b6e50ad9c7568b292a8350fc364b6a13bc4162341f70a2ca09be941f4d0ffa51

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 608KB
Sample260529-w4dqfsey7n
SHA256 b6e50ad9c7568b292a8350fc364b6a13bc4162341f70a2ca09be941f4d0ffa51
MD5 8f4a6e3e799375957d12779498ff62de
SHA1 db63b9749369cc6593fb59a99e3ff1d0d0d55412
SHA512 8a56fabe8853e225db42de8001374c818c858afaada2e10109ce703557ff633fe37bf07218e138ad4f1636b3f7721dc4353c4fde7cbf565442a565e5bc43d234
SSDEEP 6144:ThFXR3Gx+HihHQ8ntYrcWHn+CqZxw77oYW6zVHTYWId4W7b5oAIsU7J+ZNJ0sh:ThbG++HSdqUk4li5jWN+Zh
TLSH
T15BD46D747A062EFF5BBC10C248C5C11C563822B5CA682CF56ACB5CA3391D77A27B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1252	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 4332	1252	PowerShell.exe	83

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2284	powershell.exe
1252	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1252	PowerShell.exe
1252	PowerShell.exe
1252	PowerShell.exe
2284	powershell.exe
2284	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1252	PowerShell.exe
Token: SeSecurityPrivilege	1252	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1252	PowerShell.exe
Token: SeLoadDriverPrivilege	1252	PowerShell.exe
Token: SeSystemProfilePrivilege	1252	PowerShell.exe
Token: SeSystemtimePrivilege	1252	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1252	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1252	PowerShell.exe
Token: SeCreatePagefilePrivilege	1252	PowerShell.exe
Token: SeBackupPrivilege	1252	PowerShell.exe
Token: SeRestorePrivilege	1252	PowerShell.exe
Token: SeShutdownPrivilege	1252	PowerShell.exe
Token: SeDebugPrivilege	1252	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1252	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1252	PowerShell.exe
Token: SeUndockPrivilege	1252	PowerShell.exe
Token: SeManageVolumePrivilege	1252	PowerShell.exe
Token: 33	1252	PowerShell.exe
Token: 34	1252	PowerShell.exe
Token: 35	1252	PowerShell.exe
Token: 36	1252	PowerShell.exe
Token: SeDebugPrivilege	3016	whoami.exe
Token: SeIncreaseQuotaPrivilege	1252	PowerShell.exe
Token: SeSecurityPrivilege	1252	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1252	PowerShell.exe
Token: SeLoadDriverPrivilege	1252	PowerShell.exe
Token: SeSystemProfilePrivilege	1252	PowerShell.exe
Token: SeSystemtimePrivilege	1252	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1252	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1252	PowerShell.exe
Token: SeCreatePagefilePrivilege	1252	PowerShell.exe
Token: SeBackupPrivilege	1252	PowerShell.exe
Token: SeRestorePrivilege	1252	PowerShell.exe
Token: SeShutdownPrivilege	1252	PowerShell.exe
Token: SeDebugPrivilege	1252	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1252	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1252	PowerShell.exe
Token: SeUndockPrivilege	1252	PowerShell.exe
Token: SeManageVolumePrivilege	1252	PowerShell.exe
Token: 33	1252	PowerShell.exe
Token: 34	1252	PowerShell.exe
Token: 35	1252	PowerShell.exe
Token: 36	1252	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1252	PowerShell.exe
Token: SeSecurityPrivilege	1252	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1252	PowerShell.exe
Token: SeLoadDriverPrivilege	1252	PowerShell.exe
Token: SeSystemProfilePrivilege	1252	PowerShell.exe
Token: SeSystemtimePrivilege	1252	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1252	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1252	PowerShell.exe
Token: SeCreatePagefilePrivilege	1252	PowerShell.exe
Token: SeBackupPrivilege	1252	PowerShell.exe
Token: SeRestorePrivilege	1252	PowerShell.exe
Token: SeShutdownPrivilege	1252	PowerShell.exe
Token: SeDebugPrivilege	1252	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1252	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1252	PowerShell.exe
Token: SeUndockPrivilege	1252	PowerShell.exe
Token: SeManageVolumePrivilege	1252	PowerShell.exe
Token: 33	1252	PowerShell.exe
Token: 34	1252	PowerShell.exe
Token: 35	1252	PowerShell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3016	1252	PowerShell.exe	82
PID 1252 wrote to memory of 4332	1252	PowerShell.exe	83
PID 1252 wrote to memory of 4332	1252	PowerShell.exe	83
PID 1252 wrote to memory of 4332	1252	PowerShell.exe	83
PID 1252 wrote to memory of 4332	1252	PowerShell.exe	83
PID 1252 wrote to memory of 4332	1252	PowerShell.exe	83
PID 1292 wrote to memory of 2284	1292	conhost.exe	87
PID 2284 wrote to memory of 984	2284	powershell.exe	88
PID 984 wrote to memory of 4948	984	csc.exe	89

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2384

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -ep bypass -file "C:\ProgramData\onedrive-sync.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ep bypass -file C:\ProgramData\onedrive-sync.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vz33jaej\vz33jaej.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES811D.tmp" "c:\Users\Admin\AppData\Local\Temp\vz33jaej\CSC8F2093FB921F418A84A3F79B1FE01E2E.TMP"
      4⤵
      PID:4948

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless powershell -ep bypass -file "C:\ProgramData\onedrive-sync.ps1"
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

onedrive-sync.ps1

Path C:\ProgramData\onedrive-sync.ps1
Size 314KB
SHA256 5567d947046926a2f24dac0d5fd38e36ec736f9e0e6c9b60bc0c1ae0a4778d80
MD5 6be678ee8b701bc52988af3f8192a2b3
SHA1 e01979ceaae1854f1078d3c3a088d33b5dc119bc
SHA512 56c46a5077af0153acf6b0f8589c9a6371975c30b08e7d62da74a3b35773aab45ff22d40f8de05e2e0ffb1c579c4c154564ecd4173a401c48c9d5be6b5155b74
SSDEEP 6144:ac4Q7k9HUd9vMGXaZA+IVGrYrXrbcvbZ7uuxROL4JNC:luHmlKZBIM0rXrgjcYR4
TLSH
T11E646D2479422EFB57B820C248CA851C563836B9C9692DF17ACF0CA23F0D77527B79B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 cbfafb0c7e4b8223b7160d7f6012d970f5ecce110e8922635040ff577b1fd825
MD5 8c6e87ee7e70713231943cef0ccbf0b9
SHA1 9a91c6056ad1e6afe7a9d516a7b2f22f498c9057
SHA512 98cbd1e23d9f781a07210d41e4c9d404ba56addbea259a414c4ec663ef79f4a3634eeeb51055d844e485acdd50e3757cf24d7864e7de7d0ed25abe24bfa3817d
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnm7RIz+7qgRiNLWPiNyDxBPzF4h0nRf:iq4uYqGEUdncqKXq3qotzYuWqcIz+7qM
TLSH
T1A491D0323375E0D4CD567F07192C19C463AF4386EA58AF4CB658620EE92B14BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9fffb1ceace17c29124965102e6d17c54ff21d1b4c82096cbcc4e550ac6e80b8
MD5 9a91da9467b94bd9b06a45675eef96f6
SHA1 1fcaa66defa69a5b6b1284e1725a23e7b78ee403
SHA512 750c55b6da39a27f27cd226d4d5cd7ebf8a2068bc5f0559eac318b4a29ba789b1363619935bedc992f2f91eccfb0fe999c0ee9697222f49e93d7a640e9fb5ad2
TLSH
T1F741AC33B39CC1E5C89921BADCDC6C01B665C3D3809F8FCB2A80C114E57F699DAA84A4
MD5 SHA1 SHA512 TLSH

Submit Download

RES811D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES811D.tmp
Size 1KB
SHA256 518ca20e1e9defd8252273b16b7787751f139c40597e353f79f8aa3c1a381f82
MD5 d48b08d95af37e2c4cdf586cc9615d15
SHA1 cdee7f8335a87ea3c90f960e5af98b71a48a7768
SHA512 c33048a5892bba9cf544357fd3e4a0805a9a83a4a794dea959466e6a992ed5ea8c29a7b66de0cad56358d58a5b941fb7ec66cc4a1647a34208693a2dadb13e38
TLSH
T18C217B0597E8471FF0735731A9FA072BA638FEA5EFA2575B844042282C51604EEB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jfex2fco.13r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jfex2fco.13r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vz33jaej.dll

Path C:\Users\Admin\AppData\Local\Temp\vz33jaej\vz33jaej.dll
Size 3KB
SHA256 2a7dd814cc14174e12436b0e860ebf605bee120fdafb5b3c5dd393ed858b382c
MD5 4d07d152567efff8c71e9c4599180602
SHA1 84e81b47ba97b6d09c933069cc81c788c21949da
SHA512 b4dea3bb0952bcfba0f83ecd4a3289251041f14d3d577ddc4db10d580f7686ed318b9d504fa7e274df1d3e5786940ac02b23d707c039975086264fa44dadb9d6
TLSH
T133713006E7E44BA6E0B70338A9F343515378F8609F379B5F19846368BC657242A72BF0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8F2093FB921F418A84A3F79B1FE01E2E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vz33jaej\CSC8F2093FB921F418A84A3F79B1FE01E2E.TMP
Size 652B
SHA256 75500f2dc49269ffe683c77a52b04a6574ffd7abe8eb43ca413d59d3f457f1fd
MD5 0f47ad05dd8669ff9694af5a0482ca2a
SHA1 e4af0c255608e255748f00c9e80e63e6e2ec087a
SHA512 e330901cf9fbc8b3016e9f0259fb7b49529ee64d01d8325bd402b309dd80cea22dcdc3d6eedd8a4674ec7c556347d7707f5f9ab3b4c30a73d900b46498b0d9e1
TLSH
T1C0F05E09A3F8020EF4F34B30BDF6436395A8BC65DF7297ED5840431D28646108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vz33jaej.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vz33jaej\vz33jaej.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

vz33jaej.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vz33jaej\vz33jaej.cmdline
Size 369B
SHA256 f98936661560e957b2966a1e223bbe111e482ddc48eabd513228471a20b851c2
MD5 33253639dc2417576163ccb4b5ad24d6
SHA1 e44d79f13a82e9a7935e94992cc1e4ccf917bc14
SHA512 7a2e0bf379a06ddf0273fbee1a39a9ff3ea1a1cb57c902dc99c9e21c9726e48ac07ee06a6ebfc445aa0403d80ee15e780f94c35c8489d5038db3ee89d085a731
TLSH
T1ABE0263AD25EC7BF25ED300F226EC9ACCAB207872A817F84D150845DE0270046BE27DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1252-12-0x00007FF468740000-0x00007FF468750000-memory.dmp

Download

memory/1252-29-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-22-0x000001F9E9A50000-0x000001F9E9A7A000-memory.dmp

Download

memory/1252-23-0x000001F9E9A50000-0x000001F9E9A74000-memory.dmp

Download

memory/1252-24-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-25-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-0-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-27-0x000001F9EA1C0000-0x000001F9EA382000-memory.dmp

Download

memory/1252-30-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-21-0x000001F9E9570000-0x000001F9E957A000-memory.dmp

Download

memory/1252-38-0x000001F9E9910000-0x000001F9E992C000-memory.dmp

Download

memory/1252-20-0x000001F9E9990000-0x000001F9E9A43000-memory.dmp

Download

memory/1252-19-0x000001F9E9550000-0x000001F9E956C000-memory.dmp

Download

memory/1252-1-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-11-0x000001F9E9940000-0x000001F9E9990000-memory.dmp

Download

memory/1252-10-0x000001F9E9530000-0x000001F9E9542000-memory.dmp

Download

memory/1252-9-0x000001F9CD740000-0x000001F9CD750000-memory.dmp

Download

memory/1252-2-0x000001F9E9480000-0x000001F9E94A2000-memory.dmp

Download

memory/2284-74-0x000002CD2D080000-0x000002CD2D088000-memory.dmp

Download

memory/4332-26-0x0000000140000000-0x0000000140004000-memory.dmp

Download