ccf8189b785a41b8582e8ea77ab9ea3592d06ee1b868cd0877007093558baf8d

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ccf8189b785a41b8582e8ea77ab9ea3592d06ee1b868cd0877007093558baf8d.ps1
Size 5KB
Sample260522-w7a4qsfw21
SHA256 ccf8189b785a41b8582e8ea77ab9ea3592d06ee1b868cd0877007093558baf8d
MD5 591742d84b4f8152a629ee83b90b1d59
SHA1 ba0f7b7066ef2b9eb60228d0525e453e75dbf2fe
SHA512 72fc7338430e460e5faee1854877bd7b75a51ab3dbb654a2f5b3db06f2ae600078057858a2fafbcdb709aabc66ddea964beb59e3cc5a9e51ccb8e8404c20dea4
SSDEEP 96:4yEBs5sZ58fOO9D+FwqODvhsZ5SqOHAU4S6C1cpLrR1xHUHAt8XDA7QBQad79ieb:4yeefmqqcia4S606J1H8zUsjlvDJWU
TLSH
T1F7C1241067F95608BAB36B05AABFA455897BBA1D9E36DB4C0048C04E17F2E44CC67F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2424	PowerShell.exe
3	2424	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2424	PowerShell.exe
5680	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2424	PowerShell.exe
2424	PowerShell.exe
5680	powershell.exe
5680	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2424	PowerShell.exe
Token: SeSecurityPrivilege	2424	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2424	PowerShell.exe
Token: SeLoadDriverPrivilege	2424	PowerShell.exe
Token: SeSystemProfilePrivilege	2424	PowerShell.exe
Token: SeSystemtimePrivilege	2424	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2424	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2424	PowerShell.exe
Token: SeCreatePagefilePrivilege	2424	PowerShell.exe
Token: SeBackupPrivilege	2424	PowerShell.exe
Token: SeRestorePrivilege	2424	PowerShell.exe
Token: SeShutdownPrivilege	2424	PowerShell.exe
Token: SeDebugPrivilege	2424	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2424	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2424	PowerShell.exe
Token: SeUndockPrivilege	2424	PowerShell.exe
Token: SeManageVolumePrivilege	2424	PowerShell.exe
Token: 33	2424	PowerShell.exe
Token: 34	2424	PowerShell.exe
Token: 35	2424	PowerShell.exe
Token: 36	2424	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2424	PowerShell.exe
Token: SeSecurityPrivilege	2424	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2424	PowerShell.exe
Token: SeLoadDriverPrivilege	2424	PowerShell.exe
Token: SeSystemProfilePrivilege	2424	PowerShell.exe
Token: SeSystemtimePrivilege	2424	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2424	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2424	PowerShell.exe
Token: SeCreatePagefilePrivilege	2424	PowerShell.exe
Token: SeBackupPrivilege	2424	PowerShell.exe
Token: SeRestorePrivilege	2424	PowerShell.exe
Token: SeShutdownPrivilege	2424	PowerShell.exe
Token: SeDebugPrivilege	2424	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2424	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2424	PowerShell.exe
Token: SeUndockPrivilege	2424	PowerShell.exe
Token: SeManageVolumePrivilege	2424	PowerShell.exe
Token: 33	2424	PowerShell.exe
Token: 34	2424	PowerShell.exe
Token: 35	2424	PowerShell.exe
Token: 36	2424	PowerShell.exe
Token: SeDebugPrivilege	5680	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5680	2424	PowerShell.exe	81

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_ccf8189b785a41b8582e8ea77ab9ea3592d06ee1b868cd0877007093558baf8d.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\krrrr_01.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 45bcb9bf0e8d23bad52fb118465da718f152facb73938dc1d1b02ac24e782665
MD5 1972bec6044fcd8952abf7a50704bdc3
SHA1 d997f828eda01aa8fe5b1ae1795d7e2942997461
SHA512 ad0a0ee00f16deba41674c0e1f3f532254754b4c4896b1f6d254e7935c2b1056c200633518e7695ded974718d9643886996758424fe748d361f933a1ddd4098b
TLSH
T198218633B3ACC135C8D9117A108CAD01B1B1C3C7449ECE8B7B84C508A17F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vln4mwyy.w1q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vln4mwyy.w1q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

krrrr_01.ps1

Path C:\Users\Public\krrrr_01.ps1
Size 1KB
SHA256 f70a8b4c18d718cac1c19ca314f21fe73929ba940bdde0775b1aa30c9ff7aae3
MD5 7626065a8981d53011b0839ee78260b8
SHA1 b7d08540a3cf3c9283ab71ca6213073ed77acd88
SHA512 b0af3495d58ad56a960062a910b9553f9c2521aeedd2fd29b04467c94cd66c2ac823f674f35c0a12acfcc0dd1867c8b2e55e45dca8d8b2f196cf5737567ad960
TLSH
T1D7316E506AF65208B2B35E04A6FFA4924D3B7A7EAD35CB4D0044D14E1BB2A44DC77F36
MD5 SHA1 SHA512 TLSH

Submit Download

yvrkt.txt

Path C:\Users\Public\yvrkt.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2424-11-0x000001E0CB010000-0x000001E0CB020000-memory.dmp

Download

memory/2424-14-0x000001E0CB010000-0x000001E0CB020000-memory.dmp

Download

memory/2424-1-0x000001E0CB010000-0x000001E0CB020000-memory.dmp

Download

memory/2424-10-0x000001E0CB010000-0x000001E0CB020000-memory.dmp

Download

memory/2424-9-0x000001E0CB010000-0x000001E0CB020000-memory.dmp

Download

memory/2424-2-0x000001E0CB050000-0x000001E0CB072000-memory.dmp

Download

memory/2424-0-0x000001E0CB010000-0x000001E0CB020000-memory.dmp

Download

memory/5680-19-0x00000284ABAC0000-0x00000284ABAD0000-memory.dmp

Download

memory/5680-18-0x00000284ABAC0000-0x00000284ABAD0000-memory.dmp

Download