80dcad14be16b3be4e0eb9bcce6034c67300b34bf9db79597aac533e547050d4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malwa.ps1
Size 2KB
Sample260424-nc2dfaf121
SHA256 80dcad14be16b3be4e0eb9bcce6034c67300b34bf9db79597aac533e547050d4
MD5 2f77c8de4bebc18e9d6abba0304a3da3
SHA1 d2b5c992b581aba42333007d4b8452bdf1df1441
SHA512 bfc2705e27ebbd79f145a024b35f6bfeba66cc1e31b1f400c45a9e21cfa8dbadcf38725dce33239b23edadc8397a6dafc0768249940b6053d8dcacf3d2086167
TLSH
T1BF51861FE569029445A3537C454AAFB8787FA06F52872FD0785C81407F6603D0F7A799
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1040	PowerShell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.jpg"	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1040	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1040	PowerShell.exe
1040	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4184	1040	PowerShell.exe	80
PID 4184 wrote to memory of 2980	4184	csc.exe	81

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malwa.ps1
1⤵
- Badlisted process makes network request
- Sets desktop wallpaper using registry
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\djk2owyk\djk2owyk.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED2F.tmp" "c:\Users\Admin\AppData\Local\Temp\djk2owyk\CSC499A822A26F346E1A6D2E8A3D653ABFE.TMP"
    3⤵
    PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

RESED2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESED2F.tmp
Size 1KB
SHA256 ee0a7b9fac5d6de08bf2a821c29cd1e98836a9fb228b594f08c4980ed12759ff
MD5 3e1d1a7036a85f95d6aa9c07b326d77e
SHA1 9d4c6539308e3a6f7e86ed351f3009ce9d7151e1
SHA512 d7cba8070505c3d5958cce0fb45fe729a66fe38a3dabb652efb73619be1dfa309cfaa1022ba87c5fbfeaa2d93e691c0b16aee47c8b5c5a4d8d60cad5ac054fc3
TLSH
T1B721CC0583E88B0EF0B3973169F5072F9274FD65EFA6935B858042281C51240EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u4r0xpi0.p4j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4r0xpi0.p4j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

djk2owyk.dll

Path C:\Users\Admin\AppData\Local\Temp\djk2owyk\djk2owyk.dll
Size 3KB
SHA256 e6ae9b0866a4126842827661b67125cc45a521614dcbb19815f8951d3293323e
MD5 a35f3771ce04dafb0f58cceb6ca7a563
SHA1 bd30aadb427a67a702e9b9769700044ba0602fba
SHA512 2931fe9cfd7abdba7fa27179dd7cfc770c5ee3bd1293ee8605a875054a4e0663fe4141fa2a0deb54c845726a76886b607515b25cd1203b1647891198338e9a9f
TLSH
T1A051BD1AA3E8466BE86707346DF387633774F8249F67A35D0980422C9C517685E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC499A822A26F346E1A6D2E8A3D653ABFE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\djk2owyk\CSC499A822A26F346E1A6D2E8A3D653ABFE.TMP
Size 652B
SHA256 245cf60e4b3d6c188b3666d5153679ce5df8c58896cac68f7de1a941e0aa86fa
MD5 40fa453053156896cd11da62a3d66e26
SHA1 762afd453a941cc6b01cc37e9c37951d396ab25b
SHA512 fb342c5f80cf396f80220ddab76ba6dfd2f2ae9c6409c49d6c295ae041ee6078b7d55a34e87f1d0a41094da80882b12517e1eb1f201d992b183dc04b5c72b9b9
TLSH
T128F05E4AA3F8520EF0F34B30BDF6836391B8BC64DE3693ED149003196C64620D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

djk2owyk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\djk2owyk\djk2owyk.0.cs
Size 242B
SHA256 46a66a363c32cfa6537da8a5121a28f67fbd0c25c5834513767346c1dc22bde1
MD5 2432eaf5a5ce4b388e99011f331cadf7
SHA1 4ed44b0fa8fea936d6adada0d42fceb4c660bc02
SHA512 f3642c7b3c17b770967888d6f191b90fcdceee5a6adea08cdeaab263ccc36c844dbd7bd6bbad0d2783244a3866df16d02b3a72ece224b7d73e6f1b66d3d0a994
TLSH
T18BD09730B783CAF88403040B0C83A0B5B737A28A73EB7900B4E86110CF8B8082632B38
MD5 SHA1 SHA512 TLSH

Submit Download

djk2owyk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\djk2owyk\djk2owyk.cmdline
Size 369B
SHA256 94c2c2b50b284ea5c2ed992506749c36f8efa4fc7342ba36615e3cd03696883e
MD5 ae9145b82aeff431de72cce44e59e626
SHA1 4ce9739a9b2c8d51ba6511b99d13df39289e1ac0
SHA512 3fae38558c70e56c5017491faf71155e7b7802cf50caf71b8773823bf8f67075842877054c058476313d2deef2fac0acf3ccc503660d322781142f3de5052170
TLSH
T179E0C02A52D6C2FD03DD10072279C4ACC37287633B403F8C5245443DD01700327D3755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-1-0x000001C9FEE60000-0x000001C9FEE70000-memory.dmp

Download

memory/1040-0-0x000001C9FEE60000-0x000001C9FEE70000-memory.dmp

Download

memory/1040-7-0x000001C9FEEE0000-0x000001C9FEF02000-memory.dmp

Download

memory/1040-9-0x000001C9FEE60000-0x000001C9FEE70000-memory.dmp

Download

memory/1040-23-0x000001C9FEF70000-0x000001C9FEF78000-memory.dmp

Download

memory/1040-26-0x000001C9FE990000-0x000001C9FE9A2000-memory.dmp

Download