Overview

overview

8

Static

static

1

file01.ps1

windows10-2004-x64

8

file01.ps1

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file01.ps1
  • Size 12KB
  • Sample260701-xdjpfset4w
  • SHA256 37bef9d9a13d0c1a15a0a3fea74ca6cacdcc0defcbf16c888f6403c8bc56a3c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionexploitransomware

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Possible privilege escalation attempt 20 IoCs
    exploit
  • Modifies file permissions 1 TTPs 20 IoCs
    discovery
  • Drops file in System32 directory 15 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ksa3vgia\ksa3vgia.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E77.tmp" "c:\Users\Admin\AppData\Local\Temp\ksa3vgia\CSC4E1F5658FB0E4E27A7D0FF9EDC124497.TMP"
        3⤵
          PID:980
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskpart.exe /A
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1988
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskpart.exe /grant Administrators:F /t
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:5048
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskmgmt.msc /A
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4272
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskmgmt.msc /grant Administrators:F /t
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4136
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cleanmgr.exe /A
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4500
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" C:\Windows\system32\cleanmgr.exe /grant Administrators:F /t
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3292
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\defrag.exe /A
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2992
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" C:\Windows\system32\defrag.exe /grant Administrators:F /t
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4208
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cipher.exe /A
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4320
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" C:\Windows\system32\cipher.exe /grant Administrators:F /t
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2740
      • C:\Windows\system32\vssadmin.exe
        "C:\Windows\system32\vssadmin.exe" add shadowstorage /for=C: /on=C: /maxsize=10%
        2⤵
        • Interacts with shadow copies
        PID:4672
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { # For each logical disk, set EnableQuota and read-only attributes Get-WmiObject -Class Win32_LogicalDisk -ErrorAction SilentlyContinue | ForEach-Object { # Prevent formatting via WMI by setting VolumeDirty or other flags? Not directly. # Instead, we can dismount and remount? Not effective. # We'll use diskpart script to set readonly attribute on each volume. $drive = $_.DeviceID -replace ":" , "" if ($drive -match "^[CDEFGHIJKLMNOPQRSTUVWXYZ]$") { $script = "select volume $drive`nattributes volume set readonly`n`nexit" $script | diskpart.exe 2>$null } } Start-Sleep -Seconds 60 }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$vmExtensions = @("*.vhd","*.vhdx","*.vmdk","*.vmx","*.vmsd","*.nvram","*.vmem") $monitorDirs = @() $drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -gt 0 } foreach ($drive in $drives) { $root = $drive.Root if ($root -match "^[CD]:\\") { $monitorDirs += Get-ChildItem -Path $root -Recurse -Directory -ErrorAction SilentlyContinue | Where-Object { (Get-ChildItem $_.FullName -Include $vmExtensions -File -ErrorAction SilentlyContinue).Count -gt 0 } | ForEach-Object { $_.FullName } } } $monitorDirs = $monitorDirs | Select-Object -Unique # Use a file system watcher for each directory $watchers = @() foreach ($dir in $monitorDirs) { if (-not (Test-Path $dir)) { continue } $watcher = New-Object System.IO.FileSystemWatcher $watcher.Path = $dir $watcher.IncludeSubdirectories = $true $watcher.EnableRaisingEvents = $true $watcher.Filter = "*.*" $action = { $path = $Event.SourceEventArgs.FullPath $changeType = $Event.SourceEventArgs.ChangeType if ($changeType -in @('Deleted','Changed')) { $ext = [System.IO.Path]::GetExtension($path) if ($ext -in @('.vhd','.vhdx','.vmdk','.vmx','.vmsd','.nvram','.vmem')) { # Restore from latest shadow copy $shadow = (vssadmin list shadows /for=C: | Select-String "Shadow Copy Volume:") -replace ".*Volume: " , "" if ($shadow) { $shadowDrive = $shadow[0] $origPath = $path -replace "^[A-Z]:", $shadowDrive if (Test-Path $origPath) { Copy-Item -Path $origPath -Destination $path -Force -ErrorAction SilentlyContinue # Reapply permissions icacls $path /deny "Everyone:(D)" 2>$null icacls $path /deny "BUILTIN\Users:(D)" 2>$null Set-ItemProperty -Path $path -Name IsReadOnly -Value $true -Force -ErrorAction SilentlyContinue } } } } } Register-ObjectEvent $watcher "Deleted" -Action $action -SupportEvent Register-ObjectEvent $watcher "Changed" -Action $action -SupportEvent $watchers += $watcher } # Keep script running while ($true) { Start-Sleep -Seconds 3600 }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Windows\Temp\vm_keeper.ps1"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\q0l15zqc\q0l15zqc.cmdline"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES97AD.tmp" "c:\Windows\Temp\q0l15zqc\CSC82D14E15E65D48F097BBDFC2B75958B.TMP"
          3⤵
            PID:3736
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskpart.exe /A
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:4520
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskpart.exe /grant Administrators:F /t
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:3264
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskmgmt.msc /A
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1432
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskmgmt.msc /grant Administrators:F /t
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:4532
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cleanmgr.exe /A
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2716
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" C:\Windows\system32\cleanmgr.exe /grant Administrators:F /t
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2404
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\defrag.exe /A
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:836
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" C:\Windows\system32\defrag.exe /grant Administrators:F /t
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2208
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cipher.exe /A
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2932
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" C:\Windows\system32\cipher.exe /grant Administrators:F /t
          2⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2612

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 948B
            • SHA256 12724557b78af16e7b0485334c5253704fd679ad19be154a9eda35c777c5bdc3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RES5E77.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES5E77.tmp
            • Size 1KB
            • SHA256 ed55c0d85cd1808446b2a4ff1ecbf571cf336b9aa732786c624e5278f8d8f4c6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_3ofmgnmr.sjd.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ofmgnmr.sjd.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ksa3vgia.dll
            • Path C:\Users\Admin\AppData\Local\Temp\ksa3vgia\ksa3vgia.dll
            • Size 4KB
            • SHA256 591fee4cc096db741ae0a7e8a3014275e873bdede23b9985ad3b0846ca01711b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cipher.exe
            • Path C:\Windows\System32\cipher.exe
            • Size 114B
            • SHA256 92e56d0f9449fdbc7073fbe9d8ecb2592e23d78c257bc05d7e1d337443de60a3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RES97AD.tmp
            • Path C:\Windows\TEMP\RES97AD.tmp
            • Size 1KB
            • SHA256 4eae46658962dde5a9b6a3e4c9b9f772f759908776071679d138419b0d95ce52
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            q0l15zqc.dll
            • Path C:\Windows\TEMP\q0l15zqc\q0l15zqc.dll
            • Size 4KB
            • SHA256 6b8bda25612cbbb56e9c3769b5c22d654f5eb9f179301ddf958546a432f93aee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vm_keeper.ps1
            • Path C:\Windows\Temp\vm_keeper.ps1
            • Size 12KB
            • SHA256 37bef9d9a13d0c1a15a0a3fea74ca6cacdcc0defcbf16c888f6403c8bc56a3c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSC4E1F5658FB0E4E27A7D0FF9EDC124497.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\ksa3vgia\CSC4E1F5658FB0E4E27A7D0FF9EDC124497.TMP
            • Size 652B
            • SHA256 acfc08c030d101e736bd070a77f3e289f48cc3221ec70da50b2eb6b1c5186735
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ksa3vgia.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\ksa3vgia\ksa3vgia.0.cs
            • Size 1KB
            • SHA256 26054a652faede9cd2916d5f49eadee995cf32be751d45fd7259872d03c1b28a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ksa3vgia.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\ksa3vgia\ksa3vgia.cmdline
            • Size 369B
            • SHA256 b91bed189a56ee2362af52f00ed2afca9c49e0aec71805ba2630688a2e5024a1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSC82D14E15E65D48F097BBDFC2B75958B.TMP
            • Path \??\c:\Windows\Temp\q0l15zqc\CSC82D14E15E65D48F097BBDFC2B75958B.TMP
            • Size 652B
            • SHA256 52d1f30070466b184f4f3132252202d0011bd9a78e0af6bf508def943d20a0d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            q0l15zqc.cmdline
            • Path \??\c:\Windows\Temp\q0l15zqc\q0l15zqc.cmdline
            • Size 333B
            • SHA256 e75f7f0a3a98f553d3055546b7e8ddfbf0292bffbdfc505c9196d8739ffa192e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/940-22-0x000001D1F45B0000-0x000001D1F45B8000-memory.dmp
            Download

            memory/940-1-0x000001D1F4600000-0x000001D1F4610000-memory.dmp
            Download

            memory/940-33-0x000001D1F4600000-0x000001D1F4610000-memory.dmp
            Download

            memory/940-29-0x000001D1F69B0000-0x000001D1F69DA000-memory.dmp
            Download

            memory/940-23-0x000001D1F4600000-0x000001D1F4610000-memory.dmp
            Download

            memory/940-30-0x000001D1F69B0000-0x000001D1F69D4000-memory.dmp
            Download

            memory/940-32-0x000001D1F4600000-0x000001D1F4610000-memory.dmp
            Download

            memory/940-31-0x000001D1F4600000-0x000001D1F4610000-memory.dmp
            Download

            memory/940-9-0x000001D1F4580000-0x000001D1F45A2000-memory.dmp
            Download

            memory/940-0-0x000001D1F4600000-0x000001D1F4610000-memory.dmp
            Download

            memory/2796-78-0x0000026D45A50000-0x0000026D45A58000-memory.dmp
            Download

            memory/2796-96-0x0000026D45C60000-0x0000026D45C7C000-memory.dmp
            Download

            memory/2796-97-0x0000026D5DDA0000-0x0000026D5DE55000-memory.dmp
            Download

            memory/2796-98-0x0000026D45C80000-0x0000026D45C8A000-memory.dmp
            Download