b9702ecf2928354dfc32e25468848408de40b82d237f83953fdc6d6d655050ef

Analysis

max time kernel
146s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.ps1
Size 2KB
Sample260529-pgvbcscs8l
SHA256 b9702ecf2928354dfc32e25468848408de40b82d237f83953fdc6d6d655050ef
MD5 ddb2d878d67754249ca5f5bb0b423f1a
SHA1 4b25b9d5919a3077375e67245681af5ea1d96cef
SHA512 f1099369f015cf12bc0976e343866416be935780702cfd368dd96ceb4d4570903c2fefb0008eeef6f4f183049ffc4fcccee7521dc61c4256c3920a60cec14b1d
TLSH
T1165175138371123191E1130245CFB144625581BF8A4E1E2975AE9200BFA663CEBF33FB
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4728	PowerShell.exe
3	4728	PowerShell.exe
5	4728	PowerShell.exe
6	4728	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
4152	claude-2.1.156-win32-x64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
10	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4728	PowerShell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1696	reg.exe
2112	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	PowerShell.exe
4728	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4152	4728	PowerShell.exe	84
PID 4152 wrote to memory of 1696	4152	claude-2.1.156-win32-x64.exe	85
PID 4152 wrote to memory of 2112	4152	claude-2.1.156-win32-x64.exe	86
PID 4152 wrote to memory of 1784	4152	claude-2.1.156-win32-x64.exe	87
PID 4152 wrote to memory of 4280	4152	claude-2.1.156-win32-x64.exe	89

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\.claude\downloads\claude-2.1.156-win32-x64.exe
  "C:\Users\Admin\.claude\downloads\claude-2.1.156-win32-x64.exe" install latest
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:1696
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:2112
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe git
    3⤵
    PID:1784
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe npm
    3⤵
    PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.claude.json

Path C:\Users\Admin\.claude.json
Size 50B
SHA256 63c18b7ffbbdfa2428e1a2e31071f17667f8c415f641d2bff11525b69daecf1e
MD5 613ca24dcd5ba82921919a9de7080224
SHA1 18f45f5a139bd3bbb71e2de35b33775c25398d1a
SHA512 d75a0ee5a65d1f1a0949125fdc54b173c6d55dbe483911eb6181356e43506521179483e7c82ed4d91f7202d2f66e58ee69508c2208c224007cee08e070ff164d
TLSH
T1749002449172348764800050AA288AA84F14654108825145120AC70C0490AB11A4F8B0
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 86B
SHA256 078e5e70b3a6988bbc9521f71bca014f05187cd4c13aa74d748ea05dccbcbeab
MD5 b7c4b308452971a69fa0dd1583e8db69
SHA1 50051e51c9a2f14d535473c7cdd95e6d6b5c37d1
SHA512 8b66612ca0018165be43d9f8b017d40c362885504dccac4ca6ae345a7a856ed880acf6de99e55209ba17a31e68dbc5dcc7e116c0fedbf040e4aae9b159b465f2
TLSH
T1FCA012405332605311D10042F71D85280E346E4104421004434B831D0044EB2260F474
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 299B
SHA256 96bb15213ae67e50f5bbcd44f933c901c693ba4a0b359d1b00495d0795f373f9
MD5 74f55774eab9c956303736c1aea02dd9
SHA1 6af02fedf40c53634a678cd9ac80a82ae6260f15
SHA512 65705dc2b4ba2ad46c2956c8c71bc95c63a7abaf43338bbf7ef52e6e6317c8ecd19e7a774d461e7385563ff94772c626d3dd4c45c83adc566f6e8c186de50a28
TLSH
T1CEE02758A236545713E15357FF5D64450978AF950541344417CF4E14001C7A3333FEB5
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 125B
SHA256 3398ee9fa8ba73f14e9e850d9e0e658cc761fb58742fe4a952011acf609b9525
MD5 df2a5b071ef45d6676591deceb402474
SHA1 7fe3809ab674e3ea890c75abeceb045ad4f86441
SHA512 3742985711a50c24a2ef974b7d7ad8028e440a6e5aeb3aebf88925c46b6992f9c5a37a934506933eaf232008749d577217c42382901d2a087838bae0a53e18f6
TLSH
T14CB092806333A46712E64247EB5E95690E74AE990A862868428B871D0058FF3371F4F8
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 152B
SHA256 54bd4777a7092420186130ab77de9dcf4b0b7c5c0b046c5380e5031418af983e
MD5 8079cce757bc3612f480dfad80477360
SHA1 7546ca8b4838992c570094dd742c3863b464ddfa
SHA512 8036f75cd1789611e066b72a55574ea7e1c246806937a7d5edb51aeec52120c4d05d50aed5c6fda6ef5a2c889c6736fcf48f32d9ec7522bd163cf6a3dc1269e4
TLSH
T1F1C08C802332A0A312E60107EF5E80540D70ED590A822418038B87180008FB3331F4E4
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 393B
SHA256 2625d28eeab23c30f77641d49318d60d90687b0c2c9b8dcbf61904a131a3c88d
MD5 afba6345e5b24348cbde1499c68fd775
SHA1 3b0900434e55fc91a1ebd57013c2cf907e8c22e2
SHA512 2ad36252b4983c2cd151a31bb954d18ccd7babddb138bf1144fe9eaaed5c7f0818d1cabc46899828a94fa77e9904a9de0f570a17a3b735c571ab309197dd35ec
TLSH
T102E0F1545326903B12E4036BAF6D68420134DE51004234000BDF4A14000EF73233FAF6
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 258B
SHA256 e2a6784133c39994075ed23f7f31c8549070e7dc1128e4b82949fbf9caa76bdd
MD5 5b51373af198614567a4609e2f1dc910
SHA1 81d949df90178e4be33ebe0b9ddff354c3433223
SHA512 a56d32de7db4c1f252181c5efca94336cdd5b4181a04505735439e2a50415d8676183d1b99fd04bc416a29e020e73c286d08b4dbbcdce8685b17d2cfe00e2e8a
TLSH
T135D0A784533AA0A713E5139BFF5DB4451974EE590A8229481BCF8A18402CBF7373B6B9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\.claude\settings.json
Size 37B
SHA256 c0eb33614d13cccdc2db798e2a73c82af9e6f291d8261c6b711b620a8d18648d
MD5 a303e4a792338ba1128c5d9e22677aed
SHA1 df4ade37e2674a7fb00abf44cec28295a8672968
SHA512 161773fbbdf4f8468e06dd012253b84e89832380fd6a069c0358135ce4111dfe8f7c883aa667fb7a9d972b4bab871dd2d36b38bff71af2aa8b98a03bd3b4f408
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vrkfcfrc.mzz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrkfcfrc.mzz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4728-9-0x0000028F26620000-0x0000028F26630000-memory.dmp

Download

memory/4728-15-0x0000028F2A160000-0x0000028F2A688000-memory.dmp

Download

memory/4728-14-0x0000028F29A60000-0x0000028F29C22000-memory.dmp

Download

memory/4728-12-0x0000028F26620000-0x0000028F26630000-memory.dmp

Download

memory/4728-11-0x0000028F26620000-0x0000028F26630000-memory.dmp

Download

memory/4728-10-0x0000028F26620000-0x0000028F26630000-memory.dmp

Download

memory/4728-0-0x0000028F26620000-0x0000028F26630000-memory.dmp

Download

memory/4728-7-0x0000028F265A0000-0x0000028F265C2000-memory.dmp

Download

memory/4728-1-0x0000028F26620000-0x0000028F26630000-memory.dmp

Download