02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff.ps1
Size 52KB
Sample260415-mt2j4ab17l
SHA256 02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff
MD5 ee70d9cc5bad399c8379d44fa2473aa4
SHA1 61a389a5e136377e77df0bb5d07e60c6a8770480
SHA512 f4797289876349720c62b6650430e791e861606df47ba3d109d8cf29a3f4a461bc8681d743b2b4e03744fcfbb26fa473397463fdd7aec67a4f4186e8d0d3089f
SSDEEP 768:3Qbin45be8QM4FTxnpcBaBV6nwLMtduGIg5YV/3aviKu1Bo5vxpicHnW1zEk2nGA:kin4uGcMtLHwzx3941vFid7haYDl1FWl
TLSH
T1CB333CD7ED05217C864B5EDD3B7769832432DB166924AE08D802BCFC063BCF5A09E769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4616	powershell.exe
8	4616	powershell.exe
9	4616	powershell.exe
16	4616	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4616	powershell.exe
4616	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeIncreaseQuotaPrivilege	4616	powershell.exe
Token: SeSecurityPrivilege	4616	powershell.exe
Token: SeTakeOwnershipPrivilege	4616	powershell.exe
Token: SeLoadDriverPrivilege	4616	powershell.exe
Token: SeSystemProfilePrivilege	4616	powershell.exe
Token: SeSystemtimePrivilege	4616	powershell.exe
Token: SeProfSingleProcessPrivilege	4616	powershell.exe
Token: SeIncBasePriorityPrivilege	4616	powershell.exe
Token: SeCreatePagefilePrivilege	4616	powershell.exe
Token: SeBackupPrivilege	4616	powershell.exe
Token: SeRestorePrivilege	4616	powershell.exe
Token: SeShutdownPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeSystemEnvironmentPrivilege	4616	powershell.exe
Token: SeRemoteShutdownPrivilege	4616	powershell.exe
Token: SeUndockPrivilege	4616	powershell.exe
Token: SeManageVolumePrivilege	4616	powershell.exe
Token: 33	4616	powershell.exe
Token: 34	4616	powershell.exe
Token: 35	4616	powershell.exe
Token: 36	4616	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_u24wz2d5.o1n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u24wz2d5.o1n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4616-12-0x000001DBFEC90000-0x000001DBFECB4000-memory.dmp

Download

memory/4616-0-0x000001DBFECC0000-0x000001DBFECD0000-memory.dmp

Download

memory/4616-9-0x000001DBFEC30000-0x000001DBFEC52000-memory.dmp

Download

memory/4616-10-0x000001DBFECC0000-0x000001DBFECD0000-memory.dmp

Download

memory/4616-11-0x000001DBFEC90000-0x000001DBFECBA000-memory.dmp

Download

memory/4616-1-0x000001DBFECC0000-0x000001DBFECD0000-memory.dmp

Download

memory/4616-13-0x000001DBFEC70000-0x000001DBFEC7A000-memory.dmp

Download

memory/4616-14-0x000001DBFECC0000-0x000001DBFECD0000-memory.dmp

Download

memory/4616-15-0x000001DBFECC0000-0x000001DBFECD0000-memory.dmp

Download

memory/4616-16-0x000001DBE4D30000-0x000001DBE4D3C000-memory.dmp

Download

memory/4616-17-0x000001DBFECC0000-0x000001DBFECD0000-memory.dmp

Download

memory/4616-20-0x000001DBE4D30000-0x000001DBE4D3C000-memory.dmp

Download