80dcad14be16b3be4e0eb9bcce6034c67300b34bf9db79597aac533e547050d4

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malwa.ps1
Size 2KB
Sample260424-nc2dfaf121
SHA256 80dcad14be16b3be4e0eb9bcce6034c67300b34bf9db79597aac533e547050d4
MD5 2f77c8de4bebc18e9d6abba0304a3da3
SHA1 d2b5c992b581aba42333007d4b8452bdf1df1441
SHA512 bfc2705e27ebbd79f145a024b35f6bfeba66cc1e31b1f400c45a9e21cfa8dbadcf38725dce33239b23edadc8397a6dafc0768249940b6053d8dcacf3d2086167
TLSH
T1BF51861FE569029445A3537C454AAFB8787FA06F52872FD0785C81407F6603D0F7A799
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4480	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.jpg"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 6012	4480	powershell.exe	86
PID 6012 wrote to memory of 4520	6012	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malwa.ps1
1⤵
- Badlisted process makes network request
- Sets desktop wallpaper using registry
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bgxfhnm4\bgxfhnm4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1122.tmp" "c:\Users\Admin\AppData\Local\Temp\bgxfhnm4\CSCBECE64AD366F44D4B4696DFF602424B6.TMP"
    3⤵
    PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

RES1122.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1122.tmp
Size 1KB
SHA256 14ec429db90c4756bcd2f9cfd54f06ebbac8e7f893240661ce5e40a783424c82
MD5 6bbeb7753e52b2850ad649501f52314a
SHA1 19ddfddc56e4f14531e50eac5a66ee86d77beb6f
SHA512 017f75e4059e9c3810753192d0ad404159878e7c923629358262edd707e6500bab2ce32f47943e4840b79d1927abf99b60635ca0befb6c6633a3f57a66352430
TLSH
T13A21890583E94B1EF077573269F6172B9238FD98EFA2935B854442281C51544EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h2mvp3ah.zf3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2mvp3ah.zf3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bgxfhnm4.dll

Path C:\Users\Admin\AppData\Local\Temp\bgxfhnm4\bgxfhnm4.dll
Size 3KB
SHA256 1a3987159981bd98c8b11fb3d128911df2e4fe2a950ee44bbcebc0918aedb8bd
MD5 1c5b7b1fdaed52e37ce9d78cc3f7cf75
SHA1 fe96aa3764535a2669b8c85649987a371e442511
SHA512 e8f2a64aec79b4ca013bdb8832742d79db0d9f321dc6992e93929ed0ed503c895fb5e4230e5077ceb6ff896d8d801513fba756b239aebdf6eeca69f2adc68c63
TLSH
T1FC51BD1667E8466BE86B07346EF387533774F818AB72A75D498042285C617681E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBECE64AD366F44D4B4696DFF602424B6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bgxfhnm4\CSCBECE64AD366F44D4B4696DFF602424B6.TMP
Size 652B
SHA256 a3029144fa75c7affb7c6614291e1c22b0d7c1aa496208f87d1f2f4665023d2f
MD5 e52482be1908e2c9dd74206ad840d12a
SHA1 c208fbdaeb6882e7739392f4e91218606d26e4cd
SHA512 6b8ed4d7298f9587f2520cf5665111227f45c13caf3308e779dd333b9ee1fdfa3cdb1e64cbb7cd38ec3497491a63abf289345e34cda5123b5e3d4ee8aa906215
TLSH
T169F05E0963F8420EF0F74B30BEF683A391A8FC68EE3293ED5444031928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bgxfhnm4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bgxfhnm4\bgxfhnm4.0.cs
Size 242B
SHA256 46a66a363c32cfa6537da8a5121a28f67fbd0c25c5834513767346c1dc22bde1
MD5 2432eaf5a5ce4b388e99011f331cadf7
SHA1 4ed44b0fa8fea936d6adada0d42fceb4c660bc02
SHA512 f3642c7b3c17b770967888d6f191b90fcdceee5a6adea08cdeaab263ccc36c844dbd7bd6bbad0d2783244a3866df16d02b3a72ece224b7d73e6f1b66d3d0a994
TLSH
T18BD09730B783CAF88403040B0C83A0B5B737A28A73EB7900B4E86110CF8B8082632B38
MD5 SHA1 SHA512 TLSH

Submit Download

bgxfhnm4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bgxfhnm4\bgxfhnm4.cmdline
Size 369B
SHA256 671bae01aa85c3d2bdcfb2517dc283a288635973da714a3b00485fe8904da6aa
MD5 1554159ef4eeecccc1f93d2e094dfbae
SHA1 bda18ba70c62072717cb4e25fd7147ead057c766
SHA512 ac0e05e4f5b3f501c19dc0280195d98537d0d70bb800a464f83c96562cf95e3704d6ca2b9a8ed5e8062c8d3e4804092d1335f9bc6eb848d8eec030a682ed1ec8
TLSH
T11EE0DF2A5397CABD27EA200F267AC9AC82720AC729917F84D152849DE5278046BD3795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4480-0-0x00000298E86A0000-0x00000298E86B0000-memory.dmp

Download

memory/4480-1-0x00000298E8620000-0x00000298E8642000-memory.dmp

Download

memory/4480-24-0x00000298E8680000-0x00000298E8688000-memory.dmp

Download

memory/4480-25-0x00000298E86A0000-0x00000298E86B0000-memory.dmp

Download

memory/4480-28-0x00000298E7F60000-0x00000298E7F6C000-memory.dmp

Download

memory/4520-19-0x000002B2C2AE0000-0x000002B2C2AEC000-memory.dmp

Download

memory/6012-22-0x000002549EE90000-0x000002549EE9C000-memory.dmp

Download