8641f7f1359a6d1e59991d8d2ba89fa56bb721176d54d81bb3d6bd41eba5eb13

Analysis

max time kernel
12s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
run.ps1
Size 10KB
Sample260620-l6dhcsfv51
SHA256 8641f7f1359a6d1e59991d8d2ba89fa56bb721176d54d81bb3d6bd41eba5eb13
MD5 49d3921d1d5fa81e41fe21aeb9d95161
SHA1 2f587eb6917415c89024d0ae140472d9bf3becae
SHA512 5afa220154e8ff572619d74cdba09e260f9e1e98a62525319892c922b31b107ea7051e561e022c2999ab2bf19b3b1fad2756693dcee5e6d8ef7b703563c79031
SSDEEP 192:rK0q414EESWVmrmgfNE9tYvHI4Ub9+h9WQploXrbEWnBK7X14mZXRwZebQfECas:rK0mSWVmKgxJ49+o0FN1bQis
TLSH
T11422D701325511DDA5736B36E6D763AAFE67407F40670A0034ACC2807FB2A2DDB7DD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "powershell.exe -NoProfile -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\run.ps1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "powershell.exe -NoProfile -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\run.ps1\""	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\SAM	powershell.exe
File opened for modification	C:\Windows\System32\config\SECURITY	powershell.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	powershell.exe
File opened for modification	C:\Windows\System32\config\SYSTEM	powershell.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4928	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4852	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe
Token: SeRemoteShutdownPrivilege	4928	powershell.exe
Token: SeUndockPrivilege	4928	powershell.exe
Token: SeManageVolumePrivilege	4928	powershell.exe
Token: 33	4928	powershell.exe
Token: 34	4928	powershell.exe
Token: 35	4928	powershell.exe
Token: 36	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe
Token: SeRemoteShutdownPrivilege	4928	powershell.exe
Token: SeUndockPrivilege	4928	powershell.exe
Token: SeManageVolumePrivilege	4928	powershell.exe
Token: 33	4928	powershell.exe
Token: 34	4928	powershell.exe
Token: 35	4928	powershell.exe
Token: 36	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe
Token: SeRemoteShutdownPrivilege	4928	powershell.exe
Token: SeUndockPrivilege	4928	powershell.exe
Token: SeManageVolumePrivilege	4928	powershell.exe
Token: 33	4928	powershell.exe
Token: 34	4928	powershell.exe
Token: 35	4928	powershell.exe
Token: 36	4928	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4852	4928	powershell.exe	97
PID 4928 wrote to memory of 4748	4928	powershell.exe	103
PID 4748 wrote to memory of 2228	4748	csc.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\vssadmin.exe
  "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ken422ts\ken422ts.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES728B.tmp" "c:\Users\Admin\AppData\Local\Temp\ken422ts\CSC27AFF299155B40E69CB9CF622191E9DF.TMP"
    3⤵
    PID:2228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

RES728B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES728B.tmp
Size 1KB
SHA256 3bb263798c11e3bafc9aa22c0e0e85e44b139c749c6508e82a63d4a1dcf7ed90
MD5 c9daca44bd54f2a39665db5fa4d4cbad
SHA1 85f9ad7fda48510323f9bab982c28b758d0f204d
SHA512 e8d3daab1113f8ad2798a593b430044b74f1f79d36efc2a5bed1e8a2c872d284bedfe5c76652ea7566b1152d1ae6c5e1a2f3d04ed4e9ac5344bcf4acd1dde0df
TLSH
T11C21AF0583E84B1FF4774B31ADFA432F9275FD58EF62975B8540422C2C51604EFA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n2lx13qr.2jx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2lx13qr.2jx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ken422ts.dll

Path C:\Users\Admin\AppData\Local\Temp\ken422ts\ken422ts.dll
Size 3KB
SHA256 c82264e3501f6ace309ecee4cf73765cd190f597c02cc8a583a3ff165cc7e3b0
MD5 cc011cbd693686c56d9cce276c9371f6
SHA1 4a7af14ba06ad23c24cbdfa5f3d3807ec7f8f8df
SHA512 0c230143ce91c657ba2ac4439de87eb44cd452f5c439bf97083cf1b7dd4f8bffa3ea995d13b2076c61fee2510f2993ab9c871a81fcfc7b4cbbe5851bb8e66418
TLSH
T1F171ED0A93E84657E4B74730AEF3072637B4FC649F76576F19C0021DACA26A09D32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC27AFF299155B40E69CB9CF622191E9DF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ken422ts\CSC27AFF299155B40E69CB9CF622191E9DF.TMP
Size 652B
SHA256 f339c6818f2cd82824bc133daa1eff0b8bf49c6d7123bc7545f397de019d1a70
MD5 79675c192a93b363372fe9d9141f0c94
SHA1 f5d4eb24bae320c25d74700e462301f5e0ce87c1
SHA512 3d139753a03c2b5c97d629e174101a7117bfd48b4da599e3bfc6ad461235007a9cbd35f5243508f8ab33587a20a72d99d3d97e2907ef2ef0ddce60d043471afa
TLSH
T177F03A0A63F8420AF4F38B30F9F6436391A8BC69DE3293ED1490431D28645109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ken422ts.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ken422ts\ken422ts.0.cs
Size 476B
SHA256 3860430007af19512caa5bc2791e150c16125225f975d80b3a337b0286d90f7a
MD5 590689de7bcf03d0859e9eff38ad8176
SHA1 2437d6bfd15d78c5de80ed0f0e5108112189e323
SHA512 5849cc0034c8467dca491f6599a33c32c77ee98ecc356c1fc3bf8c757d589d737aa2d5d5818891f6d7534d68f66646c746188aceb29a74e9e02b962af0d1abc3
TLSH
T186F09E18170B93954A5183675C4064ACFD63815235FE2E13F54853324F5F164F935A0D
MD5 SHA1 SHA512 TLSH

Submit Download

ken422ts.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ken422ts\ken422ts.cmdline
Size 369B
SHA256 32234cb929d643b376dc0277ce14d27024e832fe70c769164b142b0775cb6f71
MD5 ca36934c3d4ff0d7c072cf60f0ba80d5
SHA1 d9af5ee029d1a1d44226ed07ddace342ced5f074
SHA512 4bff139790defbd2335b7f76777f5320f053ff5d263db84b1f6e56187bed1576865b4603b9bbb35914ed268ff0e76debd4c63c30f8fd46dea5e708b5ab5d4c18
TLSH
T133E0C63E5246C2FD01FE120B26BAC5BCC272078F69823F849846C40DE1A72043BD27A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4928-14-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-13-0x00000239790E0000-0x0000023979104000-memory.dmp

Download

memory/4928-0-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-15-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-17-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-19-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-18-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-12-0x00000239790E0000-0x000002397910A000-memory.dmp

Download

memory/4928-10-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-11-0x0000023960720000-0x0000023960730000-memory.dmp

Download

memory/4928-2-0x00000239606D0000-0x00000239606F2000-memory.dmp

Download

memory/4928-32-0x0000023979120000-0x0000023979128000-memory.dmp

Download

memory/4928-1-0x0000023960720000-0x0000023960730000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads