Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 02:34
General
- Target Wave Point - Sample Packs/Wave Point - House Essentials Vol. 1/FX & FOLEY/FX SHORT/WavePoint-LaserBlast2.ps1
- Size 35KB
- Sample261024-c2sl2swx3q
- SHA256 2cae02ab2365d515e1166810dbf13926f7234fbadc0f8a19edbe83c8302fb9f5
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Wave Point - Sample Packs\Wave Point - House Essentials Vol. 1\FX & FOLEY\FX SHORT\WavePoint-LaserBlast2.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ayc505dc.oil.ps1
memory/1844-11-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-6-0x00000240304B0000-0x00000240304D2000-memory.dmp
memory/1844-7-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-9-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-10-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-0-0x00007FF94FF7F000-0x00007FF94FF80000-memory.dmp
memory/1844-12-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-13-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-14-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-15-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-16-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-17-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-18-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/1844-20-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp