84d7077ae5a86be567bf39d94b3cc39a40751958b1692ec17d89d59f97ce3bea

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8263.ps1
Size 5KB
Sample260910-prwl6sgh86
SHA256 84d7077ae5a86be567bf39d94b3cc39a40751958b1692ec17d89d59f97ce3bea
MD5 21fcdda547ee851cf6c46447835b7db2
SHA1 851137d4767e55df797513c6d06d4f58b9db4eee
SHA512 c91dd75f88509cbba5e20fde38a6976a429ac88af42b0bd79e70964662958c688d37a81d833eef64cf5a84f9a1a4362218bb3f8bfe38711a4ae785c412eccda8
SSDEEP 96:5838wKxGxebrOY388VYURxw4NQ99hwHg4A39/OlP8l7gdo4LVNfrXkRs:638wKxGxYqY388qURxoDhwHgTxg87gdb
TLSH
T114B10D09332162699AB52B3CCDC79C1CFF3E903B25610248749C60901FB9DAECBE9F59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2496	PowerShell.exe
7	2496	PowerShell.exe
9	2496	PowerShell.exe
12	2496	PowerShell.exe
18	2496	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2496	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	PowerShell.exe
2496	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2496	PowerShell.exe
Token: SeSecurityPrivilege	2496	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2496	PowerShell.exe
Token: SeLoadDriverPrivilege	2496	PowerShell.exe
Token: SeSystemProfilePrivilege	2496	PowerShell.exe
Token: SeSystemtimePrivilege	2496	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2496	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2496	PowerShell.exe
Token: SeCreatePagefilePrivilege	2496	PowerShell.exe
Token: SeBackupPrivilege	2496	PowerShell.exe
Token: SeRestorePrivilege	2496	PowerShell.exe
Token: SeShutdownPrivilege	2496	PowerShell.exe
Token: SeDebugPrivilege	2496	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2496	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2496	PowerShell.exe
Token: SeUndockPrivilege	2496	PowerShell.exe
Token: SeManageVolumePrivilege	2496	PowerShell.exe
Token: 33	2496	PowerShell.exe
Token: 34	2496	PowerShell.exe
Token: 35	2496	PowerShell.exe
Token: 36	2496	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2496	PowerShell.exe
Token: SeSecurityPrivilege	2496	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2496	PowerShell.exe
Token: SeLoadDriverPrivilege	2496	PowerShell.exe
Token: SeSystemProfilePrivilege	2496	PowerShell.exe
Token: SeSystemtimePrivilege	2496	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2496	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2496	PowerShell.exe
Token: SeCreatePagefilePrivilege	2496	PowerShell.exe
Token: SeBackupPrivilege	2496	PowerShell.exe
Token: SeRestorePrivilege	2496	PowerShell.exe
Token: SeShutdownPrivilege	2496	PowerShell.exe
Token: SeDebugPrivilege	2496	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2496	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2496	PowerShell.exe
Token: SeUndockPrivilege	2496	PowerShell.exe
Token: SeManageVolumePrivilege	2496	PowerShell.exe
Token: 33	2496	PowerShell.exe
Token: 34	2496	PowerShell.exe
Token: 35	2496	PowerShell.exe
Token: 36	2496	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2496	PowerShell.exe
Token: SeSecurityPrivilege	2496	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2496	PowerShell.exe
Token: SeLoadDriverPrivilege	2496	PowerShell.exe
Token: SeSystemProfilePrivilege	2496	PowerShell.exe
Token: SeSystemtimePrivilege	2496	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2496	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2496	PowerShell.exe
Token: SeCreatePagefilePrivilege	2496	PowerShell.exe
Token: SeBackupPrivilege	2496	PowerShell.exe
Token: SeRestorePrivilege	2496	PowerShell.exe
Token: SeShutdownPrivilege	2496	PowerShell.exe
Token: SeDebugPrivilege	2496	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2496	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2496	PowerShell.exe
Token: SeUndockPrivilege	2496	PowerShell.exe
Token: SeManageVolumePrivilege	2496	PowerShell.exe
Token: 33	2496	PowerShell.exe
Token: 34	2496	PowerShell.exe
Token: 35	2496	PowerShell.exe
Token: 36	2496	PowerShell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8263.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x00007FFD609FF000-0x00007FFD60A00000-memory.dmp

Download

memory/2496-1-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-2-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-5-0x000002B045F30000-0x000002B045F52000-memory.dmp

Download

memory/2496-6-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-7-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-8-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-9-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-10-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-11-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-12-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-15-0x000002B05E640000-0x000002B05E65E000-memory.dmp

Download

memory/2496-16-0x000002B05E660000-0x000002B05E712000-memory.dmp

Download

memory/2496-17-0x000002B05E720000-0x000002B05E72A000-memory.dmp

Download

memory/2496-18-0x000002B05E8A0000-0x000002B05E8BE000-memory.dmp

Download

memory/2496-19-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-20-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-21-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-22-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-23-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-25-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-27-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2496-29-0x000002B05E720000-0x000002B05E72A000-memory.dmp

Download

memory/2496-28-0x000002B05E8A0000-0x000002B05E8B2000-memory.dmp

Download

memory/2496-104-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download