8187d18ad0d703dd77eb24ec1c51492d73e7b9886f7f43639c3770b014b2b98a

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 610KB
Sample260723-c8lgbazdnf
SHA256 8187d18ad0d703dd77eb24ec1c51492d73e7b9886f7f43639c3770b014b2b98a
MD5 1215924a9e9acc2a4e4facf734032e74
SHA1 b7722073659b219c124836e442592144ef7dbd46
SHA512 f64762bb4c3965978afed3b9d2155a4f32d84a73b3c1cc199e5d30d857207c81800cae256e97def5dacdf7bef6242c33da176e6e2e67007db6d3a8552b7f3361
SSDEEP 12288:xSwXIBvyw0kWGzliN9y8wSr+2vWVxqJU9YhOqPPnGZ:QwXovM9yx2vagq
TLSH
T1E8D47D307E022EFF5BA820C248C9C11D563C3675DA682DF56ACB4CA2391D77627B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3916	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 2384	3916	PowerShell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3916	PowerShell.exe
1040	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3900	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3916	PowerShell.exe
3916	PowerShell.exe
3916	PowerShell.exe
1040	powershell.exe
1040	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3916	PowerShell.exe
Token: SeSecurityPrivilege	3916	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3916	PowerShell.exe
Token: SeLoadDriverPrivilege	3916	PowerShell.exe
Token: SeSystemProfilePrivilege	3916	PowerShell.exe
Token: SeSystemtimePrivilege	3916	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3916	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3916	PowerShell.exe
Token: SeCreatePagefilePrivilege	3916	PowerShell.exe
Token: SeBackupPrivilege	3916	PowerShell.exe
Token: SeRestorePrivilege	3916	PowerShell.exe
Token: SeShutdownPrivilege	3916	PowerShell.exe
Token: SeDebugPrivilege	3916	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3916	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3916	PowerShell.exe
Token: SeUndockPrivilege	3916	PowerShell.exe
Token: SeManageVolumePrivilege	3916	PowerShell.exe
Token: 33	3916	PowerShell.exe
Token: 34	3916	PowerShell.exe
Token: 35	3916	PowerShell.exe
Token: 36	3916	PowerShell.exe
Token: SeDebugPrivilege	5624	whoami.exe
Token: SeIncreaseQuotaPrivilege	3916	PowerShell.exe
Token: SeSecurityPrivilege	3916	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3916	PowerShell.exe
Token: SeLoadDriverPrivilege	3916	PowerShell.exe
Token: SeSystemProfilePrivilege	3916	PowerShell.exe
Token: SeSystemtimePrivilege	3916	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3916	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3916	PowerShell.exe
Token: SeCreatePagefilePrivilege	3916	PowerShell.exe
Token: SeBackupPrivilege	3916	PowerShell.exe
Token: SeRestorePrivilege	3916	PowerShell.exe
Token: SeShutdownPrivilege	3916	PowerShell.exe
Token: SeDebugPrivilege	3916	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3916	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3916	PowerShell.exe
Token: SeUndockPrivilege	3916	PowerShell.exe
Token: SeManageVolumePrivilege	3916	PowerShell.exe
Token: 33	3916	PowerShell.exe
Token: 34	3916	PowerShell.exe
Token: 35	3916	PowerShell.exe
Token: 36	3916	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3916	PowerShell.exe
Token: SeSecurityPrivilege	3916	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3916	PowerShell.exe
Token: SeLoadDriverPrivilege	3916	PowerShell.exe
Token: SeSystemProfilePrivilege	3916	PowerShell.exe
Token: SeSystemtimePrivilege	3916	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3916	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3916	PowerShell.exe
Token: SeCreatePagefilePrivilege	3916	PowerShell.exe
Token: SeBackupPrivilege	3916	PowerShell.exe
Token: SeRestorePrivilege	3916	PowerShell.exe
Token: SeShutdownPrivilege	3916	PowerShell.exe
Token: SeDebugPrivilege	3916	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3916	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3916	PowerShell.exe
Token: SeUndockPrivilege	3916	PowerShell.exe
Token: SeManageVolumePrivilege	3916	PowerShell.exe
Token: 33	3916	PowerShell.exe
Token: 34	3916	PowerShell.exe
Token: 35	3916	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 5624	3916	PowerShell.exe	91
PID 3916 wrote to memory of 2384	3916	PowerShell.exe	92
PID 3916 wrote to memory of 2384	3916	PowerShell.exe	92
PID 3916 wrote to memory of 2384	3916	PowerShell.exe	92
PID 3916 wrote to memory of 2384	3916	PowerShell.exe	92
PID 3916 wrote to memory of 2384	3916	PowerShell.exe	92
PID 5084 wrote to memory of 3900	5084	conhost.exe	97
PID 3900 wrote to memory of 1040	3900	cmd.exe	98
PID 1040 wrote to memory of 2852	1040	powershell.exe	99
PID 2852 wrote to memory of 3148	2852	csc.exe	100

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:248

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5tkhd0sb\5tkhd0sb.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8742.tmp" "c:\Users\Admin\AppData\Local\Temp\5tkhd0sb\CSC7266AA2F68D74213AF3682A187D1AD65.TMP"
        5⤵
        
        PID:3148

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 287KB
SHA256 daa92175e58548ef1bc60b78b686309d23dcc8f9568447deb71ff284d6066dd8
MD5 ae704ce145ff5a96cf2cd5e29e1c73fa
SHA1 dfcaf7bee432264766d860cc780a34706ed0b2a2
SHA512 112808f5495e5797fb0c5a09bd253adf023ce77b080d95e2d97ae5d2fb5145791ce71e14cf3ee3eeed52b8c0fe3bf17d9a9f402381dc7d997b70944c337b2470
SSDEEP 6144:Yy6iELQ2uwDwD0BM4wjDqUw5VFBcvDGsj:aRu2M4wjjw5UGA
TLSH
T188546E247A522EFB5BA820C244CAC11C563C26B5D9692DF27ACF0C923F0D77617B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34ea861392567058e6bc2cfe2dcd2d05502085df96e3e2307074d18032055fa9
MD5 2321c8a71e8bd94f672afc5186e4f8fd
SHA1 87cf65a2c5a95f94ff3734c4768477f4b733fa7d
SHA512 5860aa0c778cee12031e13220e5507b0058d9c756df6a7921bc6e60881917206d7d6453dcb19237f720a50e876ce3bfc9a4d646f131933ecc256e0fcb5139d08
TLSH
T122417727B3DC82D0C88960BADCDD6C107AB693D7809F8EDB6A80E115E56F699DA68050
MD5 SHA1 SHA512 TLSH

Submit Download

5tkhd0sb.dll

Path C:\Users\Admin\AppData\Local\Temp\5tkhd0sb\5tkhd0sb.dll
Size 3KB
SHA256 24975802392c9e6f869cd2ba8863df00786abc74122e22db3121fd6ab2b17a45
MD5 8d3ae2a155718a3491877938de7e4f5b
SHA1 c3f15a79a57b5c2230e5326828ee6aa947890dc9
SHA512 0b8dfb4c105f30350d1c74433915be951092fdc8630453e96185178b12ea92d5f36faed839e2afbab8947c6a8087b4ad608a286270c0e73edc7963acb7b5ed52
TLSH
T1DB716506E7E44AA6E0B30334A9F3435253B8FC649E37571F19C41328BC667646E32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES8742.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8742.tmp
Size 1KB
SHA256 c8cfc5bedc4ccfb5313e6741dc8e42d979bc04b34eda658833d8b7b5723512d7
MD5 20df6fbaf6ad0f216ed16d5fb74a4ea0
SHA1 c493e19e0cb9ffc02282fa914cf9698be8ce7105
SHA512 d44d045e68bf3fed60b6712a905cf7071bdeab0074ab07b79b9599e7c6fcc0b53105465cdd72acb655e8fc59e2080506b06cea3976836adf90e5d7473b64d485
TLSH
T1CA21890593E8471FF0B35B3169F6076B9674FD55EFB1936A8540022C2C52654EFA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rfpk1qvn.mhv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rfpk1qvn.mhv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

5tkhd0sb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5tkhd0sb\5tkhd0sb.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

5tkhd0sb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5tkhd0sb\5tkhd0sb.cmdline
Size 369B
SHA256 d854648f78db8936ab34d65c638e168a2dedfb7f22fcaa25abcd6150fa849438
MD5 7fe2c70297675f46d2c608e40130c711
SHA1 67fa1a13441e7c8de12c0792794f89a38549d858
SHA512 fe702124c41e50e3abd61e528a4b65d753d43261eb2783961b9814af0aa07544313f989de5b7612d4cb35a1dc53e0db76a4f72d90eadf40438199a9fb63fd209
TLSH
T1C4E0C03E6377C67D11DD60472169C4AFC2730F472A403F845040849ED097CD42FD1751
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7266AA2F68D74213AF3682A187D1AD65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5tkhd0sb\CSC7266AA2F68D74213AF3682A187D1AD65.TMP
Size 652B
SHA256 dda82a070192a5c5b928157ec34fb5a4380c39d3324ca0cd02759f8ce6d791d4
MD5 d4343c9f7bd929697946ac36f13c1162
SHA1 9de24cfdfc11eb11d8bf08e979dd0fbf18e61d3b
SHA512 ef0a0ea4eb0ff1be3ae5d41cc1ea49e0b3fa6920749fc0cfd691106d5b9c465d7793c410945535f07ff5ab225f1f7c84ded460fa7ed14a529f80aeae758f587c
TLSH
T1E5F0300963F8020EF0F35B30B9F543A395A8FC64DE7293ED1540031D1C745109A61F71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-76-0x000001E455920000-0x000001E455928000-memory.dmp

Download

memory/2384-30-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/3916-28-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-34-0x00000256797D0000-0x0000025679992000-memory.dmp

Download

memory/3916-15-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-18-0x0000025678DA0000-0x0000025678DBE000-memory.dmp

Download

memory/3916-19-0x0000025678E40000-0x0000025678EF2000-memory.dmp

Download

memory/3916-21-0x00000256788F0000-0x00000256788FA000-memory.dmp

Download

memory/3916-22-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-23-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-25-0x0000025678F00000-0x0000025678F24000-memory.dmp

Download

memory/3916-26-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-24-0x0000025678F00000-0x0000025678F2A000-memory.dmp

Download

memory/3916-27-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-20-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-0-0x00007FFC2A97F000-0x00007FFC2A980000-memory.dmp

Download

memory/3916-29-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-13-0x0000025678DF0000-0x0000025678E40000-memory.dmp

Download

memory/3916-31-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-32-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-33-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-14-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-36-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-37-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-38-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-39-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-12-0x0000025678D80000-0x0000025678D92000-memory.dmp

Download

memory/3916-43-0x0000025678DC0000-0x0000025678DDE000-memory.dmp

Download

memory/3916-57-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-58-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-11-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-10-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-9-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-8-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-7-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-6-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-5-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-3-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp

Download

memory/3916-4-0x0000025678860000-0x0000025678882000-memory.dmp

Download