79d5249d1893ab6ad1280369c7b846cde6a16e59ccda328449284a8b313770f7

Analysis

max time kernel
298s
max time network
275s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/04/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
seo-following.ps1
Size 17KB
Sample260429-vg83eady4t
SHA256 79d5249d1893ab6ad1280369c7b846cde6a16e59ccda328449284a8b313770f7
MD5 6eee70924d8d0fd7c0f2956e3ff7f433
SHA1 3c5f409fa408523b071104cd52267524a76ad575
SHA512 5700d380897d9019a3d38beb6adac6718afa5dce9c01acab2ca28ed851247bb043f6f501a9124f8a28be569ab6f76ee4d1cdc92f797a251cd2a01be412c7249d
SSDEEP 384:sFXAMpdmPjzhNsJo0cUEnZ1Wuh3LRjgd50g3PHsi+:sFXAMpwXhNgwnZxh3Lm50kki+
TLSH
T1008231A317C90EAE9AD189D7C15AB606A8EAC47F1C2D12CCF5E14647B03ED24B715F38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	1332	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1332	powershell.exe
4424	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
4424	powershell.exe
4424	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe
Token: 34	1332	powershell.exe
Token: 35	1332	powershell.exe
Token: 36	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe
Token: 34	1332	powershell.exe
Token: 35	1332	powershell.exe
Token: 36	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe
Token: 34	1332	powershell.exe
Token: 35	1332	powershell.exe
Token: 36	1332	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3208	1332	powershell.exe	91
PID 3208 wrote to memory of 4112	3208	csc.exe	92
PID 1332 wrote to memory of 4424	1332	powershell.exe	93
PID 1332 wrote to memory of 212	1332	powershell.exe	96
PID 1332 wrote to memory of 212	1332	powershell.exe	96

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\seo-following.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jaumeezt\jaumeezt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES965F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC424F3806BBFD4ECBB7E019553CCB528.TMP"
    3⤵
    PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Windows\System32\change.exe
  "C:\Windows\System32\change.exe"
  2⤵
  PID:212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 660ec6e9bdf9215c37e5cf25ebd588ed26b3cbb41cb1ffa8c31aae95a2331ddc
MD5 0e288ef9d26260b08b48516fe4917e58
SHA1 2e00c4ca9054afbc5d8c1fa66eac27c137a2e4bd
SHA512 90bdeb698bb228892a964f1d7e9fac3b91d3844d6543c3c5c0d0c220de452f4ea32b54d776aac1a53f71615a3b418b7e3efdb24d59adc531236bc4badbf8ccb6
SSDEEP 1536:0UsXNhfkR+jH0Mv35iFHzdyyhl3OihN9flJdFhETYoFUpRLa5Ei3j39MVvjp/KLW:0UsXNhfkR+jH0Mv3gFHzdfhEihN9flJ3
TLSH
T11E434093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES965F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES965F.tmp
Size 1KB
SHA256 1e57bf39bf3a5b798c1e91ac038c07c8db4745c90cb44fa7d2d161f23e3599ea
MD5 1edeb84704bdb0f5665ea2fc6178371a
SHA1 1dda57cd8e0f164b8e6c9868f825d54f01e7e1f5
SHA512 104c250d7614da4b8a71523153a2e724d6ebca40f42bb5f13baf8a8db814e0f9af162df423eb6543a2d88c9a831cf6d32c970dbaf54a4fa752d48c275d96868e
TLSH
T11D31BE1853E94B1FF0B79B31A9F6136BA178FC51FA92975FC54043182800504EEA2B72
MD5 SHA1 SHA512 TLSH

Submit Download

Temp_3e33065f02e14064a0fcb1216e4f04be.dll

Path C:\Users\Admin\AppData\Local\Temp\Temp_3e33065f02e14064a0fcb1216e4f04be.dll
Size 7KB
SHA256 6b68a85041626660f0d10e8e9fcd7a9b10ab6f3abe51725ad6ed63ab6237a985
MD5 f004a1b47017070baf177d7c03c16b66
SHA1 a8a731daec130236512c60ac3ea84fb44ae033f1
SHA512 b2a2d47a691e5b2b7de44d99c4b0265532c996c280bcc6439af4401c9340761912e8e2c58437528fdc3155f097471a38132d16b9d93139d5d7b5b6556c98ea1a
SSDEEP 96:/P8+xGQRlVjHlfyz5FAOHVLew7bfncmHVn+FoyBElOgPqpzU:M+UGZfybAOH1eofDHp+FNgEU
TLSH
T1C6E1DA4BA7C985B2D86F073AB8F31B125774F091292BD7EF19A843591C167E44A423B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_m4grg3gn.24w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m4grg3gn.24w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSC424F3806BBFD4ECBB7E019553CCB528.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC424F3806BBFD4ECBB7E019553CCB528.TMP
Size 764B
SHA256 8ca278fbe96035ba2e5957e7df80b62c1ae1fd70112ec1555c66640a211625ae
MD5 4a9ea9f727da18ad6d8a563e138c4f6e
SHA1 a34a7a8bc78b03d9f46c9b6f0d72bfc4e52c107a
SHA512 f029e396a81678135f3eaee562bbcba4d89110926a47db7d390eed248a8ff8b54db51daa232f64c2f916880e4a8875c8c578e66d0fe0514ead79dfbe11ae95cd
TLSH
T1A901AF5D73F8021BF0F39B70E9F543A3A56DBC62ED3297ED9480131828245149962F75
MD5 SHA1 SHA512 TLSH

Submit Download

jaumeezt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jaumeezt\jaumeezt.0.cs
Size 7KB
SHA256 c0a69d66336b9e3a0ed541795f28faf9e5c09f45c0c1002eeaf680465d0a2177
MD5 7d877a0fd6227eadd2fb32dac1ca4165
SHA1 61758bcdd40711f421020f13bc6399d2161dc2c4
SHA512 2096190f19099ba18ebe9e686bf4304d0a51e5f973252ca0108a16d10b231e463a55e1a9dd403ce14a4437050c248aed2af0f770820cd8b91eff1b97be9944a5
SSDEEP 192:VNQ/pkT2g7V62P2E2Rz+jAubTP4yasxFGYUVR40yIXYuwNX:VNQiiszet0vPkYCSx4YuM
TLSH
T1AEE143845B9B97B118B32029BBCB9097F623505326BFDD30B5DC43109F0B66CE574B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaumeezt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jaumeezt\jaumeezt.cmdline
Size 389B
SHA256 1945730c764293dd34e7f3ed42b280e86409391cad05cbdb5c7092157ca49043
MD5 d0a7d4147474d4bd804a6e47153f52fd
SHA1 728787de40e7c48eb382dc59636c4edde318b6af
SHA512 7e333a24d69f7f48873c7ebb32caf2ab2360eb600723bd351ecf59709d6d526b1fd3f3ec38a290b082cc9bdee7c7d4d7832721893c64051bd21b8ef043615fb6
TLSH
T146E0F83A5306C63C06ED2007226AEAFCC2B20B8B29843F84A40044ADD12740037D3342
MD5 SHA1 SHA512 TLSH

Submit Download

memory/212-52-0x000002804E910000-0x000002804E937000-memory.dmp

Download

memory/212-50-0x00000280500F0000-0x00000280500FC000-memory.dmp

Download

memory/212-49-0x000002804E910000-0x000002804E937000-memory.dmp

Download

memory/1332-12-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/1332-35-0x00000246FA5F0000-0x00000246FA7FA000-memory.dmp

Download

memory/1332-16-0x00000246DF320000-0x00000246DF32C000-memory.dmp

Download

memory/1332-15-0x00000246F95E0000-0x00000246F9604000-memory.dmp

Download

memory/1332-14-0x00000246F95E0000-0x00000246F960A000-memory.dmp

Download

memory/1332-61-0x00000246DF320000-0x00000246DF32C000-memory.dmp

Download

memory/1332-1-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/1332-0-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/1332-13-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/1332-33-0x00000246F95D0000-0x00000246F95D8000-memory.dmp

Download

memory/1332-34-0x00000246FA260000-0x00000246FA3D6000-memory.dmp

Download

memory/1332-17-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/1332-43-0x00000246F9E90000-0x00000246F9ED4000-memory.dmp

Download

memory/1332-44-0x00000246FA160000-0x00000246FA1D6000-memory.dmp

Download

memory/1332-11-0x00000246F9F10000-0x00000246FA0D2000-memory.dmp

Download

memory/1332-9-0x00000246F9220000-0x00000246F9242000-memory.dmp

Download

memory/1332-48-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/1332-10-0x00000246F9260000-0x00000246F9270000-memory.dmp

Download

memory/3208-31-0x00000210DC1F0000-0x00000210DC1FC000-memory.dmp

Download

memory/4112-28-0x00000286BC2E0000-0x00000286BC2EC000-memory.dmp

Download

memory/4424-46-0x000002029E310000-0x000002029E31C000-memory.dmp

Download