151d63ab75ccab7b44fc0cea954e15e8a61a4d061c6dbea08e5477eca8798b3d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ijfcdbhjnidefarpgjbiuearhjgui9wehj38725yhfeehj.ps1
Size 7KB
Sample260729-phqdsstfja
SHA256 151d63ab75ccab7b44fc0cea954e15e8a61a4d061c6dbea08e5477eca8798b3d
MD5 2ae8d883969e88dc4f6d9303caf08dbe
SHA1 92be3872a98c04e6b3bee275913ce690ff007dd0
SHA512 8534d351f42fe5a64148e80cfb76d54e6ac03835a2e3f1830ae1eba1c04ec1d431ff8325051e8b0ff067a3a737472fc01e6162fcaf5324b7d0fd40790bbd14eb
SSDEEP 192:HMH8ztvvl788mDFoMB0oKt4JoGAWUDtBFHGFTbrch:scZvvK8YoMB0YQFmpch
TLSH
T149F17D1A7F0BC5FC55D4543878B2F826C992532930812C0EB562CBC78B099B2A4FB1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	2744	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2812	PowerShell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	PowerShell.exe
2812	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2812	PowerShell.exe
Token: SeSecurityPrivilege	2812	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2812	PowerShell.exe
Token: SeLoadDriverPrivilege	2812	PowerShell.exe
Token: SeSystemProfilePrivilege	2812	PowerShell.exe
Token: SeSystemtimePrivilege	2812	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2812	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2812	PowerShell.exe
Token: SeCreatePagefilePrivilege	2812	PowerShell.exe
Token: SeBackupPrivilege	2812	PowerShell.exe
Token: SeRestorePrivilege	2812	PowerShell.exe
Token: SeShutdownPrivilege	2812	PowerShell.exe
Token: SeDebugPrivilege	2812	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2812	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2812	PowerShell.exe
Token: SeUndockPrivilege	2812	PowerShell.exe
Token: SeManageVolumePrivilege	2812	PowerShell.exe
Token: 33	2812	PowerShell.exe
Token: 34	2812	PowerShell.exe
Token: 35	2812	PowerShell.exe
Token: 36	2812	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2812	PowerShell.exe
Token: SeSecurityPrivilege	2812	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2812	PowerShell.exe
Token: SeLoadDriverPrivilege	2812	PowerShell.exe
Token: SeSystemProfilePrivilege	2812	PowerShell.exe
Token: SeSystemtimePrivilege	2812	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2812	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2812	PowerShell.exe
Token: SeCreatePagefilePrivilege	2812	PowerShell.exe
Token: SeBackupPrivilege	2812	PowerShell.exe
Token: SeRestorePrivilege	2812	PowerShell.exe
Token: SeShutdownPrivilege	2812	PowerShell.exe
Token: SeDebugPrivilege	2812	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2812	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2812	PowerShell.exe
Token: SeUndockPrivilege	2812	PowerShell.exe
Token: SeManageVolumePrivilege	2812	PowerShell.exe
Token: 33	2812	PowerShell.exe
Token: 34	2812	PowerShell.exe
Token: 35	2812	PowerShell.exe
Token: 36	2812	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2812	PowerShell.exe
Token: SeSecurityPrivilege	2812	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2812	PowerShell.exe
Token: SeLoadDriverPrivilege	2812	PowerShell.exe
Token: SeSystemProfilePrivilege	2812	PowerShell.exe
Token: SeSystemtimePrivilege	2812	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2812	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2812	PowerShell.exe
Token: SeCreatePagefilePrivilege	2812	PowerShell.exe
Token: SeBackupPrivilege	2812	PowerShell.exe
Token: SeRestorePrivilege	2812	PowerShell.exe
Token: SeShutdownPrivilege	2812	PowerShell.exe
Token: SeDebugPrivilege	2812	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2812	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2812	PowerShell.exe
Token: SeUndockPrivilege	2812	PowerShell.exe
Token: SeManageVolumePrivilege	2812	PowerShell.exe
Token: 33	2812	PowerShell.exe
Token: 34	2812	PowerShell.exe
Token: 35	2812	PowerShell.exe
Token: 36	2812	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 5448	2812	PowerShell.exe	91
PID 5448 wrote to memory of 4136	5448	csc.exe	92
PID 2812 wrote to memory of 3876	2812	PowerShell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ijfcdbhjnidefarpgjbiuearhjgui9wehj38725yhfeehj.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h2lc3b2s\h2lc3b2s.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF076.tmp" "c:\Users\Admin\AppData\Local\Temp\h2lc3b2s\CSC7D9320AB81C24ED485D19CE914970A.TMP"
    3⤵
    PID:4136
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN WinUpd_3dee738c /TR "C:\Users\Admin\AppData\Local\Temp\upd_79e86245\RuntimeBroker522D.exe" /SC ONCE /ST 00:00 /F /RL LIMITED
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESF076.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF076.tmp
Size 1KB
SHA256 1bfbf53bb61c225aac067a465635d4c59c0bb05476dd33320a20a17e425406d7
MD5 2aee04fd63db520aaafe6023a3c714e9
SHA1 0875bacbf9a7eadbe81f0a36e211358e5bfdfd7e
SHA512 479a3f54f3c58f269beb783205d637bdbcf8254c94508d1ed936ee3346bb23891826c6751818f6af3db001c86c592f33591dae23920d8e82a6c43399b4a3da76
TLSH
T1CE216A0993E8470FF0738B327AF5172F9574FD64EFA2A75B858042282C51544EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

h2lc3b2s.dll

Path C:\Users\Admin\AppData\Local\Temp\h2lc3b2s\h2lc3b2s.dll
Size 4KB
SHA256 37fd2e333e4fcd99a4ebfb7f2aaedc921681297a7b06f8c9a790363c89a2c7a5
MD5 405f10782def4221c163d501bc3c389b
SHA1 78c243aab7db1d1600ba0dca8f3ed0126f631492
SHA512 88943240d6688031c52fc3c1fa2eb870971871e23003513c70b2255969d61b5a9f32a418778e35bcca20915c64774339fa29acffc673cb7f59a8e8215600a643
TLSH
T15B81210697E80557E4BB4B30BDF3538725F0E8808F73D76B1880922EBDA52685E25B72
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7D9320AB81C24ED485D19CE914970A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\h2lc3b2s\CSC7D9320AB81C24ED485D19CE914970A.TMP
Size 652B
SHA256 04a89d344a55a1e0afd7a7a3d970b6b29b56633bbba9c8d1f32baafbd652b1f0
MD5 d302fcf6bbf7aa63e1db80e772e1c927
SHA1 c842bad6f3c50d5034fe2d8562852f735f263064
SHA512 7cc4ec8678f1ead59f68d99038727f6275882bc4c3ba4c7b5639a9edc2867a594786e731833f77330b9f8ef09a0c9a4e81a0c52bc46a5e56bfbda8d7f82334c1
TLSH
T1F1F05409A3F8020EF0F38B30BDF543A395A8BC65DE7253ED5480431958649109971F71
MD5 SHA1 SHA512 TLSH

Submit Download

h2lc3b2s.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\h2lc3b2s\h2lc3b2s.0.cs
Size 1KB
SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
MD5 83477799135bafaac2091086495e3785
SHA1 530abad3945b9560e700429ff24a2492da0d9e4c
SHA512 e12cb0be983dabe342cdf64d1320c34c9f394180a3a5d65e9ced71e483c81f36192854a23bdd4d40c9d509da6fe3ea1a12bfd4980652a00ff5f881d7bd952538
TLSH
T10F317C5E27A9E51060B63118EB02C0CBEE9289272E77852073ECAA154F72144D779F5F
MD5 SHA1 SHA512 TLSH

Submit Download

h2lc3b2s.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\h2lc3b2s\h2lc3b2s.cmdline
Size 369B
SHA256 5cdf0c5019ced727eb3639ddab865d6770ef0b4e693a9349214c420a3b799ed4
MD5 2b758005d7ba91b7692dfe48108c5ff4
SHA1 545fc2e7f6da8cdbe313fa4261fd8ea6c239aa27
SHA512 29de26ba4f2693612ced12f606fd0398c121f47d63c2dc6298719831d74d9d2de87483c27090f9606cc8bc32c17042286fcdabf940fdb3ff79c92177e1f04851
TLSH
T1EAE0202A52DEC67D19DF100725EAF5ACC272074739417FC955D04F5DF01710867D2755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-21-0x0000012420CE0000-0x0000012420D04000-memory.dmp

Download

memory/2812-22-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-9-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-10-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-11-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-12-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-13-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-14-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-17-0x0000012420870000-0x000001242088E000-memory.dmp

Download

memory/2812-18-0x0000012420AD0000-0x0000012420B82000-memory.dmp

Download

memory/2812-19-0x0000012420860000-0x000001242086A000-memory.dmp

Download

memory/2812-0-0x00007FFD8D74F000-0x00007FFD8D750000-memory.dmp

Download

memory/2812-20-0x0000012420CE0000-0x0000012420D0A000-memory.dmp

Download

memory/2812-8-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-23-0x0000012420890000-0x00000124208A4000-memory.dmp

Download

memory/2812-7-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-6-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-3-0x00000124207C0000-0x00000124207E2000-memory.dmp

Download

memory/2812-37-0x0000012420DE0000-0x0000012420E07000-memory.dmp

Download

memory/2812-36-0x0000012420870000-0x0000012420878000-memory.dmp

Download

memory/2812-2-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-1-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-38-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-39-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-41-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-42-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-43-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/2812-48-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download