890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/IdentifyConsoleWindow.ps1
Size 1KB
Sample260712-shdlsacs2l
SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
MD5 d0568512a8b58a101d43c7c961ad50d0
SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
TLSH
T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2008	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2008	powershell.exe
2008	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4052	2008	powershell.exe	85
PID 4052 wrote to memory of 1704	4052	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\IdentifyConsoleWindow.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zoxxucmb\zoxxucmb.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48CC.tmp" "c:\Users\Admin\AppData\Local\Temp\zoxxucmb\CSC617E49AD8B6F43BC86449610112827E.TMP"
    3⤵
    PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES48CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES48CC.tmp
Size 1KB
SHA256 780046e32d62936672991a94c5d0ad798cc98166a64c7432350dd7ec48095db5
MD5 f3af75dbc035ff0ba4bc2e0a36ee1a32
SHA1 9459fc46711acf80047dea38f3cb52ff0880b165
SHA512 ad0905e2b8cf1439c9d274aaff56be1311ef69b8e007bcf24081a2c387eabbcd8556400fb9cfd7dd6c98447f6c18c7946146da3ba1aa85cf7c6e0688b6d0adf5
TLSH
T1A521BB0543FD470BF077573279F6572BA669FE94EF62632E8500462C2C52204EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tmx3voqu.r3w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tmx3voqu.r3w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zoxxucmb.dll

Path C:\Users\Admin\AppData\Local\Temp\zoxxucmb\zoxxucmb.dll
Size 3KB
SHA256 872ae86504761e1b8212a3654ced1520a5087d221c6ee48a28d5a471b0fcc83c
MD5 30f81c94fb0a549146b76647206211f8
SHA1 597bd493c092e46bde45a997dadecc49d19a9694
SHA512 b13ea5016d81fc5e3d93be6b2f7a3664762f74126aebbc04eccb8ccf225aface8448d71644c6a6539b192c8d141ebb7dd576df50fe481b1ebc3bc2ac120a53ef
TLSH
T1ED71F05797ED462BE0770735AEF3471277B8F8505BB7A76E5590021DBC621204E31FA0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC617E49AD8B6F43BC86449610112827E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zoxxucmb\CSC617E49AD8B6F43BC86449610112827E.TMP
Size 652B
SHA256 028e6e8cbbda96bcabcef5edbdb119fa29a7a7bea42f2976fbcdcc240ffb8b67
MD5 a003bd56003cd7de3c52e5947be244da
SHA1 ed45b530daa531c4cca5eb9c2b5b70fb65440099
SHA512 497ec396429295f4fe41c5e8e3a6016ac9d3d2255f50d05d768e0ab389a50722fe875245fe3bc0bb2d9479fbb860eeaa041a8f9a702a7899dc89813b2cb0cb8c
TLSH
T130F0540967FC420EF0F35B30BDF543A3A569BC65DE3253ED1440031918655108E61F72
MD5 SHA1 SHA512 TLSH

Submit Download

zoxxucmb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zoxxucmb\zoxxucmb.0.cs
Size 615B
SHA256 affbeb48f65303e13e7c8577dbafbb259131abde5bf8b6335f508a8ce7ce9cd3
MD5 99e8477437263302d0b0c9baf2007880
SHA1 9d4f4f01dc04e518f4d1dbcc910c563fe40fb4fe
SHA512 6d0ffefa51023b22df328cda965ead87d2635958ad1b2f0d41f586df46e2e2f0402c0e48def6c9ac394a60431dd58269c37f991a795524df92d18d3e626b0e73
TLSH
T157F08B24AB92E6B0447250158DC7D8ADF206512725782801F9FC2322EF02105993C75C
MD5 SHA1 SHA512 TLSH

Submit Download

zoxxucmb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zoxxucmb\zoxxucmb.cmdline
Size 369B
SHA256 56333b4fcced0122212db0fef55ff8ca8389b69f7a96ed918a12000dbefd227c
MD5 c2813bf9360a07ff5a36af7e1372d31e
SHA1 7235aca28766f9b97405fa1f9bc4bdedffaa9f49
SHA512 ee26326c63e9c3dd97a99c8710f2ede32ac0a0872fdbfa27ffdd881fc8f5fe970069a972abca9148751cb123b277e990ebe1e9b366adfe983e66ea0c34c2a4a0
TLSH
T1C6E0DF2F5297C6BE59EB104B22AAD5BC827A06D729817FA4A150845DF0270046BE2BA9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2008-0-0x000001CD61BF0000-0x000001CD61C00000-memory.dmp

Download

memory/2008-1-0x000001CD61BF0000-0x000001CD61C00000-memory.dmp

Download

memory/2008-3-0x000001CD49630000-0x000001CD49652000-memory.dmp

Download

memory/2008-22-0x000001CD49660000-0x000001CD49668000-memory.dmp

Download

memory/2008-25-0x000001CD63D70000-0x000001CD63F8C000-memory.dmp

Download