Analysis
- user interaction
yes - max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 20:27
General
- Target file.ps1
- Size 3KB
- Sample261017-y8ppmacz8v
- SHA256 19ba767525b4a1bbaa2d090f5eb2249d744f4e298aec41127de3b95fa27d5cb4
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_y5q3yihs.xfv.psm1
memory/3604-15-0x00000197ACBC0000-0x00000197ACBDE000-memory.dmp
memory/3604-1-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-5-0x0000019794640000-0x0000019794662000-memory.dmp
memory/3604-6-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-7-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-8-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-12-0x00000197ACAD0000-0x00000197ACB82000-memory.dmp
memory/3604-16-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-0-0x00000197942DC000-0x00000197942DD000-memory.dmp
memory/3604-13-0x00000197ACB90000-0x00000197ACB9A000-memory.dmp
memory/3604-2-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-14-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-11-0x00000197ACAB0000-0x00000197ACACE000-memory.dmp
memory/3604-17-0x00000197ACBA0000-0x00000197ACBAA000-memory.dmp
memory/3604-19-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-18-0x00000197AD060000-0x00000197AD07C000-memory.dmp
memory/3604-20-0x00000197ACBB0000-0x00000197ACBB8000-memory.dmp
memory/3604-21-0x00000197AD040000-0x00000197AD046000-memory.dmp
memory/3604-22-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-24-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-23-0x00000197AD050000-0x00000197AD05A000-memory.dmp
memory/3604-26-0x0000019793B40000-0x00000197944E4000-memory.dmp
memory/3604-28-0x0000019793B40000-0x00000197944E4000-memory.dmp