b6e50ad9c7568b292a8350fc364b6a13bc4162341f70a2ca09be941f4d0ffa51

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 608KB
Sample260529-w4dqfsey7n
SHA256 b6e50ad9c7568b292a8350fc364b6a13bc4162341f70a2ca09be941f4d0ffa51
MD5 8f4a6e3e799375957d12779498ff62de
SHA1 db63b9749369cc6593fb59a99e3ff1d0d0d55412
SHA512 8a56fabe8853e225db42de8001374c818c858afaada2e10109ce703557ff633fe37bf07218e138ad4f1636b3f7721dc4353c4fde7cbf565442a565e5bc43d234
SSDEEP 6144:ThFXR3Gx+HihHQ8ntYrcWHn+CqZxw77oYW6zVHTYWId4W7b5oAIsU7J+ZNJ0sh:ThbG++HSdqUk4li5jWN+Zh
TLSH
T15BD46D747A062EFF5BBC10C248C5C11C563822B5CA682CF56ACB5CA3391D77A27B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3968	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3968 set thread context of 2068	3968	powershell.exe	93

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3968	powershell.exe
3704	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3704	powershell.exe
3704	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeDebugPrivilege	3748	whoami.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3748	3968	powershell.exe	89
PID 3968 wrote to memory of 2068	3968	powershell.exe	93
PID 3968 wrote to memory of 2068	3968	powershell.exe	93
PID 3968 wrote to memory of 2068	3968	powershell.exe	93
PID 3968 wrote to memory of 2068	3968	powershell.exe	93
PID 3968 wrote to memory of 2068	3968	powershell.exe	93
PID 4376 wrote to memory of 3704	4376	conhost.exe	112
PID 3704 wrote to memory of 3840	3704	powershell.exe	113
PID 3840 wrote to memory of 2992	3840	csc.exe	114

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2264

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -ep bypass -file "C:\ProgramData\onedrive-sync.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ep bypass -file C:\ProgramData\onedrive-sync.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dovoujpr\dovoujpr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B48.tmp" "c:\Users\Admin\AppData\Local\Temp\dovoujpr\CSC249560A5B594D028C94644DEFA44C78.TMP"
      4⤵
      PID:2992

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless powershell -ep bypass -file "C:\ProgramData\onedrive-sync.ps1"
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

onedrive-sync.ps1

Path C:\ProgramData\onedrive-sync.ps1
Size 319KB
SHA256 b6da456233a21ebba4068e054c8e766650bf6fc3b1abd13f537763d38a9395e0
MD5 4460831b1d316e082efe39d9d19fdea7
SHA1 979c4fceec822a290f12d5e7e84e848b0e8130f9
SHA512 99d2081cd652afc6769ce745d3fe443ae2ef869258123d680c052316c79529bf3a5ee0d6196d8cbc418b2ba9f8d79e3940f8934a2847fa54deb0eeb17d99c8c5
SSDEEP 6144:Qy0iXI1V+muB8+hG9KSxItFocJMlUqmtdrogU3:N0iY+jSIVelKwB3
TLSH
T1EC645D347A462EFF5BA8208244CA811C563C3274CA682CF57ACF1CA63B1D77627B7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 c2d84ba748f1c8f3d42475446b47756279eceacd1f09a210c1452fe74d0c9803
MD5 ff7c608d82806c129c7b04989952adb3
SHA1 d7e0b101311cf68272d86a5c3cc2983cfb7fbd43
SHA512 0101cc5ec765405c55beba88fcb5d8ac74caba96e98455ec56d7046883783ebd666b1a6787a698f6bf98fd8855ca92c87ff61db044bfa7a879cac51e2584f2ce
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZ7qgRiNLWPfsNySxBPFe:iqdYqGAjdx4qKkq3qktznEuZq6XIzo7n
TLSH
T1F991EE313375B0D4CC567F072A2819D463AF4386EA98AF4CB25C621EDE2651BDB221F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a0f6a73bbc94c44b15970a73c2244590d1fd70903159df6c8506183f670bc84d
MD5 f1e2c55653fab746ebc0fd1eec295fce
SHA1 be80f0fb769f70475739699be576fad7de41b7a7
SHA512 5c7cb61682a873e9f87bd28154c858da69b4ecb019678374b007528a5644128ad6b0a3218c45cee540c86bcaf79c2ed5dc342ee90fe6cfaedb53df1a8aac5a4d
TLSH
T1A341B727B39C85E0D8C9257ADCEC5C117A7693D3C09F8FCB6AC0D614E1AF698CA68050
MD5 SHA1 SHA512 TLSH

Submit Download

RES4B48.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B48.tmp
Size 1KB
SHA256 6d443546f4987efbe01331d645c61285f03a783bc51f35429db0c5d2adb65f1c
MD5 08cdf9be6cfe24e49635f910cdbb78e3
SHA1 1e9230a2a5d2e6f92f6c92fd3d5c95a3174aa210
SHA512 67228d7ed56ed72001307cd23f302adfc8b78cebcfd83e7aaee707caec611b74ca225acb56f95b98b3464f3f7d1f4085b4cfe56c00c1f249af55ff72bfb147ea
TLSH
T1B6217B0553F8471BF0B75B3169FA172BA279FD65EF66536B948042282C51204DEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lwz1i3p2.bkf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwz1i3p2.bkf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dovoujpr.dll

Path C:\Users\Admin\AppData\Local\Temp\dovoujpr\dovoujpr.dll
Size 3KB
SHA256 8f60ba49cf32a7130f9d7cb9b397ae8c6e357af0b740b30daca1b51db41b1ecc
MD5 18a7556d3e89786dba6ac9adbcb53e4b
SHA1 1d0acbea392ad2685017c9e269b4984bef606068
SHA512 0edf49cd2eaf4562f2ac412cedc82948e9d10f4306885f05c379847911c0c200fc0ff765ac25ad8571556b9de40e3ef57ee1c3ff294335d884569c7d526ee97e
TLSH
T1E5716106A7F44AA2F0B74338A9F303115378F8609F37575E18C46368BC667246E72BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC249560A5B594D028C94644DEFA44C78.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dovoujpr\CSC249560A5B594D028C94644DEFA44C78.TMP
Size 652B
SHA256 8a40581cece5c7b68bc57d434b4f63098ab7ae05f83c534ced206478a37a234b
MD5 b61d3e0e16ea0e336dec92fa60489124
SHA1 203dda37b3dc0f28998b84032f873633671da716
SHA512 b253e5aa76c3505e0dafb556af8f1237a3e5cf95d23c4564d81713430ed58132738fecde65da449eb42bae151a8ddafeef45a119bc733d718546b9b1552ea124
TLSH
T1FFF05E0963F8020EF0F38B30BEF6436791B9BC65DE3293ED244043592C746108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dovoujpr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dovoujpr\dovoujpr.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

dovoujpr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dovoujpr\dovoujpr.cmdline
Size 369B
SHA256 9a6db49e7377c2213a3c2c4ebd6cbabf830eab7acdfe34c2153759e1dfc229ba
MD5 c74d0ed17d653816bc008f421b821a92
SHA1 1cc74a756a937190584570176eb0a6eb331b0c4c
SHA512 73f4e0b4775e9111100d4f68322fa9af42abb73e58ae1fb7aaccddc2b7b726578ca094d581f2bef92c1fdef390b55068b441d89702481fa6d4cb925d3502271b
TLSH
T1FEE0683A4366C2BE89D9100729AAC8EC8372074329823F845844446DF2370002FE1F61
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2068-28-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/3704-81-0x000001C4A0860000-0x000001C4A0868000-memory.dmp

Download

memory/3968-21-0x000002071CD40000-0x000002071CD5C000-memory.dmp

Download

memory/3968-44-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-26-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-27-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-24-0x000002071D200000-0x000002071D22A000-memory.dmp

Download

memory/3968-29-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-30-0x000002071D7E0000-0x000002071D9A2000-memory.dmp

Download

memory/3968-31-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-32-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-33-0x00007FF471030000-0x00007FF471040000-memory.dmp

Download

memory/3968-43-0x000002071D1F0000-0x000002071D20C000-memory.dmp

Download

memory/3968-25-0x000002071D200000-0x000002071D224000-memory.dmp

Download

memory/3968-23-0x000002071CD30000-0x000002071CD3A000-memory.dmp

Download

memory/3968-22-0x000002071D110000-0x000002071D1C5000-memory.dmp

Download

memory/3968-0-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-13-0x00007FF471030000-0x00007FF471040000-memory.dmp

Download

memory/3968-12-0x000002071D0C0000-0x000002071D110000-memory.dmp

Download

memory/3968-11-0x000002071CD00000-0x000002071CD12000-memory.dmp

Download

memory/3968-10-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download

memory/3968-2-0x000002071C7E0000-0x000002071C802000-memory.dmp

Download

memory/3968-1-0x000002071BE70000-0x000002071BE80000-memory.dmp

Download