Analysis
- user interaction
yes - max time kernel
53s - max time network
22s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 16:22
General
- Target antigravity_unlocker_win.ps1
- Size 34KB
- Sample261104-tvm7esbv6x
- SHA256 fb7bdbf35f1da3662c4ba6cb04fbb20323b6372cf6e7ec0e8812b4f50bee409d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\antigravity_unlocker_win.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_cw0uhjfv.zny.ps1
memory/3844-19-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-26-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-7-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-9-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-10-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-11-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-12-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-14-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-13-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-15-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-16-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-17-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-18-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-0-0x00007FFED567F000-0x00007FFED5680000-memory.dmp
memory/3844-6-0x0000016A52E40000-0x0000016A52E62000-memory.dmp
memory/3844-23-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-20-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-24-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-25-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-21-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-27-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-28-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-29-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-30-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-31-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-32-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-33-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-34-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp
memory/3844-35-0x00007FFED54F0000-0x00007FFED5E94000-memory.dmp