Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 18:13
General
- Target FSS-Livery-Converter.exe
- Size 1.3MB
- Sample261107-wt2pjazzhw
- SHA256 0fd069fc56bdb5c4e91900d887a17f2170143b10edda1fc1013b70b1e9da91ff
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FSS-Livery-Converter.exe"C:\Users\Admin\AppData\Local\Temp\FSS-Livery-Converter.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -STA -File C:\Users\Admin\AppData\Local\FSS-Livery-Converter\0e9bb0e3ed8b422f\Convert-Livery.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Convert-Livery.ps1
memory/3240-43-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-40-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-63-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-62-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-61-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-60-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-30-0x00000263A1560000-0x00000263A1582000-memory.dmp
memory/3240-59-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-32-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-33-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-34-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-35-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-36-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-37-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-38-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-39-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-58-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-41-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-57-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-42-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-47-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-56-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-46-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-44-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-48-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-50-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/3240-51-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-52-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-53-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-54-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/3240-55-0x00000263A1A40000-0x00000263A1C0A000-memory.dmp
memory/5888-45-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/5888-1-0x00000000002E0000-0x0000000000426000-memory.dmp
memory/5888-0-0x00007FFE41A6F000-0x00007FFE41A70000-memory.dmp
memory/5888-2-0x0000000000C80000-0x0000000000C8A000-memory.dmp
memory/5888-27-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/5888-26-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/5888-5-0x00007FFE418E0000-0x00007FFE42284000-memory.dmp
memory/5888-4-0x0000000000F00000-0x0000000000F12000-memory.dmp