Analysis
- user interaction
yes - max time kernel
43s - max time network
39s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 02:15
General
- Target install.ps1
- Size 261KB
- Sample261024-cph7vahs5k
- SHA256 defa52e0692f9a1a9a9f4f38ef457e4b954a8f19690a4cbc41a60624fcee6fc9
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE.MinHook.txt
RenameAnythingLauncher.exe
capie.mod
descriptor.mod
capie_menu_mark.dds
capie_menu.gfx
frontendmainview.gui
capie_switch_l_english.yml
capie_switch_l_polish.yml
thumbnail.png
version.dll
capie_core.dll
capie_editor.dll
capie_injector.exe
download-94ded6a0701346218bc47abe3aacf43f.zip
memory/5752-12-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-14-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-21-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-23-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-25-0x0000026D21D40000-0x0000026D21F02000-memory.dmp
memory/5752-26-0x0000026D22440000-0x0000026D22968000-memory.dmp
memory/5752-29-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-32-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-36-0x0000026D218D0000-0x0000026D218E2000-memory.dmp
memory/5752-37-0x0000026D218C0000-0x0000026D218CA000-memory.dmp
memory/5752-18-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-17-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-16-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-19-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-13-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-0-0x00007FFF15F2F000-0x00007FFF15F30000-memory.dmp
memory/5752-11-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-10-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-9-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-8-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-7-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-6-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-5-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-4-0x0000026D21760000-0x0000026D21782000-memory.dmp
memory/5752-1-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5752-150-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp