148199cc5de196afafd9ce24c7047d3a009d20ceed42a897618dbc0169e3bf0e

Analysis

user interaction
yes
max time kernel
66s
max time network
66s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_powershell_20260523_9b79f3.ps1
Size 12KB
Sample260523-yzvjhscx21
SHA256 148199cc5de196afafd9ce24c7047d3a009d20ceed42a897618dbc0169e3bf0e
MD5 9a90842ca6a94ec81d272b5f6588f074
SHA1 acf39f3a9313b6e7f93c5aa78d056267e2f5c8ed
SHA512 e70878577a028f1742c083fe902c5d09311d284bcfe3359ab5d5138bbc6f28bc459ab282acd57fbc90f5d7777d2aaf4d7b4b63e618578dd35992f9648439309e
SSDEEP 384:WTGgJ5J8PVKGiqmNxvQiOu1M3QZxDjMqhr6:WTGgJwiqQf1MATMqx6
TLSH
T13142EB08FBE096A141D2432CCDA7DA142A3D412F91286A00FAECC1C47F8562DC7FD9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\READ_ME.txt

Ransom Note

YOUR FILES HAVE BEEN PERMANENTLY ENCRYPTED ============================================ All your documents, photos, videos, databases, and other important files on this computer have been irrevocably destroyed using a hybrid military-grade encryption scheme. The unique decryption key has been thrown away. No person, government, or deity can recover your data. Do not waste time searching for a solution. This is not a negotiation.

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateHelper = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\deepseek_powershell_20260523_9b79f3.ps1\""	PowerShell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run	PowerShell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5756	sc.exe
1492	sc.exe
3960	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2636	powershell.exe
1668	PowerShell.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1668	PowerShell.exe
1668	PowerShell.exe
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1668	PowerShell.exe
Token: SeSecurityPrivilege	1668	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1668	PowerShell.exe
Token: SeLoadDriverPrivilege	1668	PowerShell.exe
Token: SeSystemProfilePrivilege	1668	PowerShell.exe
Token: SeSystemtimePrivilege	1668	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1668	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1668	PowerShell.exe
Token: SeCreatePagefilePrivilege	1668	PowerShell.exe
Token: SeBackupPrivilege	1668	PowerShell.exe
Token: SeRestorePrivilege	1668	PowerShell.exe
Token: SeShutdownPrivilege	1668	PowerShell.exe
Token: SeDebugPrivilege	1668	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1668	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1668	PowerShell.exe
Token: SeUndockPrivilege	1668	PowerShell.exe
Token: SeManageVolumePrivilege	1668	PowerShell.exe
Token: 33	1668	PowerShell.exe
Token: 34	1668	PowerShell.exe
Token: 35	1668	PowerShell.exe
Token: 36	1668	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1668	PowerShell.exe
Token: SeSecurityPrivilege	1668	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1668	PowerShell.exe
Token: SeLoadDriverPrivilege	1668	PowerShell.exe
Token: SeSystemProfilePrivilege	1668	PowerShell.exe
Token: SeSystemtimePrivilege	1668	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1668	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1668	PowerShell.exe
Token: SeCreatePagefilePrivilege	1668	PowerShell.exe
Token: SeBackupPrivilege	1668	PowerShell.exe
Token: SeRestorePrivilege	1668	PowerShell.exe
Token: SeShutdownPrivilege	1668	PowerShell.exe
Token: SeDebugPrivilege	1668	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1668	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1668	PowerShell.exe
Token: SeUndockPrivilege	1668	PowerShell.exe
Token: SeManageVolumePrivilege	1668	PowerShell.exe
Token: 33	1668	PowerShell.exe
Token: 34	1668	PowerShell.exe
Token: 35	1668	PowerShell.exe
Token: 36	1668	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1668	PowerShell.exe
Token: SeSecurityPrivilege	1668	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1668	PowerShell.exe
Token: SeLoadDriverPrivilege	1668	PowerShell.exe
Token: SeSystemProfilePrivilege	1668	PowerShell.exe
Token: SeSystemtimePrivilege	1668	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1668	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1668	PowerShell.exe
Token: SeCreatePagefilePrivilege	1668	PowerShell.exe
Token: SeBackupPrivilege	1668	PowerShell.exe
Token: SeRestorePrivilege	1668	PowerShell.exe
Token: SeShutdownPrivilege	1668	PowerShell.exe
Token: SeDebugPrivilege	1668	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1668	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1668	PowerShell.exe
Token: SeUndockPrivilege	1668	PowerShell.exe
Token: SeManageVolumePrivilege	1668	PowerShell.exe
Token: 33	1668	PowerShell.exe
Token: 34	1668	PowerShell.exe
Token: 35	1668	PowerShell.exe
Token: 36	1668	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3960	1668	PowerShell.exe	87
PID 1668 wrote to memory of 1492	1668	PowerShell.exe	88
PID 1668 wrote to memory of 5756	1668	PowerShell.exe	89

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\deepseek_powershell_20260523_9b79f3.ps1
1⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" create WindowsSecurityAssistant binPath= "powershell.exe -ExecutionPolicy Bypass -File "C:\Windows\Temp\deepseek_powershell_20260523_9b79f3.ps1"" start= auto DisplayName= "Windows Security Assistant Service"
  2⤵
  - Launches sc.exe
  PID:3960
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" description WindowsSecurityAssistant "Ensures system integrity and performs security maintenance."
  2⤵
  - Launches sc.exe
  PID:1492
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" start WindowsSecurityAssistant
  2⤵
  - Launches sc.exe
  PID:5756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File C:\Windows\Temp\deepseek_powershell_20260523_9b79f3.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_b2baea00.ip2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b2baea00.ip2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

READ_ME.txt

Path C:\Users\Admin\Documents\READ_ME.txt
Size 434B
SHA256 078ef3b37a9f1cc00b4272217779c38700f3256a70515d3e00558666ca02d73d
MD5 a76b89ecfc35527a6855b757e55373d5
SHA1 80bba1870584f85d20ee9f8cb9a72f56cfbd8e60
SHA512 6c10c0a27059052871a27dad54f9a705fb97c51988a574174c6e0e4a35fd0cdae13cfea639bed6b1d9aed6ff2855c9606af3882b7dac63d5823eda9ef4ae2517
TLSH
T1A8E0F10F9B590411229791C36F143B917B105340711FA50B5D0F9864215FF01C557860
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1668-23-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-10-0x00007FF4D83E0000-0x00007FF4D83F0000-memory.dmp

Download

memory/1668-0-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-17-0x000001FDA40E0000-0x000001FDA40FC000-memory.dmp

Download

memory/1668-19-0x000001FDA4100000-0x000001FDA410A000-memory.dmp

Download

memory/1668-21-0x000001FDA4140000-0x000001FDA4164000-memory.dmp

Download

memory/1668-20-0x000001FDA4140000-0x000001FDA416A000-memory.dmp

Download

memory/1668-18-0x000001FDA41C0000-0x000001FDA4273000-memory.dmp

Download

memory/1668-1-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-22-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-30-0x000001FDA4120000-0x000001FDA413C000-memory.dmp

Download

memory/1668-9-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-7-0x000001FDA1D40000-0x000001FDA1D62000-memory.dmp

Download

memory/1668-46-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-41-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-42-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-43-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/1668-44-0x00007FF4D83E0000-0x00007FF4D83F0000-memory.dmp

Download

memory/1668-45-0x000001FDA1D70000-0x000001FDA1D80000-memory.dmp

Download

memory/2636-32-0x0000014687180000-0x0000014687190000-memory.dmp

Download

memory/2636-33-0x0000014687180000-0x0000014687190000-memory.dmp

Download