Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 22:48
General
- Target file01.ps1
- Size 7KB
- Sample261009-2q9tmavyew
- SHA256 7638836c1f246debb1af82c31f268d30f6acb40da7053334a1a64305e3e3f8c5
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_exipmclm.ccf.ps1
memory/2216-25-0x000001A41B660000-0x000001A41B66A000-memory.dmp
memory/2216-37-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-2-0x000001A41BAF0000-0x000001A41BB12000-memory.dmp
memory/2216-9-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-10-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-11-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-12-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-13-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-14-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-21-0x000001A41B630000-0x000001A41B64E000-memory.dmp
memory/2216-22-0x000001A41B880000-0x000001A41B932000-memory.dmp
memory/2216-26-0x000001A41BAD0000-0x000001A41BAEC000-memory.dmp
memory/2216-1-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-24-0x000001A41BAB0000-0x000001A41BACE000-memory.dmp
memory/2216-23-0x000001A41B650000-0x000001A41B65A000-memory.dmp
memory/2216-27-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-28-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-30-0x000001A41BAA0000-0x000001A41BAA6000-memory.dmp
memory/2216-31-0x000001A41BF20000-0x000001A41BF2A000-memory.dmp
memory/2216-29-0x000001A41BA90000-0x000001A41BA98000-memory.dmp
memory/2216-32-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-33-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-34-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-35-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-0-0x00007FFF15DAF000-0x00007FFF15DB0000-memory.dmp
memory/2216-38-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp
memory/2216-39-0x00007FFF15C20000-0x00007FFF165C4000-memory.dmp