9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/ConinMode.ps1
Size 3KB
Sample260712-shdlsacs2l
SHA256 9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034
MD5 dec84b4f7859e44892e0750c83fd693d
SHA1 6f88920515398ca40a09ec06dd2e2a61d2c60583
SHA512 759c6f7c79a6754190848d311ed263e708c1ac791684586228aee63560c8134c310d4433c365d6543b261ffbde7777da63cc69269e22d58d2464ccc6e51ec067
TLSH
T1DB617072B75ED26542761EB8B5C68484F915E82B30A46420B2BC84EE6F3C330D1FAC69
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3976	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	powershell.exe
3976	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2860	3976	powershell.exe	86
PID 2860 wrote to memory of 1516	2860	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\ConinMode.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uo3tz4ak\uo3tz4ak.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20B2.tmp" "c:\Users\Admin\AppData\Local\Temp\uo3tz4ak\CSC530A53281724D11A9EBB0C9FD24F84.TMP"
    3⤵
    PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES20B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES20B2.tmp
Size 1KB
SHA256 86ed5c58dbbfd112dfe6bb35a0c8297a30e9b5a4a7e1a12b98a8ae9a5b604442
MD5 dc62055e2e1cfb4ad64a03ab0c700d01
SHA1 9c1fb3841048f96a9bddb35986b90d5220ba086b
SHA512 b2104f3fb9703a95e739aae66949a28733c355e83c0514f089ae049bc385ab1e30ab05b969b241122baac7bb70bef842fb2bc6535d251eddaeaa35d18d604dd8
TLSH
T13021C80253F9470BF07707326AF2172BA169FD80EBA2976A8444112C2C51204EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bznidisg.cng.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bznidisg.cng.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uo3tz4ak.dll

Path C:\Users\Admin\AppData\Local\Temp\uo3tz4ak\uo3tz4ak.dll
Size 3KB
SHA256 50093753e1b1c7d40b367f141b9fd4b3019d24aa590cbcecfff9c057808edefb
MD5 4590d4b30fee88a8e367a649a5575c0e
SHA1 a04fb3b716fe8dcc1015f3c19cbbfc57893ea9dd
SHA512 a65e65f4748c29061842746c2da7acce2e3826c230bea167018e1a6fcec3abb2ba06fe9574257fb8b7accfd3619d6d6a436e231ff77cf8b1444a510c2cdf9115
TLSH
T16471DE17D7E80667E0B607349EB3435236B0F8514B67D76E1995121DAC746304F31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC530A53281724D11A9EBB0C9FD24F84.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uo3tz4ak\CSC530A53281724D11A9EBB0C9FD24F84.TMP
Size 652B
SHA256 25615aafc4515ca5d5ec4b5cd478fe1706825c3199cb5801eea7e79ebc2c0618
MD5 f3e25a2901640504951c8cae3aac9a36
SHA1 c4793384de3f05a39625b30c34015ca6f8b82b17
SHA512 a5abf699f652f703879fff082b40ad1e56c4bed45a5d56106df16ab578ad1809eabb030aa57a011286001f3d1e3bdc7c6dd79fc526aa9d896094aea491024eff
TLSH
T1D7F0544A63F8020EF1F34B31BEF543A39169BC66DE3293ED5440031D18645109661F72
MD5 SHA1 SHA512 TLSH

Submit Download

uo3tz4ak.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uo3tz4ak\uo3tz4ak.0.cs
Size 716B
SHA256 dc34a2660b2aba1533fbcf396fce968c608dec4ca379046c15dd640eae9af060
MD5 2d82556c1fc924d18e71bf050af8e0c6
SHA1 0db7b682254bc5c54620614f8b3930f73797a811
SHA512 6619dd820fa01e95b4f80b2e1f91388b3171383d96704a4b084746cba2f87494e301c97b5772be8a66d7104d792bb5167949a0af6793c894c8a7b08d2c97118b
TLSH
T1DF017B459792C7B2C83515284D4BD4AEF663F12324F97D52B6FC07B1AF2B100953625D
MD5 SHA1 SHA512 TLSH

Submit Download

uo3tz4ak.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uo3tz4ak\uo3tz4ak.cmdline
Size 369B
SHA256 ce16d8090d6c0ccbf781daa026e04610ea201e8e0e14cc8d3119937b8eb0091a
MD5 b1fb5e75c026a4abb21b7709df15b962
SHA1 0ebc6590aa4c3f2a593d868bb77518aeae0db16d
SHA512 15b842fd259b5ca644bc3f6d9e718ef379f84c07fea755d93bbada969b24bca302bdde68be29a9d49d7bcfda1922bce8eec4b714d524530f49b6850f10381458
TLSH
T165E06F3AB3C6C2BF45E9200B336AC8EC8372068329C03FC49068880DE0370083BE2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3976-0-0x000002D7FAEB0000-0x000002D7FAEC0000-memory.dmp

Download

memory/3976-1-0x000002D7FAEB0000-0x000002D7FAEC0000-memory.dmp

Download

memory/3976-2-0x000002D7FD4E0000-0x000002D7FD502000-memory.dmp

Download

memory/3976-22-0x000002D7FDFA0000-0x000002D7FDFA8000-memory.dmp

Download