Analysis
- max time kernel
149s - max time network
17s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 21:49
General
- Target Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Import-TabCompletion.ps1
- Size 5KB
- Sample261029-1pm3sstsb1
- SHA256 94bde3c3fa430738df8c9e1932e9d2a486b9a6287267efa3ef9b770eefb189df
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0\Import-TabCompletion.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_misruvxk.pbk.ps1
memory/1308-17-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-34-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-8-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-9-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-10-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-11-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-12-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-13-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-14-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-15-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-16-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-0-0x00007FFFBA0DF000-0x00007FFFBA0E0000-memory.dmp
memory/1308-6-0x000001F2FAA20000-0x000001F2FAA42000-memory.dmp
memory/1308-18-0x000001F2FADD0000-0x000001F2FADDA000-memory.dmp
memory/1308-29-0x000001F2FB160000-0x000001F2FB18A000-memory.dmp
memory/1308-27-0x000001F2FAF50000-0x000001F2FB002000-memory.dmp
memory/1308-28-0x000001F2FAE40000-0x000001F2FAE4A000-memory.dmp
memory/1308-30-0x000001F2FB160000-0x000001F2FB184000-memory.dmp
memory/1308-26-0x000001F2FAE50000-0x000001F2FAE6E000-memory.dmp
memory/1308-31-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-32-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-33-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp
memory/1308-19-0x000001F2FADF0000-0x000001F2FADF8000-memory.dmp
memory/1308-35-0x000001F2FB330000-0x000001F2FB4F2000-memory.dmp
memory/1308-36-0x000001F2FBA30000-0x000001F2FBF58000-memory.dmp
memory/1308-38-0x00007FFFB9F50000-0x00007FFFBA8F4000-memory.dmp