8cb2f123500d51fbc99ba3026503606b63f0a4e36e2a1667d774291b53d18af8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
botnet.ps1
Size 11KB
Sample260516-xtv3esb13m
SHA256 8cb2f123500d51fbc99ba3026503606b63f0a4e36e2a1667d774291b53d18af8
MD5 4c230d8732fd2cc3e624fb0d40e701aa
SHA1 cbd8264695920ddf23c5e561e7938ea2a0642c5c
SHA512 0736b044a2bded847b027a5e7a4455ce89eea7d14d5dddb861ace80ef3b491138022b21ad3318152ac317f5a1ed786769a9f99a94c445284a360b59c5ea40881
SSDEEP 192:vLNtRY8IMc5bVkiFC4okokokom/RApygeIV7YVqFvyiSCLwQwCOKeJlBu3BlCL3r:vhIMctSYzIV7Nc7P2SDACpa+h
TLSH
T14832D65976BCE57A82672439CC8FA644A431103B126E9E10BADDC6C0FF11338C7AA6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\botnet.ps1\""	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe
2508	powershell.exe
1080	powershell.exe
4360	powershell.exe
1056	powershell.exe
4172	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
1056	powershell.exe
1056	powershell.exe
4172	powershell.exe
4172	powershell.exe
2272	powershell.exe
2272	powershell.exe
2508	powershell.exe
2508	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeIncreaseQuotaPrivilege	4360	powershell.exe
Token: SeSecurityPrivilege	4360	powershell.exe
Token: SeTakeOwnershipPrivilege	4360	powershell.exe
Token: SeLoadDriverPrivilege	4360	powershell.exe
Token: SeSystemProfilePrivilege	4360	powershell.exe
Token: SeSystemtimePrivilege	4360	powershell.exe
Token: SeProfSingleProcessPrivilege	4360	powershell.exe
Token: SeIncBasePriorityPrivilege	4360	powershell.exe
Token: SeCreatePagefilePrivilege	4360	powershell.exe
Token: SeBackupPrivilege	4360	powershell.exe
Token: SeRestorePrivilege	4360	powershell.exe
Token: SeShutdownPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeSystemEnvironmentPrivilege	4360	powershell.exe
Token: SeRemoteShutdownPrivilege	4360	powershell.exe
Token: SeUndockPrivilege	4360	powershell.exe
Token: SeManageVolumePrivilege	4360	powershell.exe
Token: 33	4360	powershell.exe
Token: 34	4360	powershell.exe
Token: 35	4360	powershell.exe
Token: 36	4360	powershell.exe
Token: SeIncreaseQuotaPrivilege	4360	powershell.exe
Token: SeSecurityPrivilege	4360	powershell.exe
Token: SeTakeOwnershipPrivilege	4360	powershell.exe
Token: SeLoadDriverPrivilege	4360	powershell.exe
Token: SeSystemProfilePrivilege	4360	powershell.exe
Token: SeSystemtimePrivilege	4360	powershell.exe
Token: SeProfSingleProcessPrivilege	4360	powershell.exe
Token: SeIncBasePriorityPrivilege	4360	powershell.exe
Token: SeCreatePagefilePrivilege	4360	powershell.exe
Token: SeBackupPrivilege	4360	powershell.exe
Token: SeRestorePrivilege	4360	powershell.exe
Token: SeShutdownPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeSystemEnvironmentPrivilege	4360	powershell.exe
Token: SeRemoteShutdownPrivilege	4360	powershell.exe
Token: SeUndockPrivilege	4360	powershell.exe
Token: SeManageVolumePrivilege	4360	powershell.exe
Token: 33	4360	powershell.exe
Token: 34	4360	powershell.exe
Token: 35	4360	powershell.exe
Token: 36	4360	powershell.exe
Token: SeIncreaseQuotaPrivilege	4360	powershell.exe
Token: SeSecurityPrivilege	4360	powershell.exe
Token: SeTakeOwnershipPrivilege	4360	powershell.exe
Token: SeLoadDriverPrivilege	4360	powershell.exe
Token: SeSystemProfilePrivilege	4360	powershell.exe
Token: SeSystemtimePrivilege	4360	powershell.exe
Token: SeProfSingleProcessPrivilege	4360	powershell.exe
Token: SeIncBasePriorityPrivilege	4360	powershell.exe
Token: SeCreatePagefilePrivilege	4360	powershell.exe
Token: SeBackupPrivilege	4360	powershell.exe
Token: SeRestorePrivilege	4360	powershell.exe
Token: SeShutdownPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeSystemEnvironmentPrivilege	4360	powershell.exe
Token: SeRemoteShutdownPrivilege	4360	powershell.exe
Token: SeUndockPrivilege	4360	powershell.exe
Token: SeManageVolumePrivilege	4360	powershell.exe
Token: 33	4360	powershell.exe
Token: 34	4360	powershell.exe
Token: 35	4360	powershell.exe
Token: 36	4360	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1056	4360	powershell.exe	90
PID 4360 wrote to memory of 4172	4360	powershell.exe	92
PID 4360 wrote to memory of 2272	4360	powershell.exe	94
PID 4360 wrote to memory of 2508	4360	powershell.exe	96
PID 4360 wrote to memory of 1080	4360	powershell.exe	98

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\botnet.ps1
1⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 8bcbbdcd7fcf9960dc0b6e02c892783441879ab3b0d868c92eb302db08930cba
MD5 d31d82a13fb392fa9d62e409168017a5
SHA1 441cdffb39de3557f76a00e19d747b2496d50b9f
SHA512 f21a4918a49f56e522c141aa4db2bddba5202a9b2457570022775147e24c71764ba874f6acc5bfc76f93e538ff587b2dd2857e0099ca2afc70b427d34707ea92
SSDEEP 1536:hC+jH04tAHkjUpx9SMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa7:hC+jH04tAHkjUpxwMrxyNhftflJdvYoy
TLSH
T164434093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pn2ss0rs.jur.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pn2ss0rs.jur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1056-17-0x0000024FA3610000-0x0000024FA3620000-memory.dmp

Download

memory/1056-57-0x0000024FA3610000-0x0000024FA3620000-memory.dmp

Download

memory/4360-15-0x00000260DADE0000-0x00000260DAF56000-memory.dmp

Download

memory/4360-14-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-0-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-16-0x00000260DB170000-0x00000260DB37A000-memory.dmp

Download

memory/4360-13-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-54-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-53-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-55-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-56-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download

memory/4360-2-0x00000260DA750000-0x00000260DA772000-memory.dmp

Download

memory/4360-1-0x00000260DA790000-0x00000260DA7A0000-memory.dmp

Download