151d63ab75ccab7b44fc0cea954e15e8a61a4d061c6dbea08e5477eca8798b3d

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ijfcdbhjnidefarpgjbiuearhjgui9wehj38725yhfeehj.ps1
Size 7KB
Sample260729-pf3akstejg
SHA256 151d63ab75ccab7b44fc0cea954e15e8a61a4d061c6dbea08e5477eca8798b3d
MD5 2ae8d883969e88dc4f6d9303caf08dbe
SHA1 92be3872a98c04e6b3bee275913ce690ff007dd0
SHA512 8534d351f42fe5a64148e80cfb76d54e6ac03835a2e3f1830ae1eba1c04ec1d431ff8325051e8b0ff067a3a737472fc01e6162fcaf5324b7d0fd40790bbd14eb
SSDEEP 192:HMH8ztvvl788mDFoMB0oKt4JoGAWUDtBFHGFTbrch:scZvvK8YoMB0YQFmpch
TLSH
T149F17D1A7F0BC5FC55D4543878B2F826C992532930812C0EB562CBC78B099B2A4FB1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3800	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2456	PowerShell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2456	PowerShell.exe
2456	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2456	PowerShell.exe
Token: SeSecurityPrivilege	2456	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2456	PowerShell.exe
Token: SeLoadDriverPrivilege	2456	PowerShell.exe
Token: SeSystemProfilePrivilege	2456	PowerShell.exe
Token: SeSystemtimePrivilege	2456	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2456	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2456	PowerShell.exe
Token: SeCreatePagefilePrivilege	2456	PowerShell.exe
Token: SeBackupPrivilege	2456	PowerShell.exe
Token: SeRestorePrivilege	2456	PowerShell.exe
Token: SeShutdownPrivilege	2456	PowerShell.exe
Token: SeDebugPrivilege	2456	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2456	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2456	PowerShell.exe
Token: SeUndockPrivilege	2456	PowerShell.exe
Token: SeManageVolumePrivilege	2456	PowerShell.exe
Token: 33	2456	PowerShell.exe
Token: 34	2456	PowerShell.exe
Token: 35	2456	PowerShell.exe
Token: 36	2456	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2456	PowerShell.exe
Token: SeSecurityPrivilege	2456	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2456	PowerShell.exe
Token: SeLoadDriverPrivilege	2456	PowerShell.exe
Token: SeSystemProfilePrivilege	2456	PowerShell.exe
Token: SeSystemtimePrivilege	2456	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2456	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2456	PowerShell.exe
Token: SeCreatePagefilePrivilege	2456	PowerShell.exe
Token: SeBackupPrivilege	2456	PowerShell.exe
Token: SeRestorePrivilege	2456	PowerShell.exe
Token: SeShutdownPrivilege	2456	PowerShell.exe
Token: SeDebugPrivilege	2456	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2456	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2456	PowerShell.exe
Token: SeUndockPrivilege	2456	PowerShell.exe
Token: SeManageVolumePrivilege	2456	PowerShell.exe
Token: 33	2456	PowerShell.exe
Token: 34	2456	PowerShell.exe
Token: 35	2456	PowerShell.exe
Token: 36	2456	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2456	PowerShell.exe
Token: SeSecurityPrivilege	2456	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2456	PowerShell.exe
Token: SeLoadDriverPrivilege	2456	PowerShell.exe
Token: SeSystemProfilePrivilege	2456	PowerShell.exe
Token: SeSystemtimePrivilege	2456	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2456	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2456	PowerShell.exe
Token: SeCreatePagefilePrivilege	2456	PowerShell.exe
Token: SeBackupPrivilege	2456	PowerShell.exe
Token: SeRestorePrivilege	2456	PowerShell.exe
Token: SeShutdownPrivilege	2456	PowerShell.exe
Token: SeDebugPrivilege	2456	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2456	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2456	PowerShell.exe
Token: SeUndockPrivilege	2456	PowerShell.exe
Token: SeManageVolumePrivilege	2456	PowerShell.exe
Token: 33	2456	PowerShell.exe
Token: 34	2456	PowerShell.exe
Token: 35	2456	PowerShell.exe
Token: 36	2456	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4664	2456	PowerShell.exe	91
PID 4664 wrote to memory of 3548	4664	csc.exe	92
PID 2456 wrote to memory of 1292	2456	PowerShell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ijfcdbhjnidefarpgjbiuearhjgui9wehj38725yhfeehj.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xrns2koi\xrns2koi.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AC2.tmp" "c:\Users\Admin\AppData\Local\Temp\xrns2koi\CSC436E1035C8E84B0B8B6497D04EBDBC.TMP"
    3⤵
    PID:3548
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN WinUpd_5d0856b5 /TR "C:\Users\Admin\AppData\Local\Temp\upd_7238437c\RuntimeBroker3E5E.exe" /SC ONCE /ST 00:00 /F /RL LIMITED
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1AC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1AC2.tmp
Size 1KB
SHA256 74a88432ade473fcc2128dca8d5112008fb82a69394bc7093c7a8f47454da2ed
MD5 a6bcd4c050141930443a39ed92dc075d
SHA1 7ef9929621d847d26edea7d240c5fcc91e6ce1ca
SHA512 9285d480deaa11aeb852943d272a911bd917473a3bbe76a3229fc65093a86c3f15fdda65d3f9353f1b2cec38c83e7f8bf5eb9185ecd87b91939e5cc2d6734302
TLSH
T1E0218C0543E94B1EF0B3473179F6532FA278FD68AFA1936A8541022D2861508EEB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

xrns2koi.dll

Path C:\Users\Admin\AppData\Local\Temp\xrns2koi\xrns2koi.dll
Size 4KB
SHA256 aca38d595e950b9287fae78233dbbc0f9a2505e1a3532647640088d6cefb7867
MD5 4b4f1160b098cff862dfa4ff6522701e
SHA1 f75e05dfd5fb71144bc40297c1bda2730dcaa85e
SHA512 536823ddd133680ec1ee31afdbb0326c641b914fab2934bb36e276c2e4cb432480f03d5503befcb7ace4c04ea27c929273f104e4514400ea4f3b51d4b22f289c
TLSH
T1B3812E0697E80557E4BB4B30BDF3538725F0E8848F73D76B1980922EADA11585E25FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC436E1035C8E84B0B8B6497D04EBDBC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xrns2koi\CSC436E1035C8E84B0B8B6497D04EBDBC.TMP
Size 652B
SHA256 7e466033ef468e995d1f0b8242d8f47c216d22ff9208e5bde333cabe86fc5020
MD5 0b983380f2e77eaad80509e28dadec3c
SHA1 301377c8f6e9b88b3e3596f686ed42abd2c91b03
SHA512 51ee136ea55b41cd1e15189a0fc1aadd68e27af55bae870044cf97a43c68b5391e7b7cae7b9e1ffee03583c316cc8cf604047fd254d5e6640ad7a7e3fc095c41
TLSH
T1FDF05E0963F8020EF0F34B30BDF6836391A8BC65DE3293ED1990031928649189972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xrns2koi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xrns2koi\xrns2koi.0.cs
Size 1KB
SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
MD5 83477799135bafaac2091086495e3785
SHA1 530abad3945b9560e700429ff24a2492da0d9e4c
SHA512 e12cb0be983dabe342cdf64d1320c34c9f394180a3a5d65e9ced71e483c81f36192854a23bdd4d40c9d509da6fe3ea1a12bfd4980652a00ff5f881d7bd952538
TLSH
T10F317C5E27A9E51060B63118EB02C0CBEE9289272E77852073ECAA154F72144D779F5F
MD5 SHA1 SHA512 TLSH

Submit Download

xrns2koi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xrns2koi\xrns2koi.cmdline
Size 369B
SHA256 bf2b4bd38fad363b153ec155e70b71045ff857f962981d2098e92078a84d0a95
MD5 c18af337d64136105322fb03891e4e73
SHA1 ce4236fbea086a4772535cdee61848e192562d55
SHA512 a342ec0b3ab5c3ddd0ea37f4f81b9c8dee96abf5cc25ceb2d1f24f069d24417e4fd988091118afe7d90359c41dbc47c23b0ac539c59b5ea2beed3c27f03aebe3
TLSH
T138E0682B4246CB7D22F9100B3269C4BD8AB286472A803FC4E080480EE03740027E1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2456-20-0x0000016570D30000-0x0000016570DE2000-memory.dmp

Download

memory/2456-25-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-9-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-10-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-11-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-12-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-13-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-14-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-15-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-18-0x0000016570D10000-0x0000016570D2E000-memory.dmp

Download

memory/2456-19-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-0-0x00007FF8998AF000-0x00007FF8998B0000-memory.dmp

Download

memory/2456-21-0x0000016570EF0000-0x0000016570EFA000-memory.dmp

Download

memory/2456-22-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-24-0x0000016571080000-0x00000165710A4000-memory.dmp

Download

memory/2456-8-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-23-0x0000016571080000-0x00000165710AA000-memory.dmp

Download

memory/2456-26-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-27-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-28-0x0000016571070000-0x0000016571084000-memory.dmp

Download

memory/2456-7-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-6-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-4-0x0000016570A40000-0x0000016570A62000-memory.dmp

Download

memory/2456-41-0x0000016570D20000-0x0000016570D28000-memory.dmp

Download

memory/2456-42-0x0000016571090000-0x00000165710B7000-memory.dmp

Download

memory/2456-5-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-1-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-45-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2456-48-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download