4625a9e4a54f759a755b5380685b797370173cd955cc148853a172602dfa79b0

Analysis

user interaction
yes
max time kernel
159s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 2KB
Sample260804-q1ycssyshy
SHA256 4625a9e4a54f759a755b5380685b797370173cd955cc148853a172602dfa79b0
MD5 9012e326698d4d2027da0e1cd97afad3
SHA1 998e79c819314e924a23eefc66596656c25e38d1
SHA512 8785e0294c5c5c06fee7589819bd698077fbeb197766a3bda80da218ba1a63c858b54cdfc5c4545d3d240b9eefd888c22c8ba03382f8070f5bc17650b47dd841
TLSH
T10F41651523667A0064A30909B9E6C4AFF7D7107B29BB0E04B9B9C1215FEB12C632E30E
MD5 SHA1 SHA512 TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 6 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6072	tasklist.exe
1264	tasklist.exe
2560	tasklist.exe
2892	tasklist.exe
2984	tasklist.exe
2200	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5212	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5212	PowerShell.exe
5212	PowerShell.exe
5760	powershell.exe
5760	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5212	PowerShell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	2200	tasklist.exe
Token: SeDebugPrivilege	6072	tasklist.exe
Token: SeDebugPrivilege	1264	tasklist.exe
Token: SeDebugPrivilege	2560	tasklist.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 2944	5212	PowerShell.exe	82
PID 2944 wrote to memory of 5280	2944	csc.exe	83
PID 5760 wrote to memory of 4336	5760	powershell.exe	89
PID 4336 wrote to memory of 2812	4336	csc.exe	90
PID 5760 wrote to memory of 2892	5760	powershell.exe	91
PID 5760 wrote to memory of 2044	5760	powershell.exe	93
PID 5760 wrote to memory of 2984	5760	powershell.exe	94
PID 5760 wrote to memory of 2200	5760	powershell.exe	95
PID 5760 wrote to memory of 6072	5760	powershell.exe	96
PID 5760 wrote to memory of 1264	5760	powershell.exe	97
PID 5760 wrote to memory of 2560	5760	powershell.exe	98

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\55v1pq3x\55v1pq3x.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B43.tmp" "c:\Users\Admin\AppData\Local\Temp\55v1pq3x\CSC4F678F87C064C4B82C6F4934A7B4238.TMP"
    3⤵
    PID:5280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2gktjrmp\2gktjrmp.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5058.tmp" "c:\Users\Admin\AppData\Local\Temp\2gktjrmp\CSC6F14320141FE48E290B752A9E249475.TMP"
    3⤵
    PID:2812
- C:\Windows\system32\tasklist.exe
  "C:\Windows\system32\tasklist.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\system32\findstr.exe
  "C:\Windows\system32\findstr.exe" powershell
  2⤵
  PID:2044
- C:\Windows\system32\tasklist.exe
  "C:\Windows\system32\tasklist.exe" /M /pid 5760
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\tasklist.exe
  "C:\Windows\system32\tasklist.exe" /?
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\tasklist.exe
  "C:\Windows\system32\tasklist.exe" /M AMSI
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6072
- C:\Windows\system32\tasklist.exe
  "C:\Windows\system32\tasklist.exe" /M AMSI*
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\system32\tasklist.exe
  "C:\Windows\system32\tasklist.exe" /M rpc*
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

2gktjrmp.dll

Path C:\Users\Admin\AppData\Local\Temp\2gktjrmp\2gktjrmp.dll
Size 3KB
SHA256 3510dffbc8a029849e4f428dc7ca3ae66f758c26059eb0c384605b7d645d0033
MD5 5aac2f582f0612b3a6050ebfae02fc1a
SHA1 d05f1200b55b30507332bf5c0989782a2938eea1
SHA512 6c2fd67d65de46f13657ab07db447135cedb940a3ac32f5140d53cf02f2701c7443ebec82f1643743ba9f5b76860b1c38531f08b4a4f440966feb615a6fb206c
TLSH
T19671010E97E4462BF0A607B4AEF3471677F4F8545A739B2E198442187CB11645D32BB2
MD5 SHA1 SHA512 TLSH

Submit Download

55v1pq3x.dll

Path C:\Users\Admin\AppData\Local\Temp\55v1pq3x\55v1pq3x.dll
Size 3KB
SHA256 b7086a109aa34582931a3cc7ba031e236cfa64f143a4a6d31d705541a9060c62
MD5 c0778504e18cdf66345de36b428ea58b
SHA1 7812623378ef304ca0499fb2e9658ba45608b9b0
SHA512 826552035e9e6fb616de0e1935c71cc7909a708219597897417cc5421cc31b1d711c733bf2e62e7fbbe58f10c2ccd60c560508062d8afbacc783321ef8f71da3
TLSH
T12071010A97E44627F0E60B716EF34717B6F4F8845B738B6E19984218ACB22245E31BA1
MD5 SHA1 SHA512 TLSH

Submit Download

RES5058.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5058.tmp
Size 1KB
SHA256 6a778f03167cb213295cb786b757d361e8508055089b6087933a5932b800fe36
MD5 8bbc0985ece4a1d0bd3b4f07256ce708
SHA1 27e97ffae89aba2759f507e5a1ad9f9d2018e5dd
SHA512 3e82e59895c5acf297630c592026050705ce44d28b1632cea204e5acb668ecb33a899da7a8918e497032a080e8c3e06477629b04b67977d9b43a58c506ae5dd9
TLSH
T14121890843ED4B1FF0778731A9F6032FA268FD64EFA2A35BC580522C2C51544EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8B43.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8B43.tmp
Size 1KB
SHA256 1deb0c221ac9c8f92e0306a69cfb26a6456a7092a142836a4f7cc5e6e9a8262f
MD5 d48afa0a2a6f2a92abc7c8bd04caced8
SHA1 d3c4ae301a8223f8017fe45f8ce56d64328892a9
SHA512 70878564c66d67746c7d6a2779415386a44ba9e6c65ee7126a24ab54f75a04ec1bc03e0537ee693ff728b1d1da7f28d50a3f57663e7a0ec9a1cd3f58662a9231
TLSH
T13D21EF0547EC4B1EF0B3473169F6572FA234FE94EFA2975B8500423C1C51104EEA0E76
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uwhtmirv.mh0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uwhtmirv.mh0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2gktjrmp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2gktjrmp\2gktjrmp.cmdline
Size 369B
SHA256 cb6acb76b209776e73352d0a4c5fbffa63e7d5f2266cbaa51eecf9ecfe22377e
MD5 a7c5380169ccf5a1bbccd6eb4ba06dd9
SHA1 2558b9f2e8b8f81c99719999f99ee5b828cdf976
SHA512 0317db00cd246f052557655160f53cee1f3d632d2f60c3ecb070228d13622c98a49b11d4b63682c7642b032fba98891e467697e6491bbea2fac2b64864c303da
TLSH
T1BCE06F2E426BC27D41E9102B32FBC8ACC6F28A832980BF84D443840DE027000ABD3783
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6F14320141FE48E290B752A9E249475.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2gktjrmp\CSC6F14320141FE48E290B752A9E249475.TMP
Size 652B
SHA256 571e2df8539e59d7d0fa5c5561309d3414c917df2ccbe3bd83df0db06dc559f9
MD5 b6f9c61754a5f5f00000c68710b242c6
SHA1 700a249f061f4bd932494b99efce3424137085f2
SHA512 7dced6f5d3c5729d06530d7db0a074fd5ea7e918334c765d2b33c8472eddec59b0c494a4146da64a02e6e72bea66cfa6c16065e9da90149510bd6f1a00756746
TLSH
T1C4F05E1963F8020EF0F74B70BEF643A391A8BC65DE32A3ED5480031D28645149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

55v1pq3x.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\55v1pq3x\55v1pq3x.0.cs
Size 837B
SHA256 ee71ffdc840f67f2c62da61632ef8efc328af1a2eda6a88ee647fb74c9cdce75
MD5 9586d398aea5eef99273949c5c53905b
SHA1 1daa7e0ecacd41141d6bc6b019956c7dead2713b
SHA512 99b6a7b5040addbde0452bcd840d493dbf017bc27b5fcef734b6cc4283ee79e7e75515ea2c6c60c498f41739e1b19c65ba5dd1fde04e47049c6781fc15eec056
TLSH
T1A401265C6321FE15A8A3481DA8D6C4ADF34B10B326BA1A0472FC43124FB7059833A76E
MD5 SHA1 SHA512 TLSH

Submit Download

55v1pq3x.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\55v1pq3x\55v1pq3x.cmdline
Size 369B
SHA256 5abb179016aa17c0e3ac3cb43f737b9e5ebd8a9d4e323b09e58bfee971720265
MD5 92a98d3958f9a254aeba0964e9990024
SHA1 589cb3086f560dacd94420a7c740dd6e770d0c67
SHA512 71733c849278117ba4f0c6fae04cba37294c3d00dcae5a8d4056428e9167d1917c449cf98d7c46157b2712fc9fc9da3f7f0e979765c5fb4bc682b5015cf8e25f
TLSH
T193E0C03B4246CA7D33DD10072969DABCC2720B433940BF84D250443DD25780867D1761
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4F678F87C064C4B82C6F4934A7B4238.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\55v1pq3x\CSC4F678F87C064C4B82C6F4934A7B4238.TMP
Size 652B
SHA256 c2059d8896da82fb1a71cdfdf15f5ad54646286516050fe3aeffb4619645dd22
MD5 47128ae15c6bd67e03a9a669a651fb73
SHA1 32e9edccf5c81a6090902f7f9f764d1f4a676c1d
SHA512 fa1737d456faf9be77d17963cd74e207378da4f7848b89a102e921393ffba0fa5d639288856bee13159ff7484b40e1e5f5a488bdce47f419a22fd2ce6c4eeaae
TLSH
T117F05E0963F8420EF0F34F31BEF64363D1A8BDA5DE7293ED144143292864520C962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4336-67-0x0000019C1D1D0000-0x0000019C1DC92000-memory.dmp

Download

memory/5212-21-0x000001FDE9D80000-0x000001FDE9D88000-memory.dmp

Download

memory/5212-22-0x000001FDE9D90000-0x000001FDE9D91000-memory.dmp

Download

memory/5212-1-0x000001FDCE2C0000-0x000001FDCE2E2000-memory.dmp

Download

memory/5212-8-0x000001FDCE160000-0x000001FDCE170000-memory.dmp

Download

memory/5212-0-0x000001FDCE160000-0x000001FDCE170000-memory.dmp

Download

memory/5760-50-0x000001BAB6E60000-0x000001BAB6E7C000-memory.dmp

Download

memory/5760-70-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-35-0x000001BAB6E80000-0x000001BAB6EF6000-memory.dmp

Download

memory/5760-51-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-53-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-34-0x000001BAB6DB0000-0x000001BAB6DF6000-memory.dmp

Download

memory/5760-48-0x000001BAB6F00000-0x000001BAB6FB3000-memory.dmp

Download

memory/5760-47-0x000001BAB6E20000-0x000001BAB6E3C000-memory.dmp

Download

memory/5760-38-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-69-0x000001BA99DB0000-0x000001BA99DB8000-memory.dmp

Download

memory/5760-36-0x000001BAB6E00000-0x000001BAB6E1E000-memory.dmp

Download

memory/5760-49-0x000001BAB49C0000-0x000001BAB49CA000-memory.dmp

Download

memory/5760-71-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-73-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-74-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-75-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-77-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-79-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-81-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-83-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download

memory/5760-86-0x000001BA9BB10000-0x000001BA9C5D2000-memory.dmp

Download