Analysis
- max time kernel
298s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 21:29
General
- Target WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
- Size 759B
- Sample261101-1cekwsdc96
- SHA256 1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Comprehensive.Tests.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3k31r3gc\3k31r3gc.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14F5.tmp" "c:\Users\Admin\AppData\Local\Temp\3k31r3gc\CSCC5CBBB33C9ED4C5485C0ED67A6361C59.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3k31r3gc.dll
RES14F5.tmp
__PSScriptPolicyTest_rxxvmpym.jg4.psm1
3k31r3gc.0.cs
3k31r3gc.cmdline
CSCC5CBBB33C9ED4C5485C0ED67A6361C59.TMP
memory/5396-21-0x000001F0FA910000-0x000001F0FA92C000-memory.dmp
memory/5396-26-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-10-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-13-0x000001F0FA6A0000-0x000001F0FA6BE000-memory.dmp
memory/5396-8-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-14-0x000001F0FA6C0000-0x000001F0FA772000-memory.dmp
memory/5396-15-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-16-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-17-0x000001F0FA470000-0x000001F0FA47A000-memory.dmp
memory/5396-18-0x000001F0FA8D0000-0x000001F0FA8EE000-memory.dmp
memory/5396-19-0x000001F0FA480000-0x000001F0FA48A000-memory.dmp
memory/5396-20-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-0-0x00007FFD5DE4F000-0x00007FFD5DE50000-memory.dmp
memory/5396-22-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-23-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-24-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-25-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-9-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-27-0x000001F0FA490000-0x000001F0FA498000-memory.dmp
memory/5396-29-0x000001F0FA900000-0x000001F0FA90A000-memory.dmp
memory/5396-28-0x000001F0FA8F0000-0x000001F0FA8F6000-memory.dmp
memory/5396-30-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-31-0x000001F0FA900000-0x000001F0FA92A000-memory.dmp
memory/5396-32-0x000001F0FA900000-0x000001F0FA924000-memory.dmp
memory/5396-7-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-6-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-5-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-4-0x000001F0FA420000-0x000001F0FA442000-memory.dmp
memory/5396-45-0x000001F0FA3D0000-0x000001F0FA3D8000-memory.dmp
memory/5396-3-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-46-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-47-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp
memory/5396-49-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp