Analysis
- max time kernel
83s - max time network
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 10:41
General
- Target file.ps1
- Size 9KB
- Sample261023-mrcg7aa16w
- SHA256 a1e70d26c772f23617fa9ed0eed39bb198b00240f434c18f3f80ce6a8e9a4fb4
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ijijsuia.t2a.psm1
memory/4140-14-0x0000013061BC0000-0x00000130620E8000-memory.dmp
memory/4140-3-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-5-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-6-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-7-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-8-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-9-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-10-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-11-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-12-0x00000130612A0000-0x00000130612F0000-memory.dmp
memory/4140-13-0x00000130614C0000-0x0000013061682000-memory.dmp
memory/4140-0-0x00007FFDC3B0F000-0x00007FFDC3B10000-memory.dmp
memory/4140-4-0x0000013060E30000-0x0000013060E52000-memory.dmp
memory/4140-17-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-15-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-18-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-19-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-20-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-23-0x00000130612F0000-0x000001306130E000-memory.dmp
memory/4140-25-0x0000013061280000-0x000001306128A000-memory.dmp
memory/4140-24-0x0000013061310000-0x00000130613C2000-memory.dmp
memory/4140-16-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-26-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-27-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp
memory/4140-29-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp