cd17c6b555f761d60373659824bf805e1510538226e4c7028e19d7494937a333

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootstrap.ps1
Size 3KB
Sample260805-plbptaah46
SHA256 cd17c6b555f761d60373659824bf805e1510538226e4c7028e19d7494937a333
MD5 bcdb5ddf3b60a9cfa8f0d8803552a0dc
SHA1 b0be54fbb7d8f977763edbb84e373c3cc568c05b
SHA512 0418723fc6107785bab6cf6e831b91b25ddd5e301b17466a09682b820394b47d4b2c1123b3aedc96e407bddb4cf98248aaaea80118b5d16857f4ebf1fa3d0308
TLSH
T13961441B4371427251A1130295CFB246B3A140BF8A4D6E2479ED9704BF96A3CDBE37B7
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5028	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	claude-2.1.222-win32-x64.exe

Executes dropped EXE 1 IoCs

pid	Process
784	claude-2.1.222-win32-x64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5028	powershell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4056	reg.exe
3636	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	powershell.exe
5028	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 784	5028	powershell.exe	90
PID 784 wrote to memory of 4056	784	claude-2.1.222-win32-x64.exe	91
PID 784 wrote to memory of 3636	784	claude-2.1.222-win32-x64.exe	92
PID 784 wrote to memory of 4956	784	claude-2.1.222-win32-x64.exe	96
PID 784 wrote to memory of 3352	784	claude-2.1.222-win32-x64.exe	100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bootstrap.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\.claude\downloads\claude-2.1.222-win32-x64.exe
  "C:\Users\Admin\.claude\downloads\claude-2.1.222-win32-x64.exe" install latest
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:4056
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:3636
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe git
    3⤵
    PID:4956
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe npm
    3⤵
    PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.claude.json

Path C:\Users\Admin\.claude.json
Size 133B
SHA256 00f2d0bff9678c08e61f4416fd04026e9c9590ad3b6d17f749188bea5cc9b792
MD5 1cd7aa31fca95a3dc803e92535ea6464
SHA1 c9c48dbbb7b44ac40631b5e3da9d162628789874
SHA512 b74fe1d245f4630515213f1c0be10aeb6bdb1f389f1005a7c7b0c6a3a1d3b61be6f9480474669d2d59a64be0919d5aa80efbd85ff5da67108d65b8d88b2d3c23
TLSH
T102C02B0644F8044304C54C053CBC70F14F38390B004182840F5F7F0303483930236456
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 430B
SHA256 32d3b8446ac32cfeb72bdad44ad3945baba1740bd949d5d9b5881894b5ebc108
MD5 0eeb2c90dbe2762d00651ada9b3eeb40
SHA1 dfcf8c6fe50587e1191352124fb4f6f52a70f51b
SHA512 bc05f753680b28c976975ea51eb307bd6c3b00bc3bfc31e510d0edd74e4c6bb53f5f84fc40b07fbae166e352950d2e72cbd43c149ad88ff5d3f2e5823c7e4d91
TLSH
T1B9E02B16A969907B46E95A03ADBE20668DBC6D2E01A43169078F7F41024D753313BAB5
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 50B
SHA256 3f1d63d8e119cebf4b107777603a02024578831e7e58a3219253e298024118da
MD5 38daed75024f1e23a6bf291b081bebf1
SHA1 37f359c7ba28b7dc74c481800839dbdf47f3e3f8
SHA512 c3a915e471b5cfb2cfcd75c0d2ebd4070a0589ad95b88cc19e0791fdc91f6d1f8018e812321198bf9fe9272616094960517cc3501350145ad34e4ed2abbc06c8
TLSH
T1AE900206806110CB98810959696FE6E04F1035160001C144554A8B1501505B1191B864
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 169B
SHA256 5affbf3e20892b0256a222502e8330bccd973d24eb72a139bd24cb4630b0f8a4
MD5 6a5e5e9bd72fc5337e8639b601b84657
SHA1 ee180c6b41e4bfb9462fc077fc749aa35ef1b367
SHA512 2a9b5c120e9935f5330fad6c6082b8e1766a32353e38ba3f78c0628553fe15f6d0b343247784aec2f168e61be11050512a2599c565efa43aa1450ef42f33f1f3
TLSH
T178C08C0645E9446305D68D4BBEBEB0B64F383E1B004692584B8FBB23024CBD3123A4AA
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 208B
SHA256 5027d7546aeeb281637afde8cd1690ca9584d97c0443cc23b404d4d3bd61ee9e
MD5 63651d19786cca53bbe1c66970b6c197
SHA1 973de08aff768022fec6b89f30bc93f70f70e4aa
SHA512 6d6fb42dc02e5aa82efefe11bcc13e856e9457717bba38377f59400859096c988c5aeedc81dcafdf5d59271b9c12d21b2e9d44261f3d1f808b28c67ce8bcad11
TLSH
T198D023010195442301D64907BFBD70610E342D1F0145515407CF6B13010CBD322370E9
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 524B
SHA256 5ce3222c4abe867eb519bcb0b38d17f025a7e608945838a4a94211e6ce4d254a
MD5 119b96eeb0b39ca6aef227315e3945ec
SHA1 e0828f94e66c1b4890a349804d74b8bc99ee0d14
SHA512 729e3ab0370c890cb8e7ba87ad59bdd5b135dec64c2038431379a209aa8a12477fd701f0c4034fbf3abf41817096e4160e40952fd81359623c335c14ad4e6e2a
TLSH
T1A3F09E269959907F06D84617ADBE24634A78AD2E01B530680BDF2F51210EF53323F6FA
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 235B
SHA256 8946d4e94f08db8b9c5466248b487fac438662acffc194be04e5f1c8107e7938
MD5 093477249af5714974fd7934d4606a5a
SHA1 af0b85cffcf45722e773052deb52cd8334b68634
SHA512 456d1ec285ce50ad16600991c5c88599d021bcd4b02f8c175c44109b70db67de9e4f880a5c35ea9588a7aaa4651ef13c195e7c3d008107311218693b9d337e0d
TLSH
T16ED0A70611A9446305DA490BBFBE60A10E75AD1F0185515807CF6B12010CBD322374E9
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 283B
SHA256 1456531253c356f9042c562ba47da8411888428310b60d01e764d409a2e05299
MD5 0085ab8073537b4ffc105af46dbf8e9a
SHA1 e46d89efe9cefe4f5255d3d10d9bffd45eee4d9a
SHA512 8e5a60d82008042ed813a9912375680e34597aec7a3d79eab3e22f4777a4cc5e42ff6ae8f74f953b6bc3df25b16700af6c9e7fe0763e1ae37b323605f7ee23ff
TLSH
T151D02B0255A9847706EA4907BEBE60920D386C1E0185606C0BCF6F12020CB9322374A4
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 309B
SHA256 4872c11abdf147ea1fc57d3867f50a9b6df692475824bb1fccbad2ab60999adc
MD5 0fe49df2bcb78818026faa718784a325
SHA1 f732080e5bf54442a0462fe384aa56465fc31a6f
SHA512 5110e8a1b9a23688339d33dde9af80f6c25628d756dbaabfa74763a55f29b486e330a8a9e25988a80768fe45c1f90c80e2beeec1564056b57a933368b7ea147a
TLSH
T167E0EB0264B8807302EA4A07BEBE60924E38AC0E0280202C0BCF6F05020CBA332375F4
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 389B
SHA256 fd3687c25071ec37900c6c4ac1326b33e771b1acd2ce6b2670c95c74b158589f
MD5 4ce4184ac1f19029888c08188b41b582
SHA1 c53e3296840c6a152d253631679e3984eab885a2
SHA512 afa34321998031d7856a0a5b12b0e13cf190fc5644de98d917e892727fd267f7def8b9d4f7d939df5b25476a70cf9b0d8461d8089507b33e66ea4f45e8c6882d
TLSH
T110E0681259A9507B42E94A07BDBE20568E7CAC1E01942069078F3F42024DB93323BAF5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\.claude\settings.json
Size 37B
SHA256 c0eb33614d13cccdc2db798e2a73c82af9e6f291d8261c6b711b620a8d18648d
MD5 a303e4a792338ba1128c5d9e22677aed
SHA1 df4ade37e2674a7fb00abf44cec28295a8672968
SHA512 161773fbbdf4f8468e06dd012253b84e89832380fd6a069c0358135ce4111dfe8f7c883aa667fb7a9d972b4bab871dd2d36b38bff71af2aa8b98a03bd3b4f408
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_41gp3c5n.gap.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41gp3c5n.gap.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5028-20-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-13-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-12-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-10-0x0000011670F70000-0x0000011671498000-memory.dmp

Download

memory/5028-9-0x0000011670870000-0x0000011670A32000-memory.dmp

Download

memory/5028-0-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-87-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-111-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-115-0x000001166E0E0000-0x000001166E0F0000-memory.dmp

Download

memory/5028-1-0x0000011655A50000-0x0000011655A72000-memory.dmp

Download