Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/10/2026, 17:41
General
- Target payload.ps1
- Size 1.7MB
- Sample261022-v9ghvsd17t
- SHA256 a378b67929589784eb935c8a63f0c275042211273297cfbc6478804cd4f41960
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1m13phzh.cwn.psm1
client.pid
memory/3452-0-0x0000017CA483C000-0x0000017CA483D000-memory.dmp
memory/3452-1-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-4-0x0000017CA4B40000-0x0000017CA4B62000-memory.dmp
memory/3452-5-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-6-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-7-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-8-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-9-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-11-0x0000017CA4B20000-0x0000017CA4B28000-memory.dmp
memory/3452-12-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-10-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-13-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-14-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-15-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-16-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-17-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-20-0x0000017CBD140000-0x0000017CBD15E000-memory.dmp
memory/3452-21-0x0000017CBD370000-0x0000017CBD422000-memory.dmp
memory/3452-22-0x0000017CBD430000-0x0000017CBD43A000-memory.dmp
memory/3452-24-0x0000017CBD5C0000-0x0000017CBD5E4000-memory.dmp
memory/3452-23-0x0000017CBD5C0000-0x0000017CBD5EA000-memory.dmp
memory/3452-25-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-26-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-28-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-27-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-29-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-30-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-31-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-37-0x0000017CBD6E0000-0x0000017CBD722000-memory.dmp
memory/3452-36-0x0000017CBD6D0000-0x0000017CBD6D8000-memory.dmp
memory/3452-35-0x0000017CBD430000-0x0000017CBD43A000-memory.dmp
memory/3452-34-0x0000017CBD690000-0x0000017CBD6D2000-memory.dmp
memory/3452-33-0x0000017CBD150000-0x0000017CBD158000-memory.dmp
memory/3452-32-0x0000017CA4B70000-0x0000017CA4B78000-memory.dmp
memory/3452-38-0x0000017CBD8F0000-0x0000017CBDAB2000-memory.dmp
memory/3452-41-0x0000017CBD760000-0x0000017CBD77E000-memory.dmp
memory/3452-44-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-48-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-47-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-49-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-51-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-52-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-53-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-56-0x0000017CBD7D0000-0x0000017CBD7DA000-memory.dmp
memory/3452-58-0x0000017CC0CE0000-0x0000017CC1208000-memory.dmp
memory/3452-59-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-61-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-63-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-65-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-67-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-69-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-71-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-73-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-75-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-77-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-79-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp
memory/3452-81-0x0000017CA40A0000-0x0000017CA4A44000-memory.dmp