Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 18:24
General
- Target secured_stub.ps1
- Size 1.2MB
- Sample260930-w112ksvx2m
- SHA256 9ce4d8776c2e0d707ef3f4f81153acf0aad5e80882e6012f48cbbbcf5d917056
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\secured_stub.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0u4xgq4j.5h5.ps1
memory/2860-15-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-17-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-1-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-8-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-10-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-11-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-12-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-13-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-14-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-0-0x00007FFC3A45F000-0x00007FFC3A460000-memory.dmp
memory/2860-2-0x000001CDDB710000-0x000001CDDB732000-memory.dmp
memory/2860-18-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-16-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-19-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-20-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-21-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-22-0x000001CDDB990000-0x000001CDDB9A4000-memory.dmp
memory/2860-23-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-24-0x00007FFC3A2D0000-0x00007FFC3AC74000-memory.dmp
memory/2860-26-0x000001CDDB9C0000-0x000001CDDB9D4000-memory.dmp
memory/2860-27-0x000001CDDB560000-0x000001CDDB574000-memory.dmp