9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/ConinMode.ps1
Size 3KB
Sample260502-werwsac121
SHA256 9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034
MD5 dec84b4f7859e44892e0750c83fd693d
SHA1 6f88920515398ca40a09ec06dd2e2a61d2c60583
SHA512 759c6f7c79a6754190848d311ed263e708c1ac791684586228aee63560c8134c310d4433c365d6543b261ffbde7777da63cc69269e22d58d2464ccc6e51ec067
TLSH
T1DB617072B75ED26542761EB8B5C68484F915E82B30A46420B2BC84EE6F3C330D1FAC69
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2872	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	powershell.exe
2872	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2920	2872	powershell.exe	84
PID 2920 wrote to memory of 4108	2920	csc.exe	85

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\ConinMode.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n0w2ijjw\n0w2ijjw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES968E.tmp" "c:\Users\Admin\AppData\Local\Temp\n0w2ijjw\CSC8C044F8D8A1541F0AB54DA152F914B.TMP"
    3⤵
    PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES968E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES968E.tmp
Size 1KB
SHA256 50c13d2d949abb4c257d62a7a6ac573a82fe361c5dbc4583e439dce243072faf
MD5 e4fdd15180436ce6d5faff164f13e6a9
SHA1 1be0402d7f7e630fe28713b403b2d41e9c34cfe1
SHA512 b058221fb5b6f1068dfc87e136a9165a3c80d71f58f7bace66ab480b1c12bd4e4b133f9447db984e0becb65815eb1faf2574248b43279478df3ce6f4f0201917
TLSH
T1A321BB0553E8471EF477573269F6676B9268FDA4EFA1A79E8540423C2C41204EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_z5xg5h0c.wwj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z5xg5h0c.wwj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

n0w2ijjw.dll

Path C:\Users\Admin\AppData\Local\Temp\n0w2ijjw\n0w2ijjw.dll
Size 3KB
SHA256 a0a90073c769964c785a18b933610dd21947a36e48380450bea158c6031fd962
MD5 4bc4edca95ed16c44a6353a139e2d034
SHA1 8ff87fb2611de3ffb3789bfea83a7be4ee57ccf8
SHA512 42c530ed3a62b3bd3af1c70e48539831e76a654a9317d37264f14986b9e3903c69e2210935c5f2fd1a55375d43fa8d91728613643e2c3154cc3bc01c7c30c4a6
TLSH
T18B71EE2BD7E80667E0AA4B349DF3435236B4FC914B629B6E1990031DAC647304F31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8C044F8D8A1541F0AB54DA152F914B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\n0w2ijjw\CSC8C044F8D8A1541F0AB54DA152F914B.TMP
Size 652B
SHA256 872abbf7fc0b72d0389acb75091fe74fa912dbdaebce7b1e94819195871da677
MD5 5805714db51ab185cc4ac12e69278cde
SHA1 a6b7acacdc147a31b82ba48864ee012309d23346
SHA512 96d75b273ac1cb05b11a3a0cedf6ee20d5be5a755f79f3326ef07243238cf6feae5255a5838243f901247d39e2a03430fef48437d4dd64cead010f4990cc27d1
TLSH
T17FF0540963F8020EF4F38B30BDF5536391A8BC64DE7263ED1880035D18645109562FB1
MD5 SHA1 SHA512 TLSH

Submit Download

n0w2ijjw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\n0w2ijjw\n0w2ijjw.0.cs
Size 716B
SHA256 dc34a2660b2aba1533fbcf396fce968c608dec4ca379046c15dd640eae9af060
MD5 2d82556c1fc924d18e71bf050af8e0c6
SHA1 0db7b682254bc5c54620614f8b3930f73797a811
SHA512 6619dd820fa01e95b4f80b2e1f91388b3171383d96704a4b084746cba2f87494e301c97b5772be8a66d7104d792bb5167949a0af6793c894c8a7b08d2c97118b
TLSH
T1DF017B459792C7B2C83515284D4BD4AEF663F12324F97D52B6FC07B1AF2B100953625D
MD5 SHA1 SHA512 TLSH

Submit Download

n0w2ijjw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\n0w2ijjw\n0w2ijjw.cmdline
Size 369B
SHA256 e1a321e1f40e612deefdb5d7c449bceccd1e4f800f85b497eb4eeba8e668aa58
MD5 9cba22a4bf62ca49ac7e737d84d24425
SHA1 d6a20ebdc170a4c0611e1065b6c5cea5db520a8b
SHA512 327334e56774d138740a0af5729f27283f61f5eb4731aa0ddbb358c0c16253c04e2f0d2af762049701482046f5998814c7789bc5dbe77052cf6948c3a315f7d3
TLSH
T1D9E0C02A4287CF7D47DD9007696BE4FCC273078329403FA49848442DD05FE0627E2741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2872-0-0x0000022947540000-0x0000022947550000-memory.dmp

Download

memory/2872-2-0x0000022947650000-0x0000022947672000-memory.dmp

Download

memory/2872-1-0x0000022947540000-0x0000022947550000-memory.dmp

Download

memory/2872-25-0x0000022947530000-0x0000022947538000-memory.dmp

Download

memory/2872-29-0x000002292D750000-0x000002292D75C000-memory.dmp

Download

memory/2872-28-0x000002292D680000-0x000002292D6D5000-memory.dmp

Download

memory/2920-23-0x0000016FD5CC0000-0x0000016FD5CCC000-memory.dmp

Download

memory/2920-22-0x0000016FD5B60000-0x0000016FD5BB5000-memory.dmp

Download

memory/4108-19-0x000002BE90E20000-0x000002BE90E2C000-memory.dmp

Download