71f4dee094a714cdf08f890d7fae40a00a1c65ae07736916cd47fbbb5e9d78e6

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ld.ps1
Size 536B
Sample261113-pcjn3aa16x
SHA256 71f4dee094a714cdf08f890d7fae40a00a1c65ae07736916cd47fbbb5e9d78e6
MD5 18e6198cc0bf49b7360d06f687a78b0c
SHA1 6fa966939df6768711801c5c8d52230c681fcbb1
SHA512 4aa21b6535e5575302559611f8b8f33cf7e0ac95512d414e6fa9397c796aabae861a9db4a7b57bf616b9cb015a066c084c54a7c4caeda00c0ce8e3f44d2da3a7
TLSH
T182F0C000A9508D75EFC10587ADF2F4CBD0C3A05B986A7F5402A02CCCF048E3D664F939
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	5468	PowerShell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	5468	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5468	PowerShell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1156	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5468	PowerShell.exe
5468	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5468	PowerShell.exe
Token: SeDebugPrivilege	4428	whoami.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4428	1156	cmd.exe	93

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ld.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5468
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c whoami > C:\Users\Public\sys.txt 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\System32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys.txt

Path C:\Users\Public\sys.txt
Size 21B
SHA256 1d11fe0d35f45662cdc2e6237b8a12d402752770ca2f76c2ac3ef54f0b006fb6
MD5 dbf0bf5264ce164cd02c2da7e0151ec6
SHA1 0e1a0054031de9a5019008bc16d2f7cae3d36dc3
SHA512 2400271c342fb3a33357fed5a24a42db1f53f0bce21cc8af1f21e8bd3917c4b8427a84cac794ca86b5a19ddbd21afa150e1e036e47bb7c0b9a30b4f1fce5bbf3
MD5 SHA1 SHA512

Submit Download

memory/5468-8-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-2-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-5-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-6-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-7-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-0-0x00007FF839CFF000-0x00007FF839D00000-memory.dmp

Download

memory/5468-9-0x0000028069C30000-0x0000028069C44000-memory.dmp

Download

memory/5468-10-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-11-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-12-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/5468-1-0x0000028069BE0000-0x0000028069C02000-memory.dmp

Download

memory/5468-17-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download