890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/IdentifyConsoleWindow.ps1
Size 1KB
Sample260712-shdlsacs2l
SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
MD5 d0568512a8b58a101d43c7c961ad50d0
SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
TLSH
T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6028	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6028	PowerShell.exe
6028	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 2468	6028	PowerShell.exe	88
PID 2468 wrote to memory of 6024	2468	csc.exe	89

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\IdentifyConsoleWindow.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yhb00i30\yhb00i30.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C10.tmp" "c:\Users\Admin\AppData\Local\Temp\yhb00i30\CSC5D8C7CA3596440B4B2B53ACD2C1F10E.TMP"
    3⤵
    PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5C10.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5C10.tmp
Size 1KB
SHA256 f824157b39b14868816c2b76f7621cf258db76a06aaef280469d51e5b9dec234
MD5 750d98ba9e1dd608cb4897d83a1ca015
SHA1 41c02f60a37954325cd9e402f38aed3d11efa34b
SHA512 1c014713379dadc12286e76e5ef0fc59b02dafc8655d626c3dbf2553ff7d39594437da36056274ee32b363934a86f8f34a165e63d6f53729746ddaa57256a81b
TLSH
T11721EB0543ED871AF0B7473279F2132B9268FD90EF62A7AA8504422C2C50604EEE2A72
MD5 SHA1 SHA512 TLSH

Submit Download

yhb00i30.dll

Path C:\Users\Admin\AppData\Local\Temp\yhb00i30\yhb00i30.dll
Size 3KB
SHA256 007cf670f507a3aaee2398f9460795255518b9be352146c82c44c4f1cea52e9f
MD5 bf7ecc951c676fe025a612002b0847f1
SHA1 f003fb3a4a41b6eefe68ebfd240eb825c0fa6b92
SHA512 558c4c6a8ba115a2b48ae3df170e802a1e11f2f7bdd3f015073dc3b137bff15b25fd2f4613bb50a45725044d0d1dde983924dc410790e333f561acf5d1630b92
TLSH
T14C71104697E94627E0B74731BEF3471373B8F8609BB3A76E55A0431DEC612204932BA0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5D8C7CA3596440B4B2B53ACD2C1F10E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yhb00i30\CSC5D8C7CA3596440B4B2B53ACD2C1F10E.TMP
Size 652B
SHA256 a8a48ee4bddc968ba1d9fa4ae6d46ca361dda0e5a676a9e7cfdb44bb8a256549
MD5 53807de058eb1e97b7115e518c5c456d
SHA1 b1ca1e401fd6d1e7bb76950de3b4761db44468bb
SHA512 cde35875104470c4f68ea097a93272e7aab8b4bf74006fc2fee8051288ea10b6f1fe803a27f9dd48949bd0261926b9b6cf09d7a717850a5901d701506d05558c
TLSH
T118F05E4963F8020EF0F74B30BDF643A391A8BC65DE3297FD2450431928646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yhb00i30.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yhb00i30\yhb00i30.0.cs
Size 615B
SHA256 affbeb48f65303e13e7c8577dbafbb259131abde5bf8b6335f508a8ce7ce9cd3
MD5 99e8477437263302d0b0c9baf2007880
SHA1 9d4f4f01dc04e518f4d1dbcc910c563fe40fb4fe
SHA512 6d0ffefa51023b22df328cda965ead87d2635958ad1b2f0d41f586df46e2e2f0402c0e48def6c9ac394a60431dd58269c37f991a795524df92d18d3e626b0e73
TLSH
T157F08B24AB92E6B0447250158DC7D8ADF206512725782801F9FC2322EF02105993C75C
MD5 SHA1 SHA512 TLSH

Submit Download

yhb00i30.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yhb00i30\yhb00i30.cmdline
Size 369B
SHA256 c480122229319452aa191a54dcf29783b59d167e33723450adeb89a5ce1d268a
MD5 16b49ae631dd3c8d4ef6d8d4c46ac98e
SHA1 4b575e31b3a2e30f6c63dc4c45dc8e11a5caec47
SHA512 93389b45bcd8e350cca3991cc9a5169bad452d08a5843c2a405d49e718095d978e258258aa7a975df63f7a7ca827b777b2e9d48836933245ee6a05bb4b75d961
TLSH
T1ECE06F3A4246C6BE01F9200F227ACAACC6720BC329867F84D060C40DE037800EBD6789
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6028-14-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-7-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-9-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-10-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-11-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp

Download

memory/6028-16-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-8-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-6-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-5-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-27-0x000001EFCFEB0000-0x000001EFCFEB8000-memory.dmp

Download

memory/6028-4-0x000001EFE8490000-0x000001EFE84B2000-memory.dmp

Download

memory/6028-29-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-23-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/6028-3-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download