Analysis
- max time kernel
149s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
14/10/2026, 18:05
General
- Target ace372ae1150fb48faffa7c36b2c67ae58047b59e90228e305e10d1b48caf0ed.ps1
- Size 10KB
- Sample261014-wn9syshb97
- SHA256 ace372ae1150fb48faffa7c36b2c67ae58047b59e90228e305e10d1b48caf0ed
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ace372ae1150fb48faffa7c36b2c67ae58047b59e90228e305e10d1b48caf0ed.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ersnodbv.5zh.ps1
memory/5164-21-0x0000028235260000-0x000002823526A000-memory.dmp
memory/5164-24-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-1-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-0-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-10-0x00000282352F0000-0x00000282354B2000-memory.dmp
memory/5164-11-0x00000282359F0000-0x0000028235F18000-memory.dmp
memory/5164-12-0x00007FF44D6B0000-0x00007FF44D6C0000-memory.dmp
memory/5164-19-0x0000028235240000-0x000002823525C000-memory.dmp
memory/5164-8-0x0000028234D40000-0x0000028234D62000-memory.dmp
memory/5164-20-0x00000282354C0000-0x0000028235573000-memory.dmp
memory/5164-9-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-23-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-22-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-25-0x0000028235290000-0x00000282352AC000-memory.dmp
memory/5164-26-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-27-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-29-0x00007FF44D6B0000-0x00007FF44D6C0000-memory.dmp
memory/5164-30-0x0000028232CC0000-0x0000028232CD0000-memory.dmp
memory/5164-31-0x0000028232CC0000-0x0000028232CD0000-memory.dmp