Analysis
- max time kernel
149s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 00:17
General
- Target wix.ps1
- Size 2.4MB
- Sample260913-algthazydw
- SHA256 61ff765ebf2ec9f3df7f72d768c1131e344e4e9ac77892b8e34ba6d25d4b8631
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wix.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5340" "2184" "2084" "2172" "0" "0" "2188" "0" "0" "0" "0" "0"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sdcfp45f.dhn.ps1
memory/5340-15-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-17-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-8-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-9-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-10-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-11-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-12-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-13-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-14-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-18-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-6-0x00000274EAE60000-0x00000274EAE82000-memory.dmp
memory/5340-16-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-0-0x00007FFEC5F2F000-0x00007FFEC5F30000-memory.dmp
memory/5340-19-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-20-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-21-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-22-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-26-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-28-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-27-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-29-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp
memory/5340-30-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp