Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 11:50
General
- Target RUN_ORGO.ps1
- Size 683B
- Sample261113-nzxc1aay91
- SHA256 de617e9ee5d4da3e3e2882f6fe6b051449b9e143a03f86be5fbca1ab038afdee
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\RUN_ORGO.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kzuukgxw.nl2.psm1
memory/4764-15-0x000001CB71340000-0x000001CB7134A000-memory.dmp
memory/4764-26-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-5-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-6-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-7-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-8-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-12-0x000001CB71020000-0x000001CB710D2000-memory.dmp
memory/4764-11-0x000001CB71000000-0x000001CB7101E000-memory.dmp
memory/4764-3-0x000001CB70D30000-0x000001CB70D52000-memory.dmp
memory/4764-13-0x000001CB710E0000-0x000001CB710EA000-memory.dmp
memory/4764-14-0x000001CB71360000-0x000001CB7137E000-memory.dmp
memory/4764-0-0x00007FFB5C5AF000-0x00007FFB5C5B0000-memory.dmp
memory/4764-4-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-16-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-23-0x000001CB71380000-0x000001CB71386000-memory.dmp
memory/4764-18-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-20-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-21-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-19-0x000001CB713A0000-0x000001CB713BC000-memory.dmp
memory/4764-24-0x000001CB71390000-0x000001CB7139A000-memory.dmp
memory/4764-22-0x000001CB71350000-0x000001CB71358000-memory.dmp
memory/4764-25-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-17-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-27-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-28-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp
memory/4764-30-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp