2d6140fd8a72fdbe19be8071f4b7a39a582edc970694a924d49d7a9ae06fbf72

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spools.ps1
Size 2.2MB
Sample260424-2casdaet2m
SHA256 2d6140fd8a72fdbe19be8071f4b7a39a582edc970694a924d49d7a9ae06fbf72
MD5 319a1b032643edc229ff06ad711f69ef
SHA1 d4732c0bfb70409c68793c04d6aed2918a02ef28
SHA512 293244ba4dee9c5f0e9bf88a9a01c6eb53522c2c53d6e166f948f3890592b1bfd613f779d096018b6b8619346f806138a6092e271479ce96d4d649500e7a4c29
SSDEEP 1536:mpu1/SzC9FJKMvMub5rAiGoXJQPrTArCROHQOoPshaybUgyUcXDFcETV2CKOunAu:mkkke6
TLSH
T174B59DC357DC08ED7B8444E942593A5354FBC26B2C9E528CF5E25A07763F8217A3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe
3536	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe
3536	powershell.exe
3536	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4316	3892	powershell.exe	88
PID 4316 wrote to memory of 4684	4316	csc.exe	89
PID 3892 wrote to memory of 3536	3892	powershell.exe	90
PID 3892 wrote to memory of 2620	3892	powershell.exe	92
PID 3892 wrote to memory of 2620	3892	powershell.exe	92

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\spools.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mby22u1m\mby22u1m.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5908.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7F5BEA2D829C46DAA42A397424B7D7A6.TMP"
    3⤵
    PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\System32\wecutil.exe
  "C:\Windows\System32\wecutil.exe"
  2⤵
  PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5908.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5908.tmp
Size 1KB
SHA256 ca4eec2aabd0038edc91b5cbf45c6e23f4e52ec0c02efcb8a0300051a00099a6
MD5 91ac0ca1a5c4b0ca5095e6d3376c69e5
SHA1 241ee892c9c124b30ec107439173d6af17e114d8
SHA512 37d95348f64665c7e5b2fb75a6a091fd01be70c4533adca4630d402361d341b748d7c56ab849a8d029d63a35d5aca5da932ef04e9a481575fb1c8362ccc78343
TLSH
T1E731BE0897EA472BF0779B3168FA135BF268FD50FE616B6F8581421C1C01500EEE2A73
MD5 SHA1 SHA512 TLSH

Submit Download

Temp_4b4beca3f41e41958207e6b2e5209296.dll

Path C:\Users\Admin\AppData\Local\Temp\Temp_4b4beca3f41e41958207e6b2e5209296.dll
Size 7KB
SHA256 b9ddb327f5abb3c01506bd9814cf6ebc43ddbf2bd8a424c383bfa24dbba62618
MD5 a251388daad2fc1daef1e836b8a02ac8
SHA1 95992e3c08099bec3445b8ea9d717a2e654da1b1
SHA512 08de30253f24a08d8b08b17ea0282ddf6ad899b3338ff671ed0dad454d0e47c8df749f05b709ea78f71d4b870dacd4c37da2e86c888e702f1c3c9a994de7fc9b
SSDEEP 96:18+xGQRHVjHlfyz5FAOpew7bfncml+Fi7ISz9lOgPqHz2:e+UQZfybAOpeofDl+FLSzGg22
TLSH
T17AE1D94BE7C981B6D96F033A78F31B125774F0916A3BD7BF09E843591C167E44A423A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i03wfwrm.sft.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i03wfwrm.sft.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7F5BEA2D829C46DAA42A397424B7D7A6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC7F5BEA2D829C46DAA42A397424B7D7A6.TMP
Size 764B
SHA256 edcbc2a60db2792e5c24120d91aa6c3438fb032afb62c28faf24b6dcbf112a8e
MD5 a0d3805e9808f8051ce65b5f3dd87e96
SHA1 5085f0d9560b7458cb3656870cef4852a1010de3
SHA512 06c29b94be9b04738e0530dddb6652b1e42af373b76f3e1898e87a5b5cc3a257bcda1887991a3a8db3f85fbc727509fb2d37bea96748e95f705e72f706482e91
TLSH
T15301C85DA7F8022BF1F79B70B8F55393F2A9BC50FD3267AE18C4031958205009963B76
MD5 SHA1 SHA512 TLSH

Submit Download

mby22u1m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mby22u1m\mby22u1m.0.cs
Size 7KB
SHA256 4990ef5c9a5dce1857a7143e2882b859d682b8650350c363da83b9c67766ae09
MD5 4c9501f4d46f2f83d795595f0220f5d8
SHA1 2d8cdc41e7ba9fec0d7cd6c398059ba9a2638ec8
SHA512 a92e8fd53d76c32921568b014d403e442a7f151f1f114359019037f2f44f181f80ca89d62509abf4b1d201cea7b39ce1f175771a2c3451c7876baaca0f1092df
SSDEEP 192:VNQ/pkT2g7V62P2E2Rz+jAubTP4yasxFGYUVR40yIXYu97X:VNQiiszet0vPkYCSx4YuF
TLSH
T173E143845B9B97B118B32029BBCB9097F623505326BFDD30B5DC43109F0B66CE574B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mby22u1m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mby22u1m\mby22u1m.cmdline
Size 389B
SHA256 0f133e12b04a2e70b445eb9bf75d7dadc50285fa7a26176160405a852fcae11c
MD5 3ac6c4b25a1539f5acffead02a9a1b68
SHA1 52bbd44c429716577b98565d1b4a0ad4f214df6a
SHA512 d4d3b7c38819a6e274d2a23094d2699ad5d085720e0ce6f30ee813d281d6a05e881ef045428a50769e00d9bd771e30d28768dd6a16ca3866eeacc38ad7602ed1
TLSH
T159E0C07B9396C27D46DD102B326ED6FCD67227877A813FD49850841ED1A74016BD1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2620-39-0x000001D12F180000-0x000001D12F1C0000-memory.dmp

Download

memory/2620-38-0x000001D12F180000-0x000001D12F1C0000-memory.dmp

Download

memory/2620-40-0x000001D12F180000-0x000001D12F1C0000-memory.dmp

Download

memory/2620-37-0x000001D12F180000-0x000001D12F1C0000-memory.dmp

Download

memory/2620-36-0x000001D12F180000-0x000001D12F1C0000-memory.dmp

Download

memory/3536-25-0x0000013DEA080000-0x0000013DEA090000-memory.dmp

Download

memory/3536-26-0x0000013DEA080000-0x0000013DEA090000-memory.dmp

Download

memory/3892-23-0x0000022BECA10000-0x0000022BECB86000-memory.dmp

Download

memory/3892-34-0x0000022BEC940000-0x0000022BEC984000-memory.dmp

Download

memory/3892-35-0x0000022BECCD0000-0x0000022BECD46000-memory.dmp

Download

memory/3892-24-0x0000022BECDA0000-0x0000022BECFAA000-memory.dmp

Download

memory/3892-1-0x0000022BEC3B0000-0x0000022BEC3C0000-memory.dmp

Download

memory/3892-22-0x0000022BEC4E0000-0x0000022BEC4E8000-memory.dmp

Download

memory/3892-7-0x0000022BEC4F0000-0x0000022BEC512000-memory.dmp

Download

memory/3892-0-0x0000022BEC3B0000-0x0000022BEC3C0000-memory.dmp

Download

memory/3892-42-0x0000022BEC3B0000-0x0000022BEC3C0000-memory.dmp

Download

memory/3892-41-0x0000022BEC3B0000-0x0000022BEC3C0000-memory.dmp

Download