f1edff0290afc18596ec5caf5dc6dc6069f28639ef606824e3a6948beb60027b

Analysis

user interaction
yes
max time kernel
270s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.ps1
Size 11KB
Sample260417-kwfpasas5m
SHA256 f1edff0290afc18596ec5caf5dc6dc6069f28639ef606824e3a6948beb60027b
MD5 f897b018e6ee3a9c1f78377ae93480d2
SHA1 84ba75c985791117107a8b21b61a2b6ac3707a4a
SHA512 f41599eabffc0b0c1e3ec3dcb286aa6373a629befeef3bb0e0f930d654e112a476bf4b5c5a1b2b0016b97ddf1fb45c85681e7fb26653b7b1195d2aba2b1a1f30
SSDEEP 192:+wcgOcgMWBk4JOCxYhlQ8dajdyyN7fohhzLFUhAU3rgBiuTF1fQy9Gi0Ak:PchcbUFOKil5deUyN7ghhzLF+AU3rgBK
TLSH
T16432657DD9E1FCC4036F72D0596E3F46209C4B23FAA56B6CF9C504A62824689DF3A19C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
5080	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3884	powershell.exe
1076	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3884	powershell.exe
3884	powershell.exe
1076	powershell.exe
1076	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeIncreaseQuotaPrivilege	3884	powershell.exe
Token: SeSecurityPrivilege	3884	powershell.exe
Token: SeTakeOwnershipPrivilege	3884	powershell.exe
Token: SeLoadDriverPrivilege	3884	powershell.exe
Token: SeSystemProfilePrivilege	3884	powershell.exe
Token: SeSystemtimePrivilege	3884	powershell.exe
Token: SeProfSingleProcessPrivilege	3884	powershell.exe
Token: SeIncBasePriorityPrivilege	3884	powershell.exe
Token: SeCreatePagefilePrivilege	3884	powershell.exe
Token: SeBackupPrivilege	3884	powershell.exe
Token: SeRestorePrivilege	3884	powershell.exe
Token: SeShutdownPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeSystemEnvironmentPrivilege	3884	powershell.exe
Token: SeRemoteShutdownPrivilege	3884	powershell.exe
Token: SeUndockPrivilege	3884	powershell.exe
Token: SeManageVolumePrivilege	3884	powershell.exe
Token: 33	3884	powershell.exe
Token: 34	3884	powershell.exe
Token: 35	3884	powershell.exe
Token: 36	3884	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 5080	3884	powershell.exe	87
PID 3884 wrote to memory of 1076	3884	powershell.exe	106

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_24ngfw0o.53o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_24ngfw0o.53o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1076-28-0x000001CA560D0000-0x000001CA560E0000-memory.dmp

Download

memory/1076-38-0x000001CA6E7A0000-0x000001CA6E90A000-memory.dmp

Download

memory/1076-39-0x000001CA6E910000-0x000001CA6E926000-memory.dmp

Download

memory/1076-37-0x000001CA55BA0000-0x000001CA55BAC000-memory.dmp

Download

memory/1076-27-0x000001CA560D0000-0x000001CA560E0000-memory.dmp

Download

memory/3884-10-0x0000029C71F50000-0x0000029C71F7A000-memory.dmp

Download

memory/3884-26-0x0000029C725D0000-0x0000029C727DA000-memory.dmp

Download

memory/3884-15-0x0000029C71320000-0x0000029C7132C000-memory.dmp

Download

memory/3884-16-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-19-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-18-0x0000029C71F50000-0x0000029C720BA000-memory.dmp

Download

memory/3884-25-0x0000029C72240000-0x0000029C723B6000-memory.dmp

Download

memory/3884-13-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-14-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-12-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-1-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-11-0x0000029C71F50000-0x0000029C71F74000-memory.dmp

Download

memory/3884-7-0x0000029C71900000-0x0000029C71922000-memory.dmp

Download

memory/3884-0-0x0000029C71960000-0x0000029C71970000-memory.dmp

Download

memory/3884-42-0x0000029C71320000-0x0000029C7132C000-memory.dmp

Download

memory/3884-43-0x0000029C71F50000-0x0000029C720BA000-memory.dmp

Download