a6c88e847dc1298c35666d698d52c0b93ddc09e1989d37b1173b87adcf2ab7fc

Analysis

max time kernel
17s
max time network
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iex irm goodness.ps1
Size 38B
Sample260721-lskphsct3p
SHA256 a6c88e847dc1298c35666d698d52c0b93ddc09e1989d37b1173b87adcf2ab7fc
MD5 fcbc748fc5f47b5af60f9320772ef88d
SHA1 b2326da3d770bdfcdfae8bdd207467969c6fa0f7
SHA512 1e98c1111a19c5ecfa7d4b44f27b0bfa8a58ada0dc38c2975a8871d8167f75f2f92d7c0e2a2b2232f580d076c1e619769b7824a981339ff65c42d67ea44e7270
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4536	PowerShell.exe
3	4536	PowerShell.exe
4	4536	PowerShell.exe
5	4536	PowerShell.exe
6	4536	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4536	PowerShell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	PowerShell.exe
4536	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4536	PowerShell.exe
Token: SeSecurityPrivilege	4536	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4536	PowerShell.exe
Token: SeLoadDriverPrivilege	4536	PowerShell.exe
Token: SeSystemProfilePrivilege	4536	PowerShell.exe
Token: SeSystemtimePrivilege	4536	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4536	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4536	PowerShell.exe
Token: SeCreatePagefilePrivilege	4536	PowerShell.exe
Token: SeBackupPrivilege	4536	PowerShell.exe
Token: SeRestorePrivilege	4536	PowerShell.exe
Token: SeShutdownPrivilege	4536	PowerShell.exe
Token: SeDebugPrivilege	4536	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4536	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4536	PowerShell.exe
Token: SeUndockPrivilege	4536	PowerShell.exe
Token: SeManageVolumePrivilege	4536	PowerShell.exe
Token: 33	4536	PowerShell.exe
Token: 34	4536	PowerShell.exe
Token: 35	4536	PowerShell.exe
Token: 36	4536	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4536	PowerShell.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4536	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3116	4536	PowerShell.exe	90
PID 3116 wrote to memory of 4324	3116	csc.exe	91
PID 4536 wrote to memory of 1480	4536	PowerShell.exe	94
PID 1480 wrote to memory of 4844	1480	csc.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\iex irm goodness.ps1"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ishiq05e\ishiq05e.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0F5.tmp" "c:\Users\Admin\AppData\Local\Temp\ishiq05e\CSCC09A962E8FEC493D84E43C268ACFD2F.TMP"
    3⤵
    PID:4324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t1nmpxlg\t1nmpxlg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE507.tmp" "c:\Users\Admin\AppData\Local\Temp\t1nmpxlg\CSC4DDE95008EEA4012A9C6D708B4E8B.TMP"
    3⤵
    PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC0F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC0F5.tmp
Size 1KB
SHA256 24b3863f9144e6e9555101172235537dd17886650f190677d080e5d30c0da75d
MD5 04e07e5a9914ff9f8c850a128fa33903
SHA1 30b4607fad55b237b60f4d8d12c08fb224334a5e
SHA512 7e0a870e46d96636704158549a6ed78e1423a03cd4dc00a59ac5b8661f29fab06c3d31e7627a2e41a21af2468d58f62bb4c717e0359a71360543461269404bc8
TLSH
T137218C0593ED870BF0B3473169F6572FA274FD55EFA2A35A854102292C51644EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESE507.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE507.tmp
Size 1KB
SHA256 1273303cc6dd526f4852363bfaf6ca6a101ca81ddd9ca018e42b2b1d0f36b4e5
MD5 3a39f47bebba7892bb8166b7136f271f
SHA1 4684ee55afe707dce41a1be25962155d99730200
SHA512 42d033b656e0c3a30f1b05dd2b0560a888bec1979d2adba0d0ded3dc4068baf29eeb708f411f1d6cf5a139f89643212ce9019a50cec19e33613fd0b9940b8f7e
TLSH
T12821C00553ED471FF0B3173279F6171B9634FD549F62A35A8540022C2C42504EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

ishiq05e.dll

Path C:\Users\Admin\AppData\Local\Temp\ishiq05e\ishiq05e.dll
Size 3KB
SHA256 4e4cf7d23f5f135206fa0eeab9b46650d9b756c68b6f1f0da533821e5820ef18
MD5 d7499150587573c12f388da48ff083df
SHA1 4aef77d390d9c695c991b5a5121ad4feb98c92c3
SHA512 1ec711ad9a408102086cc8396b0aebb5a36b2bf59afe14e62f7d039ea52c2f30a0843de43a7a7211591a11f465150c4a66e93a27f5275c52233deff62784fc79
TLSH
T1FC51DF2767E98A27E4770731ADF3631737A8FD549B73572D49804218AC613248D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

t1nmpxlg.dll

Path C:\Users\Admin\AppData\Local\Temp\t1nmpxlg\t1nmpxlg.dll
Size 4KB
SHA256 c6567951be849f6c55646166d8f409e1e51fa0793d3e0629e4eca70f0bcd6e82
MD5 d9a4711cc8967512dc59be424e22b67c
SHA1 f9d254e1dfb5c83df634f3b33bb91aec043336db
SHA512 91faacd260c6ef4c9b51bab082bf6cd86d6f361d99e6b4c12e4f841632f529b5987c09dc7a0c1b7547fb118dfe18ec7de1f7b510105d681f0cecac400eb5d348
SSDEEP 48:65FJ5hV6LRANI3WmkS088UPf5KNsUvHwFdXLNTsgmbsvBCR71ulPa3zq:ob5yLRAiWmv0qWHGXNcOCRstK
TLSH
T10591850F6FED491BD0EB473D2AF3A79A2370F825DB22879F5981212C2C115A41A11FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC09A962E8FEC493D84E43C268ACFD2F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ishiq05e\CSCC09A962E8FEC493D84E43C268ACFD2F.TMP
Size 652B
SHA256 f5b32d83485733d4c1afc5e5bd8044b4ed2a42286d4d38233f8db810420a0714
MD5 0d87025757dced10e401f661caacd5ce
SHA1 e647ed740fb3514556e853449209e3c4e7d2b643
SHA512 7e99b836a594b705e0e98ab64bce782d8f1462b3b0149cb1b8f94498de486753290a947f5bf14b0d54b4b21c92f1e7e813f1c32a44860fcb2fd3f8041fa7fab4
TLSH
T1BAF05E0963F8820EF0F34F30BDF69363A1A8BC66DE32A3ED144003196864610C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ishiq05e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ishiq05e\ishiq05e.0.cs
Size 256B
SHA256 9921b80c9e875f33171360ff586f3b434f428c1aff6e4118bfe49c6aefa1af6c
MD5 859e7c3dc6b61c3bd006fa3cf0a1a76c
SHA1 5272880b3ae0293022f7e7c1e35152ebdec6cdc2
SHA512 f0183bad5d4082d6701721774b52cb1a150caf07ac107258b39d0b5dadc1c7ccbe047e10bca27085b998d2c2528f6a693f1c13d7ec7800bb523446f665a782fe
TLSH
T138D05E157AA2FAB004124C1A4C47E2FCB62B626526BB2A10A6B91311EF5F41A8235699
MD5 SHA1 SHA512 TLSH

Submit Download

ishiq05e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ishiq05e\ishiq05e.cmdline
Size 369B
SHA256 3e81b83ef84a75615c4c01c1e78f6585df9e88be74d8c6f5851b3de232452b3b
MD5 472f71f883f5f752f2c4b303687c8720
SHA1 d117d917c9029a7b4d61e1193df53eecd23de1ef
SHA512 75be49a4000a0c3c408ad709b000767658f21664e5e6bbaa687097e918251de847e204219dc13e2f1d422a871dc0e7de4da402b60645e38ffce6010c54191362
TLSH
T1E7E06F3B864AC27D02F9200B226EF8AC86B2078339C43FA4D040848EE0378002BD27C1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4DDE95008EEA4012A9C6D708B4E8B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\t1nmpxlg\CSC4DDE95008EEA4012A9C6D708B4E8B.TMP
Size 652B
SHA256 7ba2432247f8bcbb6f91110872a09f2405ef41b1f8f0251cfa695c734cf0a491
MD5 b29b5d09dfc64676ce3010e297998c2f
SHA1 1daf464ea8b8c5ea05fb02a0ecb8c84320f7ebd0
SHA512 96f9ffeb23e056f4a5c7ba61aac79266b1660f44b860e35336e414537121321cc133a730d521422bd35c51484d19654a10eea9392977c4bfce38f832d4b52722
TLSH
T1BBF05E0963F8020EF0F35B31BDF6436395A8FC64DE32A3ED1440531D2864A248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

t1nmpxlg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\t1nmpxlg\t1nmpxlg.0.cs
Size 1KB
SHA256 6a5cf401f7636e694e915f373e106117cd27afbdff62f442103458d101455b54
MD5 2068c88a06696ecec8f709eb62a96255
SHA1 2f94cf46b256206cfcc6a77d1b841a353a440b26
SHA512 035af88be3276a5ee7d8e557f54b94e6c010730ec4d6291dc66b42407f96e2fec968c39b74395bad9eca86be9a0c63a551b86e30be26901d329e203a15323885
TLSH
T18431EF05199381B54BC3281E97749905F731E9332398FD63F98F9A20AF41E154BBC6E8
MD5 SHA1 SHA512 TLSH

Submit Download

t1nmpxlg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\t1nmpxlg\t1nmpxlg.cmdline
Size 496B
SHA256 52f8aa8f80c569ec4dd59524c9e6fdf73bf9e5d1f4bb0dfffa7c5b314d43a8cc
MD5 a73f76f0bf6bca07327317e1ada4b542
SHA1 9b6763977af4bc1ac8c49ec9b6fb74c9ea52dece
SHA512 2387e98fc48cbd98332fadcff6abd8093e015c0f7affba08e130800b68438c841d2a2cb9f42b737ec010aca0335ac0d85b28f6f31233f7c68a3ce1f8259ec15a
TLSH
T1A3F0973A52A7C6BA51FA600B2A69CEACC373074735416F88A1B8981DF1AB5046FD1B90
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4536-12-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-37-0x000001EC63600000-0x000001EC6360A000-memory.dmp

Download

memory/4536-14-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-16-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-15-0x000001EC63650000-0x000001EC63812000-memory.dmp

Download

memory/4536-17-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-0-0x00007FFD5EB3F000-0x00007FFD5EB40000-memory.dmp

Download

memory/4536-11-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-30-0x000001EC630C0000-0x000001EC630C8000-memory.dmp

Download

memory/4536-31-0x000001EC634A0000-0x000001EC634B2000-memory.dmp

Download

memory/4536-10-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-9-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-8-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-32-0x000001EC63D50000-0x000001EC64278000-memory.dmp

Download

memory/4536-36-0x000001EC63820000-0x000001EC638D2000-memory.dmp

Download

memory/4536-13-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-38-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-35-0x000001EC635E0000-0x000001EC635FE000-memory.dmp

Download

memory/4536-39-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-41-0x000001EC638E0000-0x000001EC63904000-memory.dmp

Download

memory/4536-40-0x000001EC638E0000-0x000001EC6390A000-memory.dmp

Download

memory/4536-7-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-6-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-5-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-2-0x000001EC63090000-0x000001EC630B2000-memory.dmp

Download

memory/4536-1-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-54-0x000001EC63900000-0x000001EC63908000-memory.dmp

Download

memory/4536-56-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-57-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-58-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4536-59-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download