Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 01:22
General
- Target Executables/AtlasModules/Scripts/newUsers.ps1
- Size 5B
- Sample261011-brkm1stwew
- SHA256 76ba540617fc957ff029da9d0d79d16f82852f4ceb51db771fc9169a7f1738fc
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Executables\AtlasModules\Scripts\newUsers.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2yvwqrqr.yz3.ps1
memory/2884-25-0x000001F5E0D10000-0x000001F5E0D2C000-memory.dmp
memory/2884-32-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-1-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-9-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-10-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-17-0x000001F5E0BD0000-0x000001F5E0BEE000-memory.dmp
memory/2884-18-0x000001F5E0BF0000-0x000001F5E0CA2000-memory.dmp
memory/2884-19-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-20-0x000001F5E09B0000-0x000001F5E09BA000-memory.dmp
memory/2884-21-0x000001F5E0CD0000-0x000001F5E0CEE000-memory.dmp
memory/2884-22-0x000001F5E0CB0000-0x000001F5E0CBA000-memory.dmp
memory/2884-23-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-24-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-0-0x00007FFA94E8F000-0x00007FFA94E90000-memory.dmp
memory/2884-7-0x000001F5C84A0000-0x000001F5C84C2000-memory.dmp
memory/2884-28-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-26-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-29-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-30-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-27-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-31-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-41-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-39-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-38-0x000001F5E0D00000-0x000001F5E0D0A000-memory.dmp
memory/2884-37-0x000001F5E0CF0000-0x000001F5E0CF6000-memory.dmp
memory/2884-36-0x000001F5E0CC0000-0x000001F5E0CC8000-memory.dmp
memory/2884-35-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-34-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp
memory/2884-33-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp