Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 12:44
General
- Target file01.ps1
- Size 12KB
- Sample260822-pyk41svanf
- SHA256 0aa88e76ac5f798a2620e41cddd3fc4698aa7aac457f92ee962e688484a24750
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5976-0-0x00007FFBE067F000-0x00007FFBE0680000-memory.dmp
memory/5976-3-0x0000021C38500000-0x0000021C38522000-memory.dmp
memory/5976-4-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-5-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-6-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-7-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-8-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-10-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-9-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-12-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-11-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-13-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-14-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-15-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-20-0x0000021C388C0000-0x0000021C38972000-memory.dmp
memory/5976-19-0x0000021C388A0000-0x0000021C388BE000-memory.dmp
memory/5976-16-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-21-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-22-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-23-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-24-0x0000021C38980000-0x0000021C3898A000-memory.dmp
memory/5976-26-0x0000021C38B10000-0x0000021C38B34000-memory.dmp
memory/5976-25-0x0000021C38B10000-0x0000021C38B3A000-memory.dmp
memory/5976-27-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-29-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-30-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/5976-31-0x0000021C38DB0000-0x0000021C38F72000-memory.dmp
memory/5976-32-0x0000021C394B0000-0x0000021C399D8000-memory.dmp