61c2e0e293226e87c9d149b2304799c064b83051e70e41e1a305159621a0196c

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readjustService.ps1
Size 23KB
Sample260804-h2zy1sfa87
SHA256 61c2e0e293226e87c9d149b2304799c064b83051e70e41e1a305159621a0196c
MD5 5bd7ee9dec279d1932c3af0473c4dba5
SHA1 2af3b111d0333e716f2f9a31042f64f2acd0d333
SHA512 59d442e83c83cf632b27d9043f1248b002bf46beaf3ebd8af2f1b72cec65d8b56ce1d922d377d4da71a176f87a67cd77dee2b37ac97cce899007655a01ffb4af
SSDEEP 384:bxslEuM3NtqpQsfj38y0rr+Yw3plKTlSgSb:bxUpQ0zFcri3n6lSgc
TLSH
T1E8B272146D4099268BF267289489C57CEF23A1333DA71650F9FC15806FA6424CBBEF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\WindowsPowerShell\v1.0\WinRing0x64.sys	powershell.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\WinRing0x64.sys	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1732	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	powershell.exe
1732	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3040	1732	powershell.exe	88
PID 3040 wrote to memory of 2104	3040	csc.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\readjustService.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n2si0cvo\n2si0cvo.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EFF.tmp" "c:\Users\Admin\AppData\Local\Temp\n2si0cvo\CSCD90CADF45CC14EA08CBC2885C89283E3.TMP"
    3⤵
    PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7EFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7EFF.tmp
Size 1KB
SHA256 480dbd724c08d5f073150cfd25f1c95fceeaf967b3b3f74d082a07934da073d1
MD5 3132eda56a86c27c252977464c870d45
SHA1 31648a556a82e686794508da18e9f01169efc75d
SHA512 1a0debc1492ce7f1da059a3178769f5babec25fbb90ea3c85f16731dc486bd9098a74e89b91850cb6a435634660ac1c0635b2e34340570a93356e7395ed298cd
TLSH
T13F21660583E84B0EF0B75B3279F6072FA274FDA4EF62A79B8540422D1851544EEA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_up3ybrx0.gbf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_up3ybrx0.gbf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

n2si0cvo.dll

Path C:\Users\Admin\AppData\Local\Temp\n2si0cvo\n2si0cvo.dll
Size 6KB
SHA256 ec771ecadfb8d4de57b821fc3aa6496d55850fa1287cb2c54ac1c6e99795c9db
MD5 1c491e4b49a93463e28d0907d64a33cd
SHA1 378480b1f3c0d6678eac0a2820fa74c255ea42c6
SHA512 bee727252d0c532952ebeba262e05d5c52cb4a1472a0881256b566cde6fc541a285825b074f103992bd081b21d1b5dc7c4f79162baae8dc399093267d98d2d82
SSDEEP 96:xue4758hLHL0EawjubPkAw63VRdN+vzaK:TY89HL0Eawj8w63VYT
TLSH
T1B3D10F1EBF8CC93EC476023455B30F1881F0F689B5929767ABAE511C9CFF58885E1AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCD90CADF45CC14EA08CBC2885C89283E3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\n2si0cvo\CSCD90CADF45CC14EA08CBC2885C89283E3.TMP
Size 652B
SHA256 ce0eb688dc5184cedb545c14ccf02a240905adff516c786688b0e29b9b0b64d6
MD5 512e5b5d1e38340befc05b6d0a782e14
SHA1 752484cb7e2dbd51e924dff9671de321380d881d
SHA512 8fdc093baf7709bdb426a9f7bec64087e32df932da287191540512c6e27a62720c8a5455605aa93427618a45e8890bcc31abcf9b8e3b88c0dea8daa93a4ff80d
TLSH
T189F05E09A3F8020EF0F78F31BEF6436795A8BC64DE3293ED5584031968649209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

n2si0cvo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\n2si0cvo\n2si0cvo.0.cs
Size 6KB
SHA256 a880aba85837c89c2130739707448814120940bc031ae04ab29c8f85efaca14c
MD5 f3d00934a25d9c1f3dfcfba1d29aec3f
SHA1 c2fd14ad752cdc856f1041845c1e0916d71885c2
SHA512 449d6bd21e56cfef4636569c64e5a92caf9cd7786cfa15408a05f0a5268d43e70585797555204bac3094cd6795a4b41e32d3d18133fe4a3d31249414149e1114
SSDEEP 96:JjMKKRMmrkkSnAKFNdJx55TjV9jqpszdf:8RMjAWNtqpsJf
TLSH
T132D193682940EA3594E28E48D0CCC6FEE313E17136E72B5056F81B60AF5707591FFA7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n2si0cvo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\n2si0cvo\n2si0cvo.cmdline
Size 369B
SHA256 54aa68f6ba0bc8234bb018fbae9eb2b447bac064972c2554baf2d60d8e3bd810
MD5 fbbafb71ce01c68e564e44636175f27b
SHA1 bc1c95c462f02f53ba6a2363a63ea410d3bee6bd
SHA512 f44d258c3bb8ba2c3c98f06e0e2b8dc5a0f0674cef461175f97007c6e018b84b2b818f72027fab1a7766ca4db6cd57973123f425ea4921f5c1b7e412055f31e2
TLSH
T100E0D86A9296C67D55D9100F31AAD5ACD2B2064B69417F845150885DE01B80467F1797
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1732-1-0x0000029377EB0000-0x0000029377EC0000-memory.dmp

Download

memory/1732-0-0x0000029377EB0000-0x0000029377EC0000-memory.dmp

Download

memory/1732-9-0x0000029377E70000-0x0000029377E92000-memory.dmp

Download

memory/1732-22-0x0000029377EA0000-0x0000029377EA8000-memory.dmp

Download

memory/1732-24-0x0000029377EB0000-0x0000029377EC0000-memory.dmp

Download