Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 23:14
General
- Target wordpress-seo/admin/views/class-yoast-feature-toggle.ps1
- Size 4KB
- Sample261027-28bdsahs8m
- SHA256 640ba55857d3859ee1c61f55ab7657e692150c97e4813b9c031d151c9fb4b6e2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wordpress-seo\admin\views\class-yoast-feature-toggle.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4852-0-0x00007FFB2F65F000-0x00007FFB2F660000-memory.dmp
memory/4852-3-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-5-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-4-0x0000024C37F70000-0x0000024C37F92000-memory.dmp
memory/4852-6-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-7-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-8-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-9-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-10-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-11-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-13-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp
memory/4852-14-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp