Analysis
- max time kernel
899s - max time network
462s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 08:49
General
- Target replay_mimic_cpp/build.ps1
- Size 1KB
- Sample260908-krdddaweph
- SHA256 6abadc3af9ce084ef6efcf6e519bd49e9b9f64463571ad882a49fdf095e97fdf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\replay_mimic_cpp\build.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3204-0-0x00007FFEBC44F000-0x00007FFEBC450000-memory.dmp
memory/3204-4-0x000001CAD28C0000-0x000001CAD28E2000-memory.dmp
memory/3204-3-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-5-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-6-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-7-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-8-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-9-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-10-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-15-0x000001CAD2930000-0x000001CAD293A000-memory.dmp
memory/3204-14-0x000001CAEB000000-0x000001CAEB0B2000-memory.dmp
memory/3204-13-0x000001CAD2990000-0x000001CAD29AE000-memory.dmp
memory/3204-16-0x000001CAD29D0000-0x000001CAD29EE000-memory.dmp
memory/3204-17-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-18-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-19-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-20-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-21-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-22-0x000001CAD29B0000-0x000001CAD29BA000-memory.dmp
memory/3204-23-0x000001CAD2A10000-0x000001CAD2A2C000-memory.dmp
memory/3204-24-0x000001CAD29C0000-0x000001CAD29C8000-memory.dmp
memory/3204-25-0x000001CAD29F0000-0x000001CAD29F6000-memory.dmp
memory/3204-26-0x000001CAD2A00000-0x000001CAD2A0A000-memory.dmp
memory/3204-27-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/3204-29-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp