c2bc743d848d45342a5ca1a55031052f281b0ff34eb61fa960bd5949df952222

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_c2bc743d848d45342a5ca1a55031052f281b0ff34eb61fa960bd5949df952222.ps1
Size 41KB
Sample260707-jvdymsc16w
SHA256 c2bc743d848d45342a5ca1a55031052f281b0ff34eb61fa960bd5949df952222
MD5 9c053f7d23cc6a185ef443049739c1c7
SHA1 9aa4e1b7ba508c544754a762cbced7faaff4b5f5
SHA512 a7dd055146e7c694b5fe1233242ee5fe20b88d288a4805b07b7144781de5ef3d12b4152788d06e4ffa4786511cf5806dcafe94a9920074cace60ece15e573ae3
SSDEEP 384:nPk7bO3NfmeOhP0kb/coljUit7Jl+H1iHBkvF0pUk9xfCG4YErxZgyhzUtzWeTcz:RPOZ57/EgHBkveFBErxLNdaVNe
TLSH
T1AF13ED36EA93E88297D43D04C4B6F859156426B1CBFBCC5CF78CAAFEB091E101B5469C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3896	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4520	powershell.exe
3896	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4520	powershell.exe
4520	powershell.exe
3896	powershell.exe
3896	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3896	4520	powershell.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_c2bc743d848d45342a5ca1a55031052f281b0ff34eb61fa960bd5949df952222.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc874ad26810ce20b425829cb0cc65a2791399fb1a6f8adfbcb632aa21980566
MD5 d4bcd06489740e20068c868ad2eea639
SHA1 eb4216be63ad2655142a5fb350dac49c186fa123
SHA512 6c3dd3bc23cc79e6ad4c5050315545ec911d5c47bea1e733ec18715d2a91ac2a5ef4ea1295807cde45d4b1d3e028af6033798e0249ba53627b4e91ffa687a9cf
TLSH
T190218627B39C8921CC86163A109D9C1172B283C7809ECF9FABC0D600A07F988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kxdlgjks.nkw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxdlgjks.nkw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp7589.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.ps1
Size 3KB
SHA256 40367f3323c4414abb80f463c36a47e99d2fcd24b70672ac0b025b5e7e4bd914
MD5 54eab7883f28bba239039804f43a7708
SHA1 79f8e42ea3fdd377239c3a55b10af465f01d83b3
SHA512 e437763536f8970ad13c5ba551911af08847e934222a75dd84b61d09cc5c918f64d538069de7c8e2e577c895387fe889c6cb12ac7cfe8a3c7fce65cedd1736a4
TLSH
T1A171D35063F90208F2F76E59A97F94550A7B7A29AD30CB4C41D9184D1BF3A20D87AF3A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3896-15-0x0000011824780000-0x0000011824790000-memory.dmp

Download

memory/3896-14-0x0000011824780000-0x0000011824790000-memory.dmp

Download

memory/3896-25-0x0000011824780000-0x0000011824790000-memory.dmp

Download

memory/3896-26-0x0000011824780000-0x0000011824790000-memory.dmp

Download

memory/3896-27-0x0000011824780000-0x0000011824790000-memory.dmp

Download

memory/4520-0-0x000001E3A1000000-0x000001E3A1010000-memory.dmp

Download

memory/4520-1-0x000001E3A1000000-0x000001E3A1010000-memory.dmp

Download

memory/4520-9-0x000001E3A0F70000-0x000001E3A0F92000-memory.dmp

Download