cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vcapcha.ps1
Size 5KB
Sample260804-pdkyhsag56
SHA256 cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0
MD5 c5d6a8a08926ee691de9099ea9f1bee7
SHA1 511c169fb4280d15a17a684d34c0e0cb9735f384
SHA512 5acfb6b6b7fafc8514cd077d3c32f4763362d55198821349f3c02b36896d6341f73454134b908cffd27b8dadbe13102bca1d74f1064657a283f5dec352c24a6d
SSDEEP 96:MszjtwZxHpMmQ38hFfPv1Cc6NEjivm8hEVzCTrvw2OXpDCfS:/yZZpMmQsh1wc6PF8zCX0XpWS
TLSH
T16FB131116D0085D5C3E34A2BD8D3E346BBA5217F52886E84B45CC6C1BFE372DCB1A69A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2736	powershell.exe
8	2736	powershell.exe
12	2736	powershell.exe
13	2736	powershell.exe
17	2736	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2736	powershell.exe
2736	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 4400	2736	powershell.exe	89
PID 4400 wrote to memory of 2640	4400	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\vcapcha.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3j01gwpr\3j01gwpr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E3.tmp" "c:\Users\Admin\AppData\Local\Temp\3j01gwpr\CSC4B0BB4DBB2D54F15B085B8EA6841692.TMP"
    3⤵
    PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3j01gwpr.dll

Path C:\Users\Admin\AppData\Local\Temp\3j01gwpr\3j01gwpr.dll
Size 3KB
SHA256 6ddc202f8df5b2680332c1adbad30a7000196c4da1f992a3e7217722950aed37
MD5 80880e2afe170f91630f68f0447b4398
SHA1 b663ed04778ffd0ba8ef071739bfd30d30bf5816
SHA512 372d1442400f5ff1c2415321cda83ee0609937dfc363e7698eec5c0d21502a40c503950085715e91cb5f395bf4125f1fc558efb145ff7c981e2e8bb28b2d152f
TLSH
T15351DC1663E8466BF4B707306EE3036323B9F8609FB3936958804228AC616149E71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES3E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3E3.tmp
Size 1KB
SHA256 6fe81b8a32dc3bfefe12d5dacb34726ac4cf0ba59c05bfd8a57bb61d5b77d422
MD5 67a2e14a738bf456f9f9846e36d125c4
SHA1 5673118d74ff61e829bc02516112da5d7888677c
SHA512 a7a6db0f216cee5ce5790e35b5abbfcdfadd0b8b08e8d4e5ffc263ef300974217d948a0c6136f2a78c03ff0d53d60b57bac29cc4d1710d28c9f9ddbb2dc651cc
TLSH
T1BB21AB0593E94B1FF0B74731A9FA132FA278FD65EF6357AB9540422C2C51504EEA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mnbydv04.rvt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mnbydv04.rvt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3j01gwpr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3j01gwpr\3j01gwpr.0.cs
Size 177B
SHA256 e3d5c0bb3146b61aa9a3bb51c6fa8c6863ede91e2cd3ab1588be56aec2ee6ffb
MD5 2b7e6be4f4d823f63bd7d0b952cc73d4
SHA1 9fa479a7d7785134aa75dc2ede13b868c44a7668
SHA512 68937c3c2b6aa97c1124b18237e53a8f71bd6c7871675dbf1348c0670f98ec73502fe9ee7d587b688e45a269eed5ff57417bf707de471ce4ae4f7a04bab971e1
TLSH
T193C0801476E359F1000744170C42F1EDB727533926AD2904A7990310DF5F00E5230F59
MD5 SHA1 SHA512 TLSH

Submit Download

3j01gwpr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3j01gwpr\3j01gwpr.cmdline
Size 369B
SHA256 cf83f5ab6171ac79a30621370cf472c0941c7a77af9b47b839f5af493b598fcd
MD5 e049fbc668a153ed05e47a1346fbaba4
SHA1 9543208fb5bb591f67c3919cfc739dc9cf880ec8
SHA512 d0027de9c81ef9074c4dfba4f9f8360120658169d83a4bd69890628c606369dc445f3a39eb47344e6f7a21b00a351bbe464cbbc7f48b0f0ee06248ae170aff6a
TLSH
T16AE0683E7256C27D01DD542721F9C4ACA2B206C729803F885041C40DF097000EBD1771
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4B0BB4DBB2D54F15B085B8EA6841692.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3j01gwpr\CSC4B0BB4DBB2D54F15B085B8EA6841692.TMP
Size 652B
SHA256 bbe3515d0dd41380d01e6fc022027ec67670fa4df933305d7ae0cafbc7510432
MD5 196ee109ae0228c9e778d169dc9c017b
SHA1 2e44e79345163c73e0998af60a8fc787e43a386c
SHA512 cdb6b63637da678543afb6c06ac35025930b05d7f6e3109db18050d8f57a8e6edeff38c9a6bf8508ac5c3ea7cba2804e763df8f9f4319f81965ca7eb46cf0085
TLSH
T1A1F03A0963F8420EF0F34B30BDF6436391A8BC75DE3293ED249003592864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2736-10-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-12-0x0000026A3C610000-0x0000026A3CB38000-memory.dmp

Download

memory/2736-11-0x0000026A3BF10000-0x0000026A3C0D2000-memory.dmp

Download

memory/2736-0-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-8-0x0000026A3B990000-0x0000026A3B9B2000-memory.dmp

Download

memory/2736-1-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-25-0x0000026A21270000-0x0000026A21278000-memory.dmp

Download

memory/2736-29-0x0000026A3BC40000-0x0000026A3BC4A000-memory.dmp

Download

memory/2736-30-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-33-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-34-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-35-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download

memory/2736-42-0x0000026A39810000-0x0000026A39820000-memory.dmp

Download