Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 10:23
General
- Target burnt-sushi-master/run-cmd.ps1
- Size 892B
- Sample260922-mesnmstdmg
- SHA256 68e29377cf8c3f4e4805a0dce1db951c9d5e4fd490ce99411f3e83c81ceb475f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\burnt-sushi-master\run-cmd.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4052-0-0x00007FFBB0ABF000-0x00007FFBB0AC0000-memory.dmp
memory/4052-1-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-2-0x000001975AC40000-0x000001975AC62000-memory.dmp
memory/4052-6-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-5-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-7-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-8-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-9-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-12-0x0000019773260000-0x000001977327E000-memory.dmp
memory/4052-13-0x0000019773520000-0x00000197735D2000-memory.dmp
memory/4052-14-0x000001975ACB0000-0x000001975ACBA000-memory.dmp
memory/4052-15-0x00000197732A0000-0x00000197732BE000-memory.dmp
memory/4052-16-0x0000019773280000-0x000001977328A000-memory.dmp
memory/4052-17-0x00000197732E0000-0x00000197732FC000-memory.dmp
memory/4052-18-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-19-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-20-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-21-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-22-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-23-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-24-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-25-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-26-0x0000019773290000-0x0000019773298000-memory.dmp
memory/4052-28-0x00000197732D0000-0x00000197732DA000-memory.dmp
memory/4052-27-0x00000197732C0000-0x00000197732C6000-memory.dmp
memory/4052-30-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-31-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp
memory/4052-32-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp