Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 17:52
General
- Target AutoDivert/daemon.ps1
- Size 14KB
- Sample261029-wfpg2sey2m
- SHA256 b4a05ab3abcc1cd92c6b4f79bf89e0a4a77e69101faaa8b527132b3d7c98cf7c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\AutoDivert\daemon.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
blocklist-ips.txt
collector.log
__PSScriptPolicyTest_l4rhinow.3ev.psm1
memory/5044-10-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-5-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-7-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-8-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-9-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-0-0x00007FFF86A4F000-0x00007FFF86A50000-memory.dmp
memory/5044-12-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-15-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-26-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-17-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-21-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-22-0x00000282A8EB0000-0x00000282A8F62000-memory.dmp
memory/5044-24-0x0000028290B00000-0x0000028290B0A000-memory.dmp
memory/5044-23-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-6-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-25-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-16-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-20-0x00000282A8E90000-0x00000282A8EAE000-memory.dmp
memory/5044-27-0x00000282A8F90000-0x00000282A8FAE000-memory.dmp
memory/5044-29-0x00000282A9440000-0x00000282A945A000-memory.dmp
memory/5044-28-0x00000282A8F70000-0x00000282A8F7E000-memory.dmp
memory/5044-4-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-38-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-39-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-40-0x00000282A8F90000-0x00000282A8FA0000-memory.dmp
memory/5044-50-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-51-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-52-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-53-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-54-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-55-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/5044-3-0x00000282A8E60000-0x00000282A8E82000-memory.dmp