Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 10:43
General
- Target run.ps1
- Size 26B
- Sample261003-msna3scg39
- SHA256 83af9bb02ffdafb6fe711c15452e9eae4292743e69395a19b3d74ebbb2b01aab
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1lja4v0r.xtk.psm1
memory/3904-17-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-23-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-5-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-6-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-7-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-11-0x000001F73D590000-0x000001F73D642000-memory.dmp
memory/3904-10-0x000001F73D2B0000-0x000001F73D2CE000-memory.dmp
memory/3904-4-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-12-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-13-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-14-0x000001F73D230000-0x000001F73D23A000-memory.dmp
memory/3904-15-0x000001F73D2F0000-0x000001F73D30E000-memory.dmp
memory/3904-16-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-0-0x00007FFF6B99F000-0x00007FFF6B9A0000-memory.dmp
memory/3904-3-0x000001F73D240000-0x000001F73D262000-memory.dmp
memory/3904-20-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-18-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-21-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-22-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-19-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-24-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-25-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-26-0x000001F73D2D0000-0x000001F73D2DA000-memory.dmp
memory/3904-27-0x000001F73D330000-0x000001F73D34C000-memory.dmp
memory/3904-29-0x000001F73D310000-0x000001F73D316000-memory.dmp
memory/3904-30-0x000001F73D320000-0x000001F73D32A000-memory.dmp
memory/3904-28-0x000001F73D2E0000-0x000001F73D2E8000-memory.dmp
memory/3904-31-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/3904-33-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp