Analysis
- max time kernel
39s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 22:16
General
- Target XDLQZ1.ps1
- Size 913B
- Sample261011-1682laaa24
- SHA256 04352f3b19de3480023437afa3929f8faab6d40db0f01a93d514ea3e7ed41392
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\XDLQZ1.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nzgjz24l.hro.psm1
memory/4580-7-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-15-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-5-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-6-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-0-0x00007FF81C4EF000-0x00007FF81C4F0000-memory.dmp
memory/4580-8-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-11-0x0000020ECBA40000-0x0000020ECBA5E000-memory.dmp
memory/4580-12-0x0000020ECBA60000-0x0000020ECBB12000-memory.dmp
memory/4580-13-0x0000020ECBD30000-0x0000020ECBD3A000-memory.dmp
memory/4580-3-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-4-0x0000020ECB9F0000-0x0000020ECBA12000-memory.dmp
memory/4580-16-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-14-0x0000020ECBFB0000-0x0000020ECBFCE000-memory.dmp
memory/4580-17-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-18-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-19-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-20-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-22-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-23-0x0000020EB3349000-0x0000020EB334F000-memory.dmp
memory/4580-24-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp
memory/4580-25-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp