82e627edc0ed2ffaac80506e9bca00b69f1df40597d26bf988f7a36af5cd0700

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
colorbackground.ps1
Size 1KB
Sample260717-tkf1csay5s
SHA256 82e627edc0ed2ffaac80506e9bca00b69f1df40597d26bf988f7a36af5cd0700
MD5 7a9efe0fbeaff36911ed390f4a694197
SHA1 80eb38ca396363a1da298e2c485e871918833173
SHA512 e08ed7d40721471effb262c25c0ee34a132f71f4915751fd6dea5dc196d9ea02444733b8ecf34cb80b1ce0cf0ba7be672d31481fab79f77cf58a1868a13065f3
TLSH
T161310F6C176B92611172411ADFD761C4DE5A223B102D4E00743FD624FFB9806832CE98
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3364	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3364	powershell.exe
3364	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3364	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1336	3364	powershell.exe	90
PID 1336 wrote to memory of 4876	1336	csc.exe	92

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\colorbackground.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kv30fh4g\kv30fh4g.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FC.tmp" "c:\Users\Admin\AppData\Local\Temp\kv30fh4g\CSC4A9A47954055476782AB51629244355A.TMP"
    3⤵
    PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4FC.tmp
Size 1KB
SHA256 d36db3003bb988bd8fbe842742ee1f1bbbe4ab5a3c56e0ea6921902f264a5e7e
MD5 ba9cff63c497753762ad97bd604e47b1
SHA1 34868e312519935b291c2da6bf2c7b939d24d582
SHA512 89dbabe591b4b15e93b4fad9805bc01194564341dcd17a2c1cd2010e8a17c22bfca0d88437bd93b52605a189637a9f1a057b032b7d66a5c18bf2d3c501cc1a0d
TLSH
T123217B0583F8471EF0B35732A9F6172B9278FD9AEFA2975E8540422C2C51144EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j2hwon54.4cm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2hwon54.4cm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kv30fh4g.dll

Path C:\Users\Admin\AppData\Local\Temp\kv30fh4g\kv30fh4g.dll
Size 3KB
SHA256 1c1e280b65870dab8b8d7645b23350a1ad3113da46a8031c373319a8801a2f66
MD5 b0109c15d4ded9dc89bf13f552a81f3d
SHA1 f61324ce0e644710f17a35bf01782447e135f1be
SHA512 3cd39934097d0e9c91604db88d606c6b0a4bc1106bfa130aaaf60c5bb9e3e7ae2434c14290ea1352609e3196ef6b8d842b39413484afd283e850dadcf11977b5
TLSH
T14C51FB2AA3F84A2BE4730734ADF3131637B8F8549B73636E0880031CAC613644D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4A9A47954055476782AB51629244355A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kv30fh4g\CSC4A9A47954055476782AB51629244355A.TMP
Size 652B
SHA256 46104a12709f6183405309b6ce61ead00b3fe2aa99e1c012ea786a8c1caad0d8
MD5 fee5588955e6f4b9e8e3be7d1834e07a
SHA1 ef8a581c52441a348c7c1fcac588d1d0fc1833ae
SHA512 1dc4f79d03d54a5aeed3c3d3cc8622597e737e0def108bdad6cf0fe68262b291093a31f0d9c4288628e481ac0b12257b5fff133a30509bd1b3eb693d3b688331
TLSH
T1DBF03A0963F8020EF4F35B71F9F6436391A8BC65DE3293ED1480031D2C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kv30fh4g.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kv30fh4g\kv30fh4g.0.cs
Size 280B
SHA256 e478f903a35097a6ddb89e18f98aaf91a0f770519157aa7d5f5ba9fc1c1dbdde
MD5 4e79d2528cd4f79dce60334b0707c7e2
SHA1 a678dee14591921438a6eb2e6d2b0cbebf85c4d9
SHA512 3e019099a7d462fca4eb580086b67a6f829829bfcfb3ea19fe439f1414a816b122dcaa5f7eb7af312b9a8c6963f7ab59470e14204c074197e75468c2e28d0651
TLSH
T1CAD02B686A53EF704432041A4C43D1FCF30B1021227B2B0072F50321EF6B00E9239D5D
MD5 SHA1 SHA512 TLSH

Submit Download

kv30fh4g.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kv30fh4g\kv30fh4g.cmdline
Size 369B
SHA256 26ffc7ac29e024869fed77a1d8d76166b94ecd2a3ed9e8c5128511e33388c1ee
MD5 56044d1342ec7bde1a00907769c14491
SHA1 8018a4f2d69f6d94e2f98f107705529da99f0e75
SHA512 1ed3c95526d664895e6dd5582220277cbcdf7439bca881c1ee64cab18b21d7d02c488f97aebbe7e1c39e43e4a851a4ce7201b86d410a1ea267f120005ba530a1
TLSH
T1C1E0C6BA4366C67D51ED182F267AC8BCD37227832A803F8C9044841DE027000ABD2BB3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3364-0-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download

memory/3364-7-0x000001CAC08D0000-0x000001CAC08F2000-memory.dmp

Download

memory/3364-1-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download

memory/3364-22-0x000001CAA8360000-0x000001CAA8368000-memory.dmp

Download

memory/3364-23-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download

memory/3364-24-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download

memory/3364-25-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download

memory/3364-26-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download

memory/3364-27-0x000001CAC0920000-0x000001CAC0930000-memory.dmp

Download