9f43b2b206b6dd7e0b0b98c42911b9213fccf8a9a4db370e48790e11ee2284d6

Analysis

user interaction
yes
max time kernel
45s
max time network
49s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.ps1
Size 15KB
Sample260827-ppln7avbpf
SHA256 9f43b2b206b6dd7e0b0b98c42911b9213fccf8a9a4db370e48790e11ee2284d6
MD5 fafb5ef4377ef312637206fb2a03e337
SHA1 deb2d3c6a664ac4de200b422536fe1e5085dfe0d
SHA512 9455ab3c38ef822b14c13706ee5a64e559e07dd4c78179bb5c236214cc465d370e9ff598e9f3940c35fdbbe5f7230e44f1d022065b60f8f7c94c3b2f6c82f2be
SSDEEP 192:5AErwRzVVA/uA/bkX5AN1a7D2D7Ce3kwRvNVA/uA/bkX5AN1a7D2D7Ce3v:mK/r/T4n2D7Ce1K/r/T4n2D7Cef
TLSH
T1016273A7A9A421E2DAA2569ECF87674EB7BFE47F452D2340715CC3002F60D7D8B2D481
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	PowerShell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	PowerShell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	PowerShell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	PowerShell.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5164	PowerShell.exe
6	5164	PowerShell.exe
7	5164	PowerShell.exe
12	5164	PowerShell.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5164	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5164	PowerShell.exe
5164	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5164	PowerShell.exe
Token: SeSecurityPrivilege	5164	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5164	PowerShell.exe
Token: SeLoadDriverPrivilege	5164	PowerShell.exe
Token: SeSystemProfilePrivilege	5164	PowerShell.exe
Token: SeSystemtimePrivilege	5164	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5164	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5164	PowerShell.exe
Token: SeCreatePagefilePrivilege	5164	PowerShell.exe
Token: SeBackupPrivilege	5164	PowerShell.exe
Token: SeRestorePrivilege	5164	PowerShell.exe
Token: SeShutdownPrivilege	5164	PowerShell.exe
Token: SeDebugPrivilege	5164	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5164	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5164	PowerShell.exe
Token: SeUndockPrivilege	5164	PowerShell.exe
Token: SeManageVolumePrivilege	5164	PowerShell.exe
Token: 33	5164	PowerShell.exe
Token: 34	5164	PowerShell.exe
Token: 35	5164	PowerShell.exe
Token: 36	5164	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5164	PowerShell.exe
Token: SeSecurityPrivilege	5164	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5164	PowerShell.exe
Token: SeLoadDriverPrivilege	5164	PowerShell.exe
Token: SeSystemProfilePrivilege	5164	PowerShell.exe
Token: SeSystemtimePrivilege	5164	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5164	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5164	PowerShell.exe
Token: SeCreatePagefilePrivilege	5164	PowerShell.exe
Token: SeBackupPrivilege	5164	PowerShell.exe
Token: SeRestorePrivilege	5164	PowerShell.exe
Token: SeShutdownPrivilege	5164	PowerShell.exe
Token: SeDebugPrivilege	5164	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5164	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5164	PowerShell.exe
Token: SeUndockPrivilege	5164	PowerShell.exe
Token: SeManageVolumePrivilege	5164	PowerShell.exe
Token: 33	5164	PowerShell.exe
Token: 34	5164	PowerShell.exe
Token: 35	5164	PowerShell.exe
Token: 36	5164	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5164	PowerShell.exe
Token: SeSecurityPrivilege	5164	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5164	PowerShell.exe
Token: SeLoadDriverPrivilege	5164	PowerShell.exe
Token: SeSystemProfilePrivilege	5164	PowerShell.exe
Token: SeSystemtimePrivilege	5164	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5164	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5164	PowerShell.exe
Token: SeCreatePagefilePrivilege	5164	PowerShell.exe
Token: SeBackupPrivilege	5164	PowerShell.exe
Token: SeRestorePrivilege	5164	PowerShell.exe
Token: SeShutdownPrivilege	5164	PowerShell.exe
Token: SeDebugPrivilege	5164	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5164	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5164	PowerShell.exe
Token: SeUndockPrivilege	5164	PowerShell.exe
Token: SeManageVolumePrivilege	5164	PowerShell.exe
Token: 33	5164	PowerShell.exe
Token: 34	5164	PowerShell.exe
Token: 35	5164	PowerShell.exe
Token: 36	5164	PowerShell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 5472	5164	PowerShell.exe	89

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps1
1⤵
- UAC bypass
- Badlisted process makes network request
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\system32\CiTool.exe
  "C:\Windows\system32\CiTool.exe" -r
  2⤵
  PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5164-0-0x00007FF8B85AF000-0x00007FF8B85B0000-memory.dmp

Download

memory/5164-1-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-2-0x00000194778A0000-0x00000194778C2000-memory.dmp

Download

memory/5164-5-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-6-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-7-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-8-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-9-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-10-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-11-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-12-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-13-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-14-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-17-0x0000019477970000-0x000001947798E000-memory.dmp

Download

memory/5164-18-0x0000019477BA0000-0x0000019477C52000-memory.dmp

Download

memory/5164-19-0x0000019477D60000-0x0000019477D6A000-memory.dmp

Download

memory/5164-20-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-21-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-22-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-23-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/5164-25-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download