a1414a80c216451c9a5c0e6aa35ba5319dead9643455abfa45c47d129e40483c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
message.ps1
Size 5KB
Sample260620-3aav2aas9j
SHA256 a1414a80c216451c9a5c0e6aa35ba5319dead9643455abfa45c47d129e40483c
MD5 3eacbe1f2810841881a40b8389f889f8
SHA1 0018d3ed9489d81a4da8448c10dd10fa11fccf2d
SHA512 d81dbb9fd1f21691996bb238ff152eca041ee8a2b8c81fe65afb8e5977bd2a92ca39b325c7f901f6f26cf7e6b9e020d3ae9b685c5755b1b7da7d3bd54f76b405
SSDEEP 96:eSIOuC+YZdF3KhX7PSoVSSSwKSSjn0qFBTfLYlieQIRGe1kE5CraG/83:eSIOuCY+oczwKzj0yBbLYlx7RGEko3
TLSH
T1B1C18629A904422E12B333BE4C569808FBDF416FC3516E54766CB0A46FB505EC7B4EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6388	PowerShell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6588	sc.exe
1836	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6388	PowerShell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4392	PING.EXE
2420	cmd.exe
2144	PING.EXE
6016	cmd.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5552	reg.exe
5464	reg.exe
3716	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2144	PING.EXE
4392	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6388	PowerShell.exe
6388	PowerShell.exe
2084	powershell.exe
2084	powershell.exe
2260	powershell.exe
2260	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6388	PowerShell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 6388 wrote to memory of 4632	6388	PowerShell.exe	90
PID 6388 wrote to memory of 2728	6388	PowerShell.exe	91
PID 2728 wrote to memory of 6588	2728	cmd.exe	93
PID 2728 wrote to memory of 7052	2728	cmd.exe	94
PID 2728 wrote to memory of 760	2728	cmd.exe	95
PID 2728 wrote to memory of 3480	2728	cmd.exe	96
PID 2728 wrote to memory of 6436	2728	cmd.exe	97
PID 2728 wrote to memory of 6340	2728	cmd.exe	98
PID 2728 wrote to memory of 4688	2728	cmd.exe	99
PID 2728 wrote to memory of 4972	2728	cmd.exe	100
PID 2728 wrote to memory of 7000	2728	cmd.exe	101
PID 2728 wrote to memory of 6784	2728	cmd.exe	102
PID 2728 wrote to memory of 4912	2728	cmd.exe	103
PID 4912 wrote to memory of 424	4912	cmd.exe	104
PID 4912 wrote to memory of 3720	4912	cmd.exe	105
PID 2728 wrote to memory of 7012	2728	cmd.exe	106
PID 2728 wrote to memory of 5392	2728	cmd.exe	107
PID 2728 wrote to memory of 6716	2728	cmd.exe	108
PID 2728 wrote to memory of 1924	2728	cmd.exe	109
PID 1924 wrote to memory of 2084	1924	cmd.exe	110
PID 2728 wrote to memory of 6752	2728	cmd.exe	111
PID 6752 wrote to memory of 2552	6752	cmd.exe	112
PID 2728 wrote to memory of 5464	2728	cmd.exe	113
PID 2728 wrote to memory of 6764	2728	cmd.exe	114
PID 2728 wrote to memory of 3716	2728	cmd.exe	115
PID 2728 wrote to memory of 5720	2728	cmd.exe	116
PID 2728 wrote to memory of 5552	2728	cmd.exe	117
PID 5720 wrote to memory of 1836	5720	cmd.exe	120
PID 5720 wrote to memory of 6128	5720	cmd.exe	121
PID 5720 wrote to memory of 1344	5720	cmd.exe	122
PID 5720 wrote to memory of 1608	5720	cmd.exe	123
PID 5720 wrote to memory of 7164	5720	cmd.exe	124
PID 5720 wrote to memory of 5932	5720	cmd.exe	125
PID 5720 wrote to memory of 4212	5720	cmd.exe	126
PID 5720 wrote to memory of 2316	5720	cmd.exe	127
PID 5720 wrote to memory of 3608	5720	cmd.exe	128
PID 5720 wrote to memory of 1940	5720	cmd.exe	129
PID 5720 wrote to memory of 5620	5720	cmd.exe	130
PID 5620 wrote to memory of 6748	5620	cmd.exe	131
PID 5620 wrote to memory of 5172	5620	cmd.exe	132
PID 5720 wrote to memory of 2504	5720	cmd.exe	133
PID 5720 wrote to memory of 7120	5720	cmd.exe	134
PID 5720 wrote to memory of 4044	5720	cmd.exe	135
PID 5720 wrote to memory of 2156	5720	cmd.exe	136
PID 2156 wrote to memory of 2260	2156	cmd.exe	137
PID 5720 wrote to memory of 4220	5720	cmd.exe	138
PID 4220 wrote to memory of 6836	4220	cmd.exe	139
PID 5720 wrote to memory of 2420	5720	cmd.exe	140
PID 2420 wrote to memory of 2144	2420	cmd.exe	141
PID 5720 wrote to memory of 6016	5720	cmd.exe	142
PID 6016 wrote to memory of 4392	6016	cmd.exe	143
PID 5720 wrote to memory of 4680	5720	cmd.exe	144

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\message.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6388
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
  2⤵
  PID:4632
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd" -el "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:6588
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:7052
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd"
    3⤵
    PID:760
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-el" "
    3⤵
    PID:3480
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:6436
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    PID:6340
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4688
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4972
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:7000
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:6784
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:424
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:3720
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd" "
    3⤵
    PID:7012
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:5392
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:6716
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6752
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:2552
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:5464
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:6764
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3716
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd" -el -qedit"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:1836
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:6128
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd"
      4⤵
      PID:1344
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:1608
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:7164
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      PID:5932
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:4212
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:2316
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:3608
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:1940
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:6748
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:5172
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd" "
      4⤵
      PID:2504
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:7120
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:4044
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:6836
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2144
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck39.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:6016
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck39.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4392
  - - C:\Windows\System32\choice.exe
      choice /C:10 /N
      4⤵
      PID:4680
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 0989be8b16552ed61c3b22fa0e58713680c4c6d4e6dd8c5792398b953440d596
MD5 bf5c406537eee81450c2ebcc45cb7dcc
SHA1 3273c2a3744bfa85aa6cd46012d1be9c85e69a52
SHA512 0173c86b081df883f9dcd32df4e4a9293266613912018a6a45910ac5d0663a793dd7b4794374c7171b6f06dc8d018da0b37d3664f770297a0d0cf01aac3c673a
TLSH
T125114433F3CC8624DC59403650CEA91136B687CB409ECE6B7B84D154A42F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kwvyod0n.lhr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kwvyod0n.lhr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd

Path C:\Windows\Temp\MAS_6762699b-5bd6-4811-82e9-cafbdabede30.cmd
Size 741KB
SHA256 bd4aefd29073ddec143d53b79a8c2dee0b80463cafba9aeede136b63727348ed
MD5 01edf489051d0b1792531f200164947a
SHA1 49d2e59ca219b82e5a569c85b0e9906a3e098192
SHA512 c4ef6c409ca636f7c9562c48a0c6665a76b497d8ae62477195bb864c9e1ecdad295c4ac352e55850c543eddeead88c122ecd84dcf7c26a1ed92dde787f5842aa
SSDEEP 6144:RPI3+2yX52UBcEvTGmaiE8pLnc/x4Wi0yklBpuP:RPI3ODcEvTGXiE8c5ri0yklB8
TLSH
T107F419466D0251A601B3F379DE63814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6388-7-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-14-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-0-0x00007FFA441EF000-0x00007FFA441F0000-memory.dmp

Download

memory/6388-8-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-9-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-10-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-11-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-12-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-13-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-6-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-15-0x000001A9A0120000-0x000001A9A02E2000-memory.dmp

Download

memory/6388-17-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-5-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-19-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-20-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-4-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-3-0x000001A99FB50000-0x000001A99FB72000-memory.dmp

Download

memory/6388-28-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-30-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download

memory/6388-31-0x00007FFA44060000-0x00007FFA44A04000-memory.dmp

Download