cf5702427d2c572de7296211b24ef106103c4266ada9cb16944df8a755c7a000

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
1799s
max time network
1795s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6622000003220000.ps1
Size 8KB
Sample260708-vtaelsds8p
SHA256 cf5702427d2c572de7296211b24ef106103c4266ada9cb16944df8a755c7a000
MD5 b3f0a0a7c5f8b2fa32dd509bc28d393c
SHA1 b26eab2d1855e2846006462b4adf8dd5412bf539
SHA512 cc17e75ab5449c14ef91193004f1d8f25b1699aaf5d83ebd29724ba89453320d2eefafa3928b0024f67fa93b0929de56e7a11cf342d4e48d3c98ea1806bc5f66
SSDEEP 192:OXnx9Tk0WqKPnHm5olmVpvU+2mDWaSXptgBxPktV/ahhdaTfufUyARV/:UQ0KPnHm5LvUwDWaSXptgBxPktV/aoT7
TLSH
T10702651E9A15425142F31376AC0B8589FCAA113F4A085B10355CD18DBFB5A2F9AF4FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2036	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
2628	LockScreenContentServer.exe

Loads dropped DLL 1 IoCs

pid	Process
2628	LockScreenContentServer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Logon Key Manager s5jm3n0a = "C:\\ProgramData\\WindowsLogonKeyManager_r54ia1z2\\LockScreenContentServer.exe"	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2036	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2036	PowerShell.exe
2036	PowerShell.exe
2036	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4716	2036	PowerShell.exe	81
PID 2036 wrote to memory of 5080	2036	PowerShell.exe	82
PID 5080 wrote to memory of 2628	5080	cmd.exe	84

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4716	attrib.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6622000003220000.ps1
1⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\ProgramData\WindowsLogonKeyManager_r54ia1z2
  2⤵
  - Views/modifies file attributes
  PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\WindowsLogonKeyManager_r54ia1z2\LockScreenContentServer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\ProgramData\WindowsLogonKeyManager_r54ia1z2\LockScreenContentServer.exe
    C:\ProgramData\WindowsLogonKeyManager_r54ia1z2\LockScreenContentServer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EzHrugYpplmE.png

Path C:\ProgramData\EzHrugYpplmE.png
Size 463KB
SHA256 57f84dd867e3a3857562f6dc08126608cf13a87f717602afb1a2526bddfc4ee7
MD5 a1ec9c76fbe9c74325c8f80841c870e7
SHA1 601b1b824e9d5cd0d5f32764924ef162d99f4ffc
SHA512 0555c36e0af03e1705c1a19698637fb693996ea226a23a10fdd935e436fdcc57e24cba6258ad941d4acd59674f7c55b168066c251d483b161260c6ac006df7fa
SSDEEP 12288:Cudi+v37/S+ezEvhG031clqYIHBPdqVI1T5:ClM37/SkAsclHGVoVU
TLSH
T1A5A42354A1DECA64E12E6264CAF03EEC249E06A24B1B4CF1ED07921D9DC70617BE9F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utg7vP6iX2sQ.png

Path C:\ProgramData\Utg7vP6iX2sQ.png
Size 30KB
SHA256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe
MD5 db26a20f72ca2d01d8c834159b7b5a8d
SHA1 11455dc20e59e5e027ca51914918487b29b5fc2e
SHA512 4f91e7ffaf143ba7ba851bf67a65cbc85f6ee14d1e7c098c1ab661186ac84c3e866381fab6131386557df7ad01378584199d77e38558d257075e63e336fe02bb
SSDEEP 768:N1frXsGi74HUK0o/GkZNAI7n40oIC7wNwfkj:H8f46ouKAx0o/7qwfo
TLSH
T1E3D2F1A21AC895AEDFE9F960A7CF0027587021175F25A64388194C86FDB60E315FF1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DUI70.dll

Path C:\ProgramData\WindowsLogonKeyManager_r54ia1z2\DUI70.dll
Size 2.0MB
SHA256 906035b6092b2ce1290c566f590e88f1b960b25c6d987f46a3d99cca5b05ee9d
MD5 b2f2473d9058cb975a630485096e6bba
SHA1 9d6c2dd28cefd022b9b63767ce6000fd4e637a11
SHA512 ea35bbea0d2a420073b9099ab9f30f4aa0354ebb963c3cf76abbb86fc02f633530c214fa4c4bc9c71b59dec23ef495f8db753eb070fa24a1d8ea634bf47dacfe
SSDEEP 24576:3S9u7mMJjwtE/v50t/6/Vax3Bc/Tjd2kJKx2ozdoYq9tBGnr5xrYU:3eimMJj6E/c6U9BcLjd2kcxVqVw
TLSH
T191A55B0AB3E80096D0AEF23DE95F460EE3F37541572B86CF225903799E23BD5653A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockScreenContentServer.exe

Path C:\ProgramData\WindowsLogonKeyManager_r54ia1z2\LockScreenContentServer.exe
Size 48KB
SHA256 de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2
MD5 2cf29ef0ae66fcea7056ae948ffd9541
SHA1 3d493a1afae9b38d3c0953016a00ef3d9ac514a0
SHA512 3fd5a0c603ef7630adfc10e69de373aeb66df75f1830cbe83c68df59cbd27bdbe3fe7394a0549ebf8470b48ad207b122acddddc4c0cb1a3ef5e253a462e5fe4b
SSDEEP 768:eQvZAVIG7PsefP8lAd7MtCwIpS9SL4WZwWCXeG1Po9zvR:ZvIIgL5ta+YFWZwWgeePgzZ
TLSH
T1D6233A49ABBA10C1E5ADD23C606A420AF476F262570706EF5199C33C5F73FD4AE39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nbJOotvrywqK.png

Path C:\ProgramData\nbJOotvrywqK.png
Size 646KB
SHA256 20a0f60d7364766ce7317dd17c0287c72cb2a402872e15fbdeaf9303bcf0ceb7
MD5 27005257dc88ded4c4aaf9c1064db694
SHA1 ddf937f25f659fcb865b249c75d893f86c9a5be1
SHA512 a8b75b5c2a60b620ee3cc892c709a2f2580f16841a0e64029b3d501da07a3761a87900294ceb89c5f9c80b05bca185f8d0d62de0641dfbc73614f8328e322e82
SSDEEP 12288:WCMLDfEC8xgxwoJ1YDv4x1eNDWq9hO0lyokWSlYtdH:WCMHwQwW1TK1O0MoNyYtB
TLSH
T121E433AFB65CBDF0B13B4A714396042B0FDB6818129FF1A92B1E582D87117C4EA0F1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0af8bb5-c090-4acf-bb56-57ff09ca98c3

Path C:\Users\Admin\AppData\Local\Temp\0af8bb5-c090-4acf-bb56-57ff09ca98c3
Size 25KB
SHA256 f1bdb538ab7fbf2627a9fce7fcdeb7dc94fc6c135caa5729d91aaff4fc5f1cb3
MD5 274162751ecd895c6bd5a23d64008b46
SHA1 a5306722122fb2f720ae53f041d435e135191f94
SHA512 048518f27f3c13ecdac962d8bbd0848f8236f151aa61a51bfb73c8e32bae0b60d0ff51d986243cb17902f6739ef0bfe43eb8d1b06da43cadab196c7cd5efac33
SSDEEP 768:M1BkAf0eRDH1Ii+8qKeJF5MSaVd2iHtYXmhgZpwBDI0k:MvkAf0eRDH1lteJF5RpwFFk
TLSH
T140C26132944D8C37032B52D979647B5860AF8E36E2968CC6F2FF8D1D5FC6D816E1E062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sus0dm4x.b1h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sus0dm4x.b1h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2036-0-0x00000179EE0F0000-0x00000179EE100000-memory.dmp

Download

memory/2036-1-0x00000179EE0C0000-0x00000179EE0E2000-memory.dmp

Download

memory/2036-8-0x00000179EE0F0000-0x00000179EE100000-memory.dmp

Download

memory/2036-47-0x00000179EE0F0000-0x00000179EE100000-memory.dmp

Download

memory/2036-63-0x00000179EE0F0000-0x00000179EE100000-memory.dmp

Download