Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/04/2026, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7.ps1
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7.ps1
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7.ps1
- Size 26KB
- Sample260413-jppsysfs2m
- SHA256 ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7
- MD5 c665978db00bb0f222ae7a0e795252ca
- SHA1 76256a724562a9ad941c8fd2041cd0cfc8cb900d
- SHA512 5eb30a38d83bb59d007717205009bb4716c8aff356c2a0bde4144c6df45cb2cf4dc227c305ff3424dd24b6469f6299f83bd11f2c4b1fb469fc6d7f5d4e8ec00e
- SSDEEP 384:j3CCmd4S3p5Y+ugCM0Y2FBAmOiaq0rJxmru83pE:WCY4ovY1gCM0YWMA0qxE
- TLSH T122C27E61BE98F0B897CF330776B4F9969534B7B2A08D655C60EE84C153DCAE0E53C192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 2748 powershell.exe 13 2748 powershell.exe - Deletes itself 1 IoCs
pid Process 2748 powershell.exe -
pid Process 2748 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2748 powershell.exe 2748 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2748 powershell.exe Token: SeIncreaseQuotaPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 2748 powershell.exe Token: SeTakeOwnershipPrivilege 2748 powershell.exe Token: SeLoadDriverPrivilege 2748 powershell.exe Token: SeSystemProfilePrivilege 2748 powershell.exe Token: SeSystemtimePrivilege 2748 powershell.exe Token: SeProfSingleProcessPrivilege 2748 powershell.exe Token: SeIncBasePriorityPrivilege 2748 powershell.exe Token: SeCreatePagefilePrivilege 2748 powershell.exe Token: SeBackupPrivilege 2748 powershell.exe Token: SeRestorePrivilege 2748 powershell.exe Token: SeShutdownPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSystemEnvironmentPrivilege 2748 powershell.exe Token: SeRemoteShutdownPrivilege 2748 powershell.exe Token: SeUndockPrivilege 2748 powershell.exe Token: SeManageVolumePrivilege 2748 powershell.exe Token: 33 2748 powershell.exe Token: 34 2748 powershell.exe Token: 35 2748 powershell.exe Token: 36 2748 powershell.exe Token: SeIncreaseQuotaPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 2748 powershell.exe Token: SeTakeOwnershipPrivilege 2748 powershell.exe Token: SeLoadDriverPrivilege 2748 powershell.exe Token: SeSystemProfilePrivilege 2748 powershell.exe Token: SeSystemtimePrivilege 2748 powershell.exe Token: SeProfSingleProcessPrivilege 2748 powershell.exe Token: SeIncBasePriorityPrivilege 2748 powershell.exe Token: SeCreatePagefilePrivilege 2748 powershell.exe Token: SeBackupPrivilege 2748 powershell.exe Token: SeRestorePrivilege 2748 powershell.exe Token: SeShutdownPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSystemEnvironmentPrivilege 2748 powershell.exe Token: SeRemoteShutdownPrivilege 2748 powershell.exe Token: SeUndockPrivilege 2748 powershell.exe Token: SeManageVolumePrivilege 2748 powershell.exe Token: 33 2748 powershell.exe Token: 34 2748 powershell.exe Token: 35 2748 powershell.exe Token: 36 2748 powershell.exe Token: SeIncreaseQuotaPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 2748 powershell.exe Token: SeTakeOwnershipPrivilege 2748 powershell.exe Token: SeLoadDriverPrivilege 2748 powershell.exe Token: SeSystemProfilePrivilege 2748 powershell.exe Token: SeSystemtimePrivilege 2748 powershell.exe Token: SeProfSingleProcessPrivilege 2748 powershell.exe Token: SeIncBasePriorityPrivilege 2748 powershell.exe Token: SeCreatePagefilePrivilege 2748 powershell.exe Token: SeBackupPrivilege 2748 powershell.exe Token: SeRestorePrivilege 2748 powershell.exe Token: SeShutdownPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSystemEnvironmentPrivilege 2748 powershell.exe Token: SeRemoteShutdownPrivilege 2748 powershell.exe Token: SeUndockPrivilege 2748 powershell.exe Token: SeManageVolumePrivilege 2748 powershell.exe Token: 33 2748 powershell.exe Token: 34 2748 powershell.exe Token: 35 2748 powershell.exe Token: 36 2748 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jc0jh0ra.vyq.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH