4338b41fbcf4083983e558dfbee5ff9793fd0f89a3151e48ebcbee6603cf861b

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s.ps1
Size 298B
Sample260721-ph5tgstscy
SHA256 4338b41fbcf4083983e558dfbee5ff9793fd0f89a3151e48ebcbee6603cf861b
MD5 f5bfcf815dcc64b9e14d1e612fa9485a
SHA1 be16b60a716827f89bfdf06531ef71f58ea4bec1
SHA512 099153321f1427d7e6b752e2980decee84d642701b19a477e482fa38c254fe61d77644318744f789121e46b2666b27544062d4fbbe685e78435d4a2cfa79712d
TLSH
T120E07D43C65B66F88D2D03E7D1031F56C2C99087808E240033F28C9AF6C29EC8A44146
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2852	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
4176	svc32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2852	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2852	PowerShell.exe
2852	PowerShell.exe
4176	svc32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	PowerShell.exe
Token: SeDebugPrivilege	4176	svc32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4176	2852	PowerShell.exe	90

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\s.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\svc32.exe
  "C:\Users\Admin\AppData\Local\Temp\svc32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svc32.exe

Path C:\Users\Admin\AppData\Local\Temp\svc32.exe
Size 12.3MB
SHA256 f9868bbd91e68473934f6e245b3d972e913209d0567fe945e52a212918ff4b58
MD5 4056f72108211c9ed554186e4f110a01
SHA1 3eb9144189e8970fb01b9b61ba1c77a1ddc1bc0a
SHA512 640a8ddab5ab8f4bc0c34fd82379780c0d3cf145af10da5b1c5932b344894bebbcfb74ab8273fadd412c0bc28b3ae44e4bbeb46023785a378415407c777d14b4
SSDEEP 196608:EtidXRR6SWyjwYgk+8o97TdxG6EHDTXFqEzSdK8GPp+pn8j1BROWWgEy2:9dXH5cpL7Ta60DTXUEOsp+mj1vx2
TLSH
T143D6BF56E2F901E8D47BC0B8C65B5627EBB234551330A7EB16A08A252F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-0-0x00007FFA37AEF000-0x00007FFA37AF0000-memory.dmp

Download

memory/2852-3-0x000001E3965A0000-0x000001E3965C2000-memory.dmp

Download

memory/2852-4-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-5-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-6-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-7-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-8-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-11-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-12-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-17-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2852-21-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download