da42b7e015cde84d988ddefcea11f76d4c03596f7505b552b1aab62b90335b26

Analysis

max time kernel
898s
max time network
596s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 11:16

Target
malware_1779966796_9288.ps1
Size 5KB
Sample260528-nddc1ae18w
SHA256 da42b7e015cde84d988ddefcea11f76d4c03596f7505b552b1aab62b90335b26
MD5 4855aba3390561c55de68dbaf0690e7e
SHA1 2495434d9a284379719f171edb6cae158249b11f
SHA512 53f385f0a2e87096c7bb019a949a8824ce1f1192e0c9820aa5776e2ba72e17cd3faf4639b62ceab6d5e4e0534b27efb42f8292c1fd0b370592f666b34d660923
SSDEEP 96:toB6zrgW51X7ZM+efXGpxXjSczNVAy6cGb+SRRxNrqCiyVoJF8q/Q2M:twY/51X1MDOpxzrzA7cGyGFirBM
TLSH
T12AC11A3E2B6B864CCCB4353B4C0A042146C0E6A4707297EAF8C75857F2F2059BEDBA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
4920	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	PowerShell.exe
4920	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	PowerShell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

__PSScriptPolicyTest_um2zcs5y.zwl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_um2zcs5y.zwl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH