Token: SeProfSingleProcessPrivilege 4808 powershell.exe Token: SeIncBasePriorityPrivilege 4808 powershell.exe Token: SeCreatePagefilePrivilege 4808 powershell.exe Token: SeBackupPrivilege 4808 powershell.exe Token: SeRestorePrivilege 4808 powershell.exe Token: SeShutdownPrivilege 4808 powershell.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeSystemEnvironmentPrivilege 4808 powershell.exe Token: SeRemoteShutdownPrivilege 4808 powershell.exe Token: SeUndockPrivilege 4808 powershell.exe Token: SeManageVolumePrivilege 4808 powershell.exe Token: 33 4808 powershell.exe Token: 34 4808 powershell.exe Token: 35 4808 powershell.exe Token: 36 4808 powershell.exe Token: SeIncreaseQuotaPrivilege 4808 powershell.exe Token: SeSecurityPrivilege 4808 powershell.exe Token: SeTakeOwnershipPrivilege 4808 powershell.exe Token: SeLoadDriverPrivilege 4808 powershell.exe Token: SeSystemProfilePrivilege 4808 powershell.exe Token: SeSystemtimePrivilege 4808 powershell.exe Token: SeProfSingleProcessPrivilege 4808 powershell.exe Token: SeIncBasePriorityPrivilege 4808 powershell.exe Token: SeCreatePagefilePrivilege 4808 powershell.exe Token: SeBackupPrivilege 4808 powershell.exe Token: SeRestorePrivilege 4808 powershell.exe Token: SeShutdownPrivilege 4808 powershell.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeSystemEnvironmentPrivilege 4808 powershell.exe Token: SeRemoteShutdownPrivilege 4808 powershell.exe Token: SeUndockPrivilege 4808 powershell.exe Token: SeManageVolumePrivilege 4808 powershell.exe Token: 33 4808 powershell.exe Token: 34 4808 powershell.exe Token: 35 4808 powershell.exe Token: 36 4808 powershell.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4808 wrote to memory of 5780 4808 powershell.exe 88
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Game.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5780
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yiz5oono.mie.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH