Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 19:51
General
- Target KaliRELab-1.2.2/Install.ps1
- Size 9KB
- Sample261029-yk1f8aev2y
- SHA256 865e32450dae49c8cca8485819f5b460943fb5345919f1f2ac59734bdf95df16
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\KaliRELab-1.2.2\Install.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wsl.exe"C:\Windows\system32\wsl.exe" --list --quiet2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_cvelxazq.2k1.ps1
memory/1984-15-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-6-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-7-0x00000180A92E0000-0x00000180A9302000-memory.dmp
memory/1984-9-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-10-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-11-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-12-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-13-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-0-0x00007FFB7C08F000-0x00007FFB7C090000-memory.dmp
memory/1984-14-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-18-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-17-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-16-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-19-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-20-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-21-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-22-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-24-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-25-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp
memory/1984-27-0x00007FFB7BF00000-0x00007FFB7C8A4000-memory.dmp