Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 18:01
General
- Target script.ps1
- Size 1B
- Sample261002-wl9eeaws5l
- SHA256 043a718774c572bd8a25adbeb1bfcd5c0256ae11cecf9f9c3f925d0e52beaf89
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kascwvs5.20t.psm1
memory/5256-13-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-15-0x000001DB331E0000-0x000001DB331EA000-memory.dmp
memory/5256-5-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-6-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-7-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-10-0x000001DB33100000-0x000001DB3311E000-memory.dmp
memory/5256-3-0x000001DB32DF0000-0x000001DB32E12000-memory.dmp
memory/5256-11-0x000001DB33120000-0x000001DB331D2000-memory.dmp
memory/5256-12-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-16-0x000001DB33360000-0x000001DB3337E000-memory.dmp
memory/5256-4-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-14-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-0-0x00007FFB8DA0F000-0x00007FFB8DA10000-memory.dmp
memory/5256-17-0x000001DB33340000-0x000001DB3334A000-memory.dmp
memory/5256-18-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-19-0x000001DB333A0000-0x000001DB333BC000-memory.dmp
memory/5256-20-0x000001DB33350000-0x000001DB33358000-memory.dmp
memory/5256-22-0x000001DB33390000-0x000001DB3339A000-memory.dmp
memory/5256-21-0x000001DB33380000-0x000001DB33386000-memory.dmp
memory/5256-24-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-25-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp
memory/5256-26-0x00007FFB8D880000-0x00007FFB8E224000-memory.dmp