e28ddb8025857760a6770c03dc41e3bbf136af45e5fb447944e22ae2742bdeb5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 11:16

Target
driver_framework_3734.ps1
Size 6KB
Sample260529-ndmxfaat3x
SHA256 e28ddb8025857760a6770c03dc41e3bbf136af45e5fb447944e22ae2742bdeb5
MD5 7d391a2e10f6edfbe8d9a92175d6023e
SHA1 54e8909d6840f0f7574a61772a70e1a1d9e08da9
SHA512 0037347e228750de68f9147341e3276f4b0f200f7c206488fdd00f1278602445922872e59237bbcde9cf783f52a8f98cc155540ecb3b59cc4ab4cf502dae7b0e
SSDEEP 192:/jLq6F18ae0AFeayMfD5wsdTT0woeoimHN4P2x60xOI00oz4/LK:/jL78aoFrfD+sdTAwRo5HN4Pg9O10oG2
TLSH
T1BCD12A3B71F2EB47F495410D498A8EDBCE01D8B5173928DCA481B62EC8D6573B1CE0B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
4504	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	PowerShell.exe
4504	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	PowerShell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

__PSScriptPolicyTest_1fehcf5z.glb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fehcf5z.glb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH