Analysis
- max time kernel
29s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
25/08/2026, 14:02
General
- Target Helloworld.ps1
- Size 2.1MB
- Sample260825-rcfzaatbpg
- SHA256 37f7374a4bf1afd576de6459dc04d2083eb2ed5254084de131b1eae5bcfc5b3e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Helloworld.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4632-0-0x00007FFEA52FF000-0x00007FFEA5300000-memory.dmp
memory/4632-3-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-4-0x0000018CBBCF0000-0x0000018CBBD12000-memory.dmp
memory/4632-5-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-6-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-7-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-8-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-9-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-10-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-11-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-12-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-13-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-14-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-15-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-16-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-17-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-18-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-19-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-20-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-21-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-22-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-23-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-24-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-25-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-26-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-27-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-28-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-29-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-30-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-31-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4632-32-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp