05ef1162119b056a9c419fe8c1231bef91bf07fe055884186b51f338f0ef6115

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 688KB
Sample260522-wt2drscw9m
SHA256 05ef1162119b056a9c419fe8c1231bef91bf07fe055884186b51f338f0ef6115
MD5 c40c371e7c65d2b0b51b3b96a34a7fcb
SHA1 b820f6561bc9079e880868c8b86e44dc18068750
SHA512 b5317ef8c22f6688149fb22e27f93cef4020afaf1858035a110050cf22300b1935ac5ac41472c06549f1307ea4b3152315f0de2c489dfe79bf44701aed509e65
SSDEEP 12288:52fRxZmFIxfIaIHxnzos5KdHnKV6mypwWZ7pE+ZRuYLsoZo1e1fB:52px+BxnXytRG1e3
TLSH
T14EE46D307A021EFF5BB820C248DA851C563C27B9DA682DF669CB4CE2390D77517B79B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
22	4220	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4220 set thread context of 3856	4220	powershell.exe	91

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4220	powershell.exe
4356	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeIncreaseQuotaPrivilege	4220	powershell.exe
Token: SeSecurityPrivilege	4220	powershell.exe
Token: SeTakeOwnershipPrivilege	4220	powershell.exe
Token: SeLoadDriverPrivilege	4220	powershell.exe
Token: SeSystemProfilePrivilege	4220	powershell.exe
Token: SeSystemtimePrivilege	4220	powershell.exe
Token: SeProfSingleProcessPrivilege	4220	powershell.exe
Token: SeIncBasePriorityPrivilege	4220	powershell.exe
Token: SeCreatePagefilePrivilege	4220	powershell.exe
Token: SeBackupPrivilege	4220	powershell.exe
Token: SeRestorePrivilege	4220	powershell.exe
Token: SeShutdownPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeSystemEnvironmentPrivilege	4220	powershell.exe
Token: SeRemoteShutdownPrivilege	4220	powershell.exe
Token: SeUndockPrivilege	4220	powershell.exe
Token: SeManageVolumePrivilege	4220	powershell.exe
Token: 33	4220	powershell.exe
Token: 34	4220	powershell.exe
Token: 35	4220	powershell.exe
Token: 36	4220	powershell.exe
Token: SeDebugPrivilege	2952	whoami.exe
Token: SeIncreaseQuotaPrivilege	4220	powershell.exe
Token: SeSecurityPrivilege	4220	powershell.exe
Token: SeTakeOwnershipPrivilege	4220	powershell.exe
Token: SeLoadDriverPrivilege	4220	powershell.exe
Token: SeSystemProfilePrivilege	4220	powershell.exe
Token: SeSystemtimePrivilege	4220	powershell.exe
Token: SeProfSingleProcessPrivilege	4220	powershell.exe
Token: SeIncBasePriorityPrivilege	4220	powershell.exe
Token: SeCreatePagefilePrivilege	4220	powershell.exe
Token: SeBackupPrivilege	4220	powershell.exe
Token: SeRestorePrivilege	4220	powershell.exe
Token: SeShutdownPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeSystemEnvironmentPrivilege	4220	powershell.exe
Token: SeRemoteShutdownPrivilege	4220	powershell.exe
Token: SeUndockPrivilege	4220	powershell.exe
Token: SeManageVolumePrivilege	4220	powershell.exe
Token: 33	4220	powershell.exe
Token: 34	4220	powershell.exe
Token: 35	4220	powershell.exe
Token: 36	4220	powershell.exe
Token: SeIncreaseQuotaPrivilege	4220	powershell.exe
Token: SeSecurityPrivilege	4220	powershell.exe
Token: SeTakeOwnershipPrivilege	4220	powershell.exe
Token: SeLoadDriverPrivilege	4220	powershell.exe
Token: SeSystemProfilePrivilege	4220	powershell.exe
Token: SeSystemtimePrivilege	4220	powershell.exe
Token: SeProfSingleProcessPrivilege	4220	powershell.exe
Token: SeIncBasePriorityPrivilege	4220	powershell.exe
Token: SeCreatePagefilePrivilege	4220	powershell.exe
Token: SeBackupPrivilege	4220	powershell.exe
Token: SeRestorePrivilege	4220	powershell.exe
Token: SeShutdownPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeSystemEnvironmentPrivilege	4220	powershell.exe
Token: SeRemoteShutdownPrivilege	4220	powershell.exe
Token: SeUndockPrivilege	4220	powershell.exe
Token: SeManageVolumePrivilege	4220	powershell.exe
Token: 33	4220	powershell.exe
Token: 34	4220	powershell.exe
Token: 35	4220	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 2952	4220	powershell.exe	90
PID 4220 wrote to memory of 3856	4220	powershell.exe	91
PID 4220 wrote to memory of 3856	4220	powershell.exe	91
PID 4220 wrote to memory of 3856	4220	powershell.exe	91
PID 4220 wrote to memory of 3856	4220	powershell.exe	91
PID 4220 wrote to memory of 3856	4220	powershell.exe	91
PID 4696 wrote to memory of 4356	4696	conhost.exe	111
PID 4356 wrote to memory of 3736	4356	powershell.exe	112
PID 3736 wrote to memory of 3848	3736	csc.exe	113

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1200

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -ep bypass -file "C:\ProgramData\onedrive-sync.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ep bypass -file C:\ProgramData\onedrive-sync.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2cg4cska\2cg4cska.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF6.tmp" "c:\Users\Admin\AppData\Local\Temp\2cg4cska\CSC1A17EB44E5AC4530A5C1986802F2CB7.TMP"
      4⤵
      PID:3848

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless powershell -ep bypass -file "C:\ProgramData\onedrive-sync.ps1"
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

onedrive-sync.ps1

Path C:\ProgramData\onedrive-sync.ps1
Size 328KB
SHA256 727c35900b684e2339cf25f6f79d1c4c003f4c7277d0d6cdec66c60b2a47dbae
MD5 ffe3876f56579e2e4691da86e99c0381
SHA1 650fef4d38b3470fd543accccc5e3eef922aceb3
SHA512 3e69fa8f63f5e1319360606a3d2956ddebf5c4c02933771421e3ee565334e69df0ef887517d33f2ed5703d1664d73cf230a5b9b5a3babc0d53cba9e6fa317396
SSDEEP 6144:jB28/vB6qonZoNE/8jP/VZwl74gHspCzzr6+Dvw2J6eV:2oasP/UB/iCz3p+eV
TLSH
T159645B207A426EFB5BBC20C248CAC51C662C36B5C9686DF57ACF1CA23F0D76616B7570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 ae19d5fb9122eb3f5bfbde5364d6c7f1206ab89d6592315f69514d455d315bc9
MD5 bd5ac526558a1753a45425a0f0c28a62
SHA1 92dc535d870cb84e3bbc1143e24c9ca37001a2bb
SHA512 fbc1073d88dfcffeaeca43a5137eb09046123af76f54efb3876884bf3a3799c41100e4a99b841ee12b02c106b40f366ff45828e6ca0db4e6eb226d0098709ac1
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZ7qg0WPfsNySxBPFX:iqdYqGAjdx4qKkq3qktznEuZq6XIzo7q
TLSH
T1E281DD313275B0D4C9567F072A2819D463BF4386EA98AF4CB25C621ED92751BDB221F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e38d17687ad3cbece466448e37b7e035e083226adce62bec57dc5d62f3fcd2cc
MD5 edb48d51cc1edcc6b425cce11a3ddaa9
SHA1 e6c2de6b5f7a5e40b8dace13bd12e68c437b3fbc
SHA512 1671d4af03ce5121d9084c5a61ead2bcb686b9e8c1215b40fe8807074f063503e30bc8cf42cecc7aadafc16f90e9e00d58dc4d01ab94610351527bb04f108e25
TLSH
T1F541B727B39C85E0D889257ADCEC5C117A7693D3C09F8FCB6AC0D610E1AFA98CA68050
MD5 SHA1 SHA512 TLSH

Submit Download

2cg4cska.dll

Path C:\Users\Admin\AppData\Local\Temp\2cg4cska\2cg4cska.dll
Size 3KB
SHA256 cedde245473ceb9df26c1a74602ece354ffb4989b7d712901823fbb964d00912
MD5 3ff218dfa335f2caae71880d0f7b5866
SHA1 eb75df2664a9f5778c828dea80e9ea8a1a7a149e
SHA512 51b94ae3a77d914a5b6280d35f04f10f6d7590fea07c0c8b3661f89110e4e641ef856442f9ae9b6f1952b9fed80025dd698cfbca4dde29b08f74184935d9290b
TLSH
T1D1715006A7E44AA6F0B7073869E3431113B8F8609E37575F18C82328BC65B646E36BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESCF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCF6.tmp
Size 1KB
SHA256 a9e01149a994f5b0b9045ced8d6249391f888625c3d41fe8643aa0a5cad48187
MD5 233b2d4c6f12a67d7aef1a921a28a33d
SHA1 8a54e41612375e24cb7ba5309de7e0c0a26b443f
SHA512 c54a0253f20941a9e31128d33a5f3b94a3e341bafefe87e7f1bba10a05d54e1f3f0dad6167078eb72c869fd8b7d7d520cea011224ac8be71c4fac5587dcf328e
TLSH
T14921AB0593FC070FF0735B31A9F6031B9624FD55EFB2935A848042282C50940EEB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iz5v13c5.eul.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iz5v13c5.eul.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2cg4cska.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2cg4cska\2cg4cska.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

2cg4cska.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2cg4cska\2cg4cska.cmdline
Size 369B
SHA256 996b420f7a628007ed39392698962f9c54709b9b33d372b672dbc8e1e5fed0af
MD5 d31a373914790842425d547713fa9aad
SHA1 b867ff6440739a25a3535559a64a1792299a23ac
SHA512 2d63c064f6562985b8e39e28d2fa8a136019259249852479b2ede610bc9ec3675c040ca26882515bb0264735df8dcf64ea29595409192ffa48f0542185c5f51f
TLSH
T1E2E0202AA35ACA7D35DD180731A9D5ACD27207473DC9BF845150845DE01F00567D1B66
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1A17EB44E5AC4530A5C1986802F2CB7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2cg4cska\CSC1A17EB44E5AC4530A5C1986802F2CB7.TMP
Size 652B
SHA256 dd85154de84cc5852ca29b1e5a705d6bd118db84c39cc6618dd4a38e38eb6e8d
MD5 910aa43f537c72fcfb81862878d1fb9e
SHA1 546b106987470fe41f859ab6a666fc414b75e6da
SHA512 a4974479d771ddf189c70552b9535be9ee4329f220f46b3d4684f385f679f597732ab8285f86ad2cc3f2e0afa8bd4266cf146b67bf2e1a78f5283a9bcd9927b9
TLSH
T131F03A0963F8020EF4F35B71B9F6836395A8FC64DE72A3ED548003192864920D962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3856-16-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4220-11-0x0000019EE1A70000-0x0000019EE1A82000-memory.dmp

Download

memory/4220-17-0x0000019EE2100000-0x0000019EE22C2000-memory.dmp

Download

memory/4220-18-0x00007FFC45E40000-0x00007FFC46109000-memory.dmp

Download

memory/4220-35-0x00007FFC45E40000-0x00007FFC46109000-memory.dmp

Download

memory/4220-14-0x0000019EE1A90000-0x0000019EE1AB4000-memory.dmp

Download

memory/4220-13-0x0000019EE1A90000-0x0000019EE1ABA000-memory.dmp

Download

memory/4220-15-0x00007FFC45E40000-0x00007FFC46109000-memory.dmp

Download

memory/4220-12-0x0000019EE1AE0000-0x0000019EE1B30000-memory.dmp

Download

memory/4220-10-0x00007FFC45E40000-0x00007FFC46109000-memory.dmp

Download

memory/4220-9-0x0000019EC70A0000-0x0000019EC70C2000-memory.dmp

Download

memory/4220-5-0x00007FFC45E40000-0x00007FFC46109000-memory.dmp

Download

memory/4220-6-0x00007FFC45E40000-0x00007FFC46109000-memory.dmp

Download

memory/4356-58-0x0000026C246E0000-0x0000026C246E8000-memory.dmp

Download