Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 12:26
General
- Target update.ps1
- Size 1KB
- Sample260928-pma5nstdmb
- SHA256 d2a61974ff1bb720f48b0694213f2df964bbb0399a9855fbcb9d6dedbdd8a35a
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\update.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ox4tzu5f.nim.ps1
memory/4708-23-0x000001439ABA0000-0x000001439AC52000-memory.dmp
memory/4708-33-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-1-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-8-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-10-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-11-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-12-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-13-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-14-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-15-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-22-0x000001439AB80000-0x000001439AB9E000-memory.dmp
memory/4708-0-0x00007FF9FC4FF000-0x00007FF9FC500000-memory.dmp
memory/4708-7-0x0000014382680000-0x00000143826A2000-memory.dmp
memory/4708-26-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-24-0x000001439AC60000-0x000001439AC6A000-memory.dmp
memory/4708-27-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-28-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-29-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-30-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-31-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-32-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-25-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-35-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-36-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp
memory/4708-38-0x00007FF9FC370000-0x00007FF9FCD14000-memory.dmp