2138319d8986a48b6bcdc941d21f563ada1fe51d419ffcc21b5996440338241b

Analysis

user interaction
yes
max time kernel
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apagar_pantalla.ps1
Size 181B
Sample260802-de9sgscc39
SHA256 2138319d8986a48b6bcdc941d21f563ada1fe51d419ffcc21b5996440338241b
MD5 6637152556dee87524cfa9a180ae424f
SHA1 e0c44b4e6f602c30fbe357b6c2a01f4105222b83
SHA512 0a52b62a5fcb393c774687886b6a0397b4ba375d82f2808a5e303da1fe7c55f6773c508f0568923f4fcd699dc924ec26915d7a82a8bfd54b52e2032939dce48c
TLSH
T1C4C08020A951784C5593520CFC48A4757515F0DD33E63521C55DD733AF27CD45531334
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5588	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5588	PowerShell.exe
5588	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5588	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 3716	5588	PowerShell.exe	90
PID 3716 wrote to memory of 2864	3716	csc.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\apagar_pantalla.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ech4av3d\ech4av3d.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F8D.tmp" "c:\Users\Admin\AppData\Local\Temp\ech4av3d\CSC129BA631E7AE44439EAD19B1969956B.TMP"
    3⤵
    PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4F8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4F8D.tmp
Size 1KB
SHA256 9231b219fa3149bd326cfef9aa287b9d84a06651248d1780277a34b3352d3ca6
MD5 30471c142165cfeac8db52b37d5af894
SHA1 260cbbacd70cfd47e3e59deb161ab781a7111c28
SHA512 5fa66291e722e136042ef5bd9000bf741149fc8b983c77d13c4c09360b16e0018170c21bf5743899f10c1325ea362bacc4ae744cc928ec7f4787a3305bd5ccd5
TLSH
T13521AB0593E8472FF0734732A9F6432F9674FDA4EFA2939A9540822D2C41604EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

ech4av3d.dll

Path C:\Users\Admin\AppData\Local\Temp\ech4av3d\ech4av3d.dll
Size 3KB
SHA256 121739595c715c5e22ccc797d42bfb27b3d80a4c758c97d862bfc2943630c943
MD5 a7fa9bfc22575b0d235bb77699dff9d5
SHA1 2c85171542504567ff6ff85c0633b2954989e9bd
SHA512 deebe1fcf6afd0ba5c60e06116501c3740a9977bdce012afde85d48b5eb3d9a364fddfbcf2e4aae00c0b6161a53abcd92180231888fdc5ba84d9a1fda34e42dd
TLSH
T1EB51CA1AA3E8466BE47707346EF3432A67B4F8909B72A35E498042299C207586D71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC129BA631E7AE44439EAD19B1969956B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ech4av3d\CSC129BA631E7AE44439EAD19B1969956B.TMP
Size 652B
SHA256 550a9e6ec7206a6957bb3230cc006b44eac90527edf06e93cb3d831fa36b3131
MD5 70cbe669e0bfd08ff251b60a921d3e0d
SHA1 3c583e992b45f009217f099a6ae4f4413a4535ac
SHA512 cc2142727cf83078e324530b6f1f6b6763e6251a7bced2b3aa32f33b02429527a4f4a5d2749dd39f44869eea8a5235c528e0494b2c70228787f50e88c396127e
TLSH
T1F6F05E0963F8520EF0F34B71BDF643A395A9BCA5DE3293ED144043292C64A1099B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ech4av3d.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ech4av3d\ech4av3d.0.cs
Size 216B
SHA256 ebb50dfebe7a75234288244db8cadac8b122cbb4752da52c5db4f300b80f8e9d
MD5 a96ac6468e92aa2799dda2f4a255653a
SHA1 d0c24e63521e0c5d27858a030b36a6cd0c56492d
SHA512 9b2780e05b68b335de7fd8989722f0411212efd559753ff56507197364dbff16f88dc6071f9e39703e094b48abb9f7052727653a40bd81950d33aad4cb6dd317
TLSH
T1C7D0231467F77D5C404301095C08A4797723D00733DE3D01B59D0331CF8B4445431B2D
MD5 SHA1 SHA512 TLSH

Submit Download

ech4av3d.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ech4av3d\ech4av3d.cmdline
Size 369B
SHA256 ed223a08f96a96a8c7d9abae7af4e9621f2c74bdc5821ead5fc3bc0b8bc8c9a5
MD5 6096015f1d3d61519467f0777b909fad
SHA1 4bb565da11be7fb41218399fb12b289d1de61d6d
SHA512 f9b03aed29a2871084cddd61f86dedfdcbe58b48a1d289854aed7abd2625e65bf354cf49e7e5c63896ea6e398fed8120bf73786949ab2962836857d99b8b7441
TLSH
T1A3E0682A6356CB7E11DD201731EBC4ACC2B216432948BF845090880ED01700A27D1BC1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5588-10-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-17-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-9-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-0-0x00007FFA7AA9F000-0x00007FFA7AAA0000-memory.dmp

Download

memory/5588-11-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-7-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-6-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-8-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-5-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-25-0x00000215B4380000-0x00000215B4388000-memory.dmp

Download

memory/5588-1-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-4-0x00000215B4390000-0x00000215B43B2000-memory.dmp

Download

memory/5588-26-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/5588-28-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download