Analysis
- user interaction
yes - max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 19:33
General
- Target ca2dc5a3f94c4f19334cc8b68f256259.ps1
- Size 32B
- Sample261003-x9qsmswcra
- SHA256 ef0990d44c7952cc860a8dcdb09c2b22e4863087860dc8b755c5161f4b28f844
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ca2dc5a3f94c4f19334cc8b68f256259.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_53ac24sz.4np.psm1
memory/5080-12-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-16-0x00000272F5880000-0x00000272F5932000-memory.dmp
memory/5080-5-0x00000272F5800000-0x00000272F5822000-memory.dmp
memory/5080-4-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-7-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-8-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-9-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-10-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-11-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-1-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-6-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-15-0x00000272F5860000-0x00000272F587E000-memory.dmp
memory/5080-0-0x00007FF99BCFF000-0x00007FF99BD00000-memory.dmp
memory/5080-17-0x00000272F5C50000-0x00000272F5C5A000-memory.dmp
memory/5080-18-0x00000272F5DD0000-0x00000272F5DEE000-memory.dmp
memory/5080-19-0x00000272F5DB0000-0x00000272F5DBA000-memory.dmp
memory/5080-20-0x00000272F5E10000-0x00000272F5E2C000-memory.dmp
memory/5080-23-0x00000272F5E00000-0x00000272F5E0A000-memory.dmp
memory/5080-22-0x00000272F5DF0000-0x00000272F5DF6000-memory.dmp
memory/5080-21-0x00000272F5DC0000-0x00000272F5DC8000-memory.dmp
memory/5080-25-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5080-26-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp