Analysis
- user interaction
yes - max time kernel
66s - max time network
68s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-fr - resource tags
- submitted
30/10/2026, 09:15
General
- Target Loader.ps1
- Size 8KB
- Sample261030-k715daea83
- SHA256 7bc6e086ef46bf96d8badefc7905be41f1bd17ad14b5bc117d0bae55c1c3b368
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Loader.ps12⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svc_596086686\7za.exe"C:\Users\Admin\AppData\Local\Temp\svc_596086686\7za.exe" x C:\Users\Admin\AppData\Local\Temp\svc_596086686\1.zip -oC:\Users\Admin\AppData\Local\Temp\svc_596086686\out -p1 -y3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svc_596086686\out\1\1.exe"C:\Users\Admin\AppData\Local\Temp\svc_596086686\out\1\1.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tds00t5a.rwg.psm1
1.zip
7za.exe
1.exe
memory/2992-96-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-88-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-73-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-74-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-75-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-77-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-78-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-79-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-80-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-82-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-83-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-84-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-85-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-97-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-71-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-86-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-87-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-72-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-95-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-92-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-70-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-89-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-69-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-60-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-61-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-63-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-68-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-65-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-66-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-64-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-62-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-91-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/2992-99-0x00000000035E0000-0x000000000368A000-memory.dmp
memory/6108-26-0x000002DDEBBD0000-0x000002DDEBC82000-memory.dmp
memory/6108-27-0x000002DDEB930000-0x000002DDEB93A000-memory.dmp
memory/6108-45-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-46-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-47-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-48-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-49-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-50-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-40-0x000002DDECA40000-0x000002DDECA60000-memory.dmp
memory/6108-39-0x000002DDEB970000-0x000002DDEB986000-memory.dmp
memory/6108-38-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-37-0x000002DDEB9D0000-0x000002DDEB9DA000-memory.dmp
memory/6108-36-0x000002DDEB980000-0x000002DDEB986000-memory.dmp
memory/6108-35-0x000002DDEB970000-0x000002DDEB978000-memory.dmp
memory/6108-34-0x000002DDEB9B0000-0x000002DDEB9CC000-memory.dmp
memory/6108-33-0x000002DDEB940000-0x000002DDEB94A000-memory.dmp
memory/6108-67-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-32-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-30-0x000002DDEB990000-0x000002DDEB9AE000-memory.dmp
memory/6108-31-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-29-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-28-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-25-0x000002DDEB950000-0x000002DDEB96E000-memory.dmp
memory/6108-41-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-0-0x00007FF9B4D6F000-0x00007FF9B4D70000-memory.dmp
memory/6108-20-0x000002DDEB490000-0x000002DDEB4AE000-memory.dmp
memory/6108-22-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-21-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-19-0x000002DDEC100000-0x000002DDEC628000-memory.dmp
memory/6108-18-0x000002DDEBA00000-0x000002DDEBBC2000-memory.dmp
memory/6108-17-0x000002DDEB7E0000-0x000002DDEB82C000-memory.dmp
memory/6108-16-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-15-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-14-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-12-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-13-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-10-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-11-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-9-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-8-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-7-0x000002DDEB4D0000-0x000002DDEB5D2000-memory.dmp
memory/6108-6-0x000002DDEB200000-0x000002DDEB210000-memory.dmp
memory/6108-2-0x000002DDEABA0000-0x000002DDEABC2000-memory.dmp
memory/6108-3-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-98-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-1-0x000002DDEB260000-0x000002DDEB2EA000-memory.dmp
memory/6108-100-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp
memory/6108-102-0x00007FF9B4BE0000-0x00007FF9B5584000-memory.dmp