148199cc5de196afafd9ce24c7047d3a009d20ceed42a897618dbc0169e3bf0e

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_powershell_20260523_9b79f3.ps1
Size 12KB
Sample260523-yzvjhscx21
SHA256 148199cc5de196afafd9ce24c7047d3a009d20ceed42a897618dbc0169e3bf0e
MD5 9a90842ca6a94ec81d272b5f6588f074
SHA1 acf39f3a9313b6e7f93c5aa78d056267e2f5c8ed
SHA512 e70878577a028f1742c083fe902c5d09311d284bcfe3359ab5d5138bbc6f28bc459ab282acd57fbc90f5d7777d2aaf4d7b4b63e618578dd35992f9648439309e
SSDEEP 384:WTGgJ5J8PVKGiqmNxvQiOu1M3QZxDjMqhr6:WTGgJwiqQf1MATMqx6
TLSH
T13142EB08FBE096A141D2432CCDA7DA142A3D412F91286A00FAECC1C47F8562DC7FD9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Outlook Files\READ_ME.txt

Ransom Note

YOUR FILES HAVE BEEN PERMANENTLY ENCRYPTED ============================================ All your documents, photos, videos, databases, and other important files on this computer have been irrevocably destroyed using a hybrid military-grade encryption scheme. The unique decryption key has been thrown away. No person, government, or deity can recover your data. Do not waste time searching for a solution. This is not a negotiation.

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateHelper = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\deepseek_powershell_20260523_9b79f3.ps1\""	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
764	sc.exe
2060	sc.exe
3292	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
2580	powershell.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.encrypted\ = "encrypted_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.encrypted	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\encrypted_auto_file\shell	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2148	NOTEPAD.EXE
1692	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2244	powershell.exe
2244	powershell.exe
2580	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeIncreaseQuotaPrivilege	2244	powershell.exe
Token: SeSecurityPrivilege	2244	powershell.exe
Token: SeTakeOwnershipPrivilege	2244	powershell.exe
Token: SeLoadDriverPrivilege	2244	powershell.exe
Token: SeSystemProfilePrivilege	2244	powershell.exe
Token: SeSystemtimePrivilege	2244	powershell.exe
Token: SeProfSingleProcessPrivilege	2244	powershell.exe
Token: SeIncBasePriorityPrivilege	2244	powershell.exe
Token: SeCreatePagefilePrivilege	2244	powershell.exe
Token: SeBackupPrivilege	2244	powershell.exe
Token: SeRestorePrivilege	2244	powershell.exe
Token: SeShutdownPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeSystemEnvironmentPrivilege	2244	powershell.exe
Token: SeRemoteShutdownPrivilege	2244	powershell.exe
Token: SeUndockPrivilege	2244	powershell.exe
Token: SeManageVolumePrivilege	2244	powershell.exe
Token: 33	2244	powershell.exe
Token: 34	2244	powershell.exe
Token: 35	2244	powershell.exe
Token: 36	2244	powershell.exe
Token: SeIncreaseQuotaPrivilege	2244	powershell.exe
Token: SeSecurityPrivilege	2244	powershell.exe
Token: SeTakeOwnershipPrivilege	2244	powershell.exe
Token: SeLoadDriverPrivilege	2244	powershell.exe
Token: SeSystemProfilePrivilege	2244	powershell.exe
Token: SeSystemtimePrivilege	2244	powershell.exe
Token: SeProfSingleProcessPrivilege	2244	powershell.exe
Token: SeIncBasePriorityPrivilege	2244	powershell.exe
Token: SeCreatePagefilePrivilege	2244	powershell.exe
Token: SeBackupPrivilege	2244	powershell.exe
Token: SeRestorePrivilege	2244	powershell.exe
Token: SeShutdownPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeSystemEnvironmentPrivilege	2244	powershell.exe
Token: SeRemoteShutdownPrivilege	2244	powershell.exe
Token: SeUndockPrivilege	2244	powershell.exe
Token: SeManageVolumePrivilege	2244	powershell.exe
Token: 33	2244	powershell.exe
Token: 34	2244	powershell.exe
Token: 35	2244	powershell.exe
Token: 36	2244	powershell.exe
Token: SeIncreaseQuotaPrivilege	2244	powershell.exe
Token: SeSecurityPrivilege	2244	powershell.exe
Token: SeTakeOwnershipPrivilege	2244	powershell.exe
Token: SeLoadDriverPrivilege	2244	powershell.exe
Token: SeSystemProfilePrivilege	2244	powershell.exe
Token: SeSystemtimePrivilege	2244	powershell.exe
Token: SeProfSingleProcessPrivilege	2244	powershell.exe
Token: SeIncBasePriorityPrivilege	2244	powershell.exe
Token: SeCreatePagefilePrivilege	2244	powershell.exe
Token: SeBackupPrivilege	2244	powershell.exe
Token: SeRestorePrivilege	2244	powershell.exe
Token: SeShutdownPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeSystemEnvironmentPrivilege	2244	powershell.exe
Token: SeRemoteShutdownPrivilege	2244	powershell.exe
Token: SeUndockPrivilege	2244	powershell.exe
Token: SeManageVolumePrivilege	2244	powershell.exe
Token: 33	2244	powershell.exe
Token: 34	2244	powershell.exe
Token: 35	2244	powershell.exe
Token: 36	2244	powershell.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe
3024	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 764	2244	powershell.exe	90
PID 2244 wrote to memory of 3292	2244	powershell.exe	91
PID 2244 wrote to memory of 2060	2244	powershell.exe	92
PID 3024 wrote to memory of 1692	3024	OpenWith.exe	124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\deepseek_powershell_20260523_9b79f3.ps1
1⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" create WindowsSecurityAssistant binPath= "powershell.exe -ExecutionPolicy Bypass -File "C:\Windows\Temp\deepseek_powershell_20260523_9b79f3.ps1"" start= auto DisplayName= "Windows Security Assistant Service"
  2⤵
  - Launches sc.exe
  PID:764
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" description WindowsSecurityAssistant "Ensures system integrity and performs security maintenance."
  2⤵
  - Launches sc.exe
  PID:3292
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" start WindowsSecurityAssistant
  2⤵
  - Launches sc.exe
  PID:2060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File C:\Windows\Temp\deepseek_powershell_20260523_9b79f3.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2580

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READ_ME.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\ConvertToTrace.docx.encrypted
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bc15qrcs.zsm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bc15qrcs.zsm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ConvertToTrace.docx.encrypted

Path C:\Users\Admin\Documents\ConvertToTrace.docx.encrypted
Size 20KB
SHA256 ed66d9cd74110e3b0e128da03e42b610e7cdc9bf8c72bb01c2346dcb08a75aa0
MD5 f51cf6a5f42bdb13fbe8c40ef5c61e9a
SHA1 b7f27a314ce2bf55fdcc73857e94e853d03ea4a5
SHA512 5be662e8a9ef4be52b9f8160139fd73e9e1ec3fc270bff7f8cee11be89f700e965f6d37d1d9bea32fbc87dbe8d56001c75cce01f45a89b6e5094b0af9f744517
SSDEEP 384:J/jkq9PXEzVC3DDitHSi3tJy0o4nbGVyPAZ8aBX2K5ZS/CL6CmBv6:NjhXCC3DCvsWav561i
TLSH
T12592F1C95797A614E11E690926074A4BE002CA9CBEB6C7D8137B039D2BDC279B44EDB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READ_ME.txt

Path C:\Users\Admin\Documents\Outlook Files\READ_ME.txt
Size 434B
SHA256 078ef3b37a9f1cc00b4272217779c38700f3256a70515d3e00558666ca02d73d
MD5 a76b89ecfc35527a6855b757e55373d5
SHA1 80bba1870584f85d20ee9f8cb9a72f56cfbd8e60
SHA512 6c10c0a27059052871a27dad54f9a705fb97c51988a574174c6e0e4a35fd0cdae13cfea639bed6b1d9aed6ff2855c9606af3882b7dac63d5823eda9ef4ae2517
TLSH
T1A8E0F10F9B590411229791C36F143B917B105340711FA50B5D0F9864215FF01C557860
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2244-27-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-10-0x00000276267B0000-0x00000276267DA000-memory.dmp

Download

memory/2244-11-0x00000276267B0000-0x00000276267D4000-memory.dmp

Download

memory/2244-12-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-13-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-26-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-25-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-0-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-28-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2244-7-0x000002760D3A0000-0x000002760D3C2000-memory.dmp

Download

memory/2244-1-0x0000027625890000-0x00000276258A0000-memory.dmp

Download

memory/2580-16-0x000002ECD95F0000-0x000002ECD9600000-memory.dmp

Download

memory/2580-15-0x000002ECD95F0000-0x000002ECD9600000-memory.dmp

Download