2138319d8986a48b6bcdc941d21f563ada1fe51d419ffcc21b5996440338241b

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apagar_pantalla.ps1
Size 181B
Sample260802-de9sgscc39
SHA256 2138319d8986a48b6bcdc941d21f563ada1fe51d419ffcc21b5996440338241b
MD5 6637152556dee87524cfa9a180ae424f
SHA1 e0c44b4e6f602c30fbe357b6c2a01f4105222b83
SHA512 0a52b62a5fcb393c774687886b6a0397b4ba375d82f2808a5e303da1fe7c55f6773c508f0568923f4fcd699dc924ec26915d7a82a8bfd54b52e2032939dce48c
TLSH
T1C4C08020A951784C5593520CFC48A4757515F0DD33E63521C55DD733AF27CD45531334
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	powershell.exe
4600	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3300	4600	powershell.exe	85
PID 3300 wrote to memory of 4136	3300	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\apagar_pantalla.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tqlzgcdx\tqlzgcdx.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB6E.tmp" "c:\Users\Admin\AppData\Local\Temp\tqlzgcdx\CSCE4546A4A10F243929362F7FA5068E874.TMP"
    3⤵
    PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESAB6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAB6E.tmp
Size 1KB
SHA256 29724e787e4328113939e02bcf87b1d6f4f0ae451c1aef695c49523cf3e23fd1
MD5 810c821e31d7dbaaa911f8c7e185069a
SHA1 268a17acfca9e8acc5596480c5392f550d513449
SHA512 b6d9554bbc656da715222a8e9f8cd8986a1252449970820164dbbadf34d8315410951a59aac1eb44d3e3248a793b310978cdbb1c2444acca4da7d73155597ded
TLSH
T1FD21CC0183E94B1FF07307326DF6236BA238FD95AF62A75B8540012C1C51604EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_psxq12oa.mhp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_psxq12oa.mhp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tqlzgcdx.dll

Path C:\Users\Admin\AppData\Local\Temp\tqlzgcdx\tqlzgcdx.dll
Size 3KB
SHA256 2cff4d7552975d6582e455d84dc8c147575303a316f314ddbdd604a8d89a3a28
MD5 b10e810354c79efb000e7e3e39027c12
SHA1 0ff73454683c858a24e8401afd5d68a5bf148d50
SHA512 451d16b40225e1b20baa3c654db89eb8062073e8d8fb30630885d08dbd99a2e92f7a229fc93abab12b4595cb34d3202cc9e8180aeecb56bed35a5c4b594f3d6e
TLSH
T19851DC1BA3E846ABE47707307EF3432B37B4F8509B72A36D598402289C207586E71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE4546A4A10F243929362F7FA5068E874.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tqlzgcdx\CSCE4546A4A10F243929362F7FA5068E874.TMP
Size 652B
SHA256 7f846eba9402bb446f03d05e84306f838fb57ff22180e0048a0831ec2202fd93
MD5 b6571f7b8f855cc2acaa2991e054291c
SHA1 c53f4eed255f8be920d9421a7001643da95a8d36
SHA512 5fac0ab7a7961a03737ad68b27bead4f2f00f9c4af3b0f2b24867d7dec97a33b5557dedf54a50dc36caa017256ea2634cc0588cd398e87c2f4a0dc76886f38e5
TLSH
T181F0824963F8420EF0F34B31BDF653A395A8FC65DE3293ED5440031D2C64A149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tqlzgcdx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tqlzgcdx\tqlzgcdx.0.cs
Size 216B
SHA256 ebb50dfebe7a75234288244db8cadac8b122cbb4752da52c5db4f300b80f8e9d
MD5 a96ac6468e92aa2799dda2f4a255653a
SHA1 d0c24e63521e0c5d27858a030b36a6cd0c56492d
SHA512 9b2780e05b68b335de7fd8989722f0411212efd559753ff56507197364dbff16f88dc6071f9e39703e094b48abb9f7052727653a40bd81950d33aad4cb6dd317
TLSH
T1C7D0231467F77D5C404301095C08A4797723D00733DE3D01B59D0331CF8B4445431B2D
MD5 SHA1 SHA512 TLSH

Submit Download

tqlzgcdx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tqlzgcdx\tqlzgcdx.cmdline
Size 369B
SHA256 719b2ac262a694e26ea5389323f928104e0ea335f88c600e7cffafa71b229f02
MD5 141e1b531fbc10903974999d03a43a49
SHA1 eadd2f822da438ebbd16c38704f41afe9436b564
SHA512 324efef4e1d5c961e4c9e537c8fe3167c5a845aaa45c34b8c30e43f75713cd18c26bdf2ccad592d930f615db1fc5c330c6aa30a79ba465193aac8f72c65622cb
TLSH
T18AE0682E8286C6BD19ED101F296BC4ACA272164339483FC4606A446ED83720067D1752
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4600-1-0x00000154E2040000-0x00000154E2050000-memory.dmp

Download

memory/4600-0-0x00000154E2040000-0x00000154E2050000-memory.dmp

Download

memory/4600-7-0x00000154E1FF0000-0x00000154E2012000-memory.dmp

Download

memory/4600-22-0x00000154C9B90000-0x00000154C9B98000-memory.dmp

Download