Overview
overview
10Static
static
10zScripts-m...ns.ps1
windows10-2004-x64
3zScripts-m...ns.ps1
windows11-ltsc_2024-x64
3zScripts-m...rf.ps1
windows10-2004-x64
4zScripts-m...rf.ps1
windows11-ltsc_2024-x64
4zScripts-m...ng.ps1
windows10-2004-x64
6zScripts-m...ng.ps1
windows11-ltsc_2024-x64
6zScripts-m...ns.ps1
windows10-2004-x64
3zScripts-m...ns.ps1
windows11-ltsc_2024-x64
3zScripts-m...er.ps1
windows10-2004-x64
8zScripts-m...er.ps1
windows11-ltsc_2024-x64
8zScripts-m...ge.ps1
windows10-2004-x64
3zScripts-m...ge.ps1
windows11-ltsc_2024-x64
3zScripts-m...EQ.ps1
windows10-2004-x64
3zScripts-m...EQ.ps1
windows11-ltsc_2024-x64
3zScripts-m...me.ps1
windows10-2004-x64
3zScripts-m...me.ps1
windows11-ltsc_2024-x64
3zScripts-m...rs.ps1
windows10-2004-x64
7zScripts-m...rs.ps1
windows11-ltsc_2024-x64
4zScripts-m...rs.ps1
windows10-2004-x64
6zScripts-m...rs.ps1
windows11-ltsc_2024-x64
6zScripts-m...on.ps1
windows10-2004-x64
3zScripts-m...on.ps1
windows11-ltsc_2024-x64
3zScripts-m...de.ps1
windows10-2004-x64
3zScripts-m...de.ps1
windows11-ltsc_2024-x64
3zScripts-m...ns.ps1
windows10-2004-x64
3zScripts-m...ns.ps1
windows11-ltsc_2024-x64
3zScripts-m...er.ps1
windows10-2004-x64
3zScripts-m...er.ps1
windows11-ltsc_2024-x64
3zScripts-m...er.ps1
windows10-2004-x64
3zScripts-m...er.ps1
windows11-ltsc_2024-x64
3zScripts-m...or.ps1
windows10-2004-x64
3zScripts-m...or.ps1
windows11-ltsc_2024-x64
3General
- Target zScripts-main.zip
- Size 149KB
- Sample260806-plxmaahf65
- SHA256 7c247e10b6d7bae6789630b2ae642a30757fc34925d7b731b7cacabd75c1d38e
- MD5 05b22a9d73297f3cdb17c62d1db60eda
- SHA1 6328aa451eb5917ae4dd6450575f39bc1b4c8512
- SHA512 82ec5a66d29d42801de0dfbbe7a005c8856492be891419efed5bfc4373fcaede90b867fa7f5cc1aeb69cfbb8cd58ca058627d9cfc472a8cfc9a2b8176bc8b8b6
- SSDEEP 3072:qamRuL7eToCq9RRRPId9Za7LfjDSnbG6TSH50Z:2w7eToCQRRWvZmffSnM0Z
- TLSH T19DE30249D556FD28D69468FB31729D2AA7345080A60BDB3327F12E321C7E2627E131AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
zScripts-main/BlankStartMenuIcons.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
zScripts-main/BlankStartMenuIcons.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
zScripts-main/CheckPerf.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
zScripts-main/CheckPerf.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
zScripts-main/DeviceManagerPowerSaving.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
zScripts-main/DeviceManagerPowerSaving.ps1
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
zScripts-main/Disable-AppActions.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
zScripts-main/Disable-AppActions.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
zScripts-main/Download-AmdDriver.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
zScripts-main/Download-AmdDriver.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
zScripts-main/Download-AppxPackage.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
zScripts-main/Download-AppxPackage.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
zScripts-main/EnableLoudnessEQ.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
zScripts-main/EnableLoudnessEQ.ps1
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral15
Sample
zScripts-main/EnableUblockChrome.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
zScripts-main/EnableUblockChrome.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
zScripts-main/ExportDrivers.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
zScripts-main/ExportDrivers.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
zScripts-main/ExportWallpapers.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
zScripts-main/ExportWallpapers.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
zScripts-main/FixDiscordLocation.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
zScripts-main/FixDiscordLocation.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
zScripts-main/GameMode.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
zScripts-main/GameMode.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
zScripts-main/Get-TeleDomains.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
zScripts-main/Get-TeleDomains.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
zScripts-main/ModernFilePicker.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
zScripts-main/ModernFilePicker.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
zScripts-main/RegAPIWrapper.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
zScripts-main/RegAPIWrapper.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
zScripts-main/RemoveAppsPolicyEditor.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
zScripts-main/RemoveAppsPolicyEditor.ps1
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
ps1
-
exe.dropper
https://download.sysinternals.com/files/ProcessMonitor.zip
-
exe.dropper
https://download.sysinternals.com/files/ProcessExplorer.zip
Targets
-
- Target zScripts-main/BlankStartMenuIcons.ps1
- Size 784B
- SHA256 50cab1ff2b7b4b9a0c5cc34bd31e88fd54edc33e499c71106c6b47facab5f0c2
- MD5 c925846e18d94cc92032b95cabaa349b
- SHA1 3dae4672432dfa0a6ed04e09d17c5afc2d39170e
- SHA512 2ca4969e66b267a1cfd68f4137e49ace563b45e11b0014e0f6d241233de1322d38f76dc1987a638eea92f4149767d7562de36232052ba9838e3cd600ae51847c
- TLSH T17301BDE2E7D593B10433466A94EEC244E41F466551B3DC11F09D481DFEB6647C1B94DC
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target zScripts-main/CheckPerf.ps1
- Size 1KB
- SHA256 d681e7175495c6ae029a1facce13fb2c36b164768295af2a2ef9c703a70eb5b6
- MD5 afecd63571a19e0fab8773782cda91a4
- SHA1 efdf5652a86733c8fff5a33bf92d7df2ddc8490b
- SHA512 ef59bd3c331f7f3e24f6f25197c8c5be09d3f753761798577a711e57ba3b54dfd6c87bc2f637a61774e6dc52d9ed0a00f67b4498ee2909363788d6ba38b2b6a5
- TLSH T1B8219B658399251A1AB31DDE0024E386AC6E71708397CEC8763C8139FBE605F92760AB
- MD5 SHA1 SHA512 TLSH
Score4/10 -
- Target zScripts-main/DeviceManagerPowerSaving.ps1
- Size 864B
- SHA256 a4be9ff0328a7a5f81f7947c85324d0c2e10e863cbd2391c48b14bc15d88772c
- MD5 9c72b5e4615d9383cffedf8bc79c4280
- SHA1 332b19dd7f655fdea5bc8e42c2219731703224db
- SHA512 99ff80b720e90a94fa11df74090e8ad22b8ce0df00d137ce8235887034f34f35f1377b93ecfab4f8d1c90a4f0725c04d452e0bdc3d61c9367bac78ce91c9607c
- TLSH T160111E2383229852091BD3A9ED50A822EE1B203E421027F0BCAC355D3E17C5844BFDAA
- MD5 SHA1 SHA512 TLSH
Score6/10-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
- Target zScripts-main/Disable-AppActions.ps1
- Size 4KB
- SHA256 492549f8d32f3a318aedca98b5e27eb3f809dbae8796b7cafedfc3ee40278354
- MD5 37582002030cfa27a8574e88b6abf1de
- SHA1 54de1b0fd537871e6adb6a31ad56e739eb5b23e8
- SHA512 e55e0bce2682b1cad0c94a30607042f5802816e173ac29789269b3db21227626f40988435bc038965bc029a81138946a743b9594f620821a29b1e077a5e51ecc
- SSDEEP 96:Z7Pll2WXUWRj+f035Q9s89TxiXpqj+5MMp/x2kq/PlGG:l9T6f03SxicjnB3n
- TLSH T1B2916422A45690EA42B3273BDC659704FF5B403B00A2251079BCD4C92FB18DE97F8ED9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target zScripts-main/Download-AmdDriver.ps1
- Size 694B
- SHA256 12ab9bcb336e80c3e8e9a1b96efc6d144ba28df69a1fe3b9d44f4f8f3be55948
- MD5 78ff5f9a9780716db1ab01b4fab54531
- SHA1 0b68cb601aa3d5cce7d75bbb5d8181644c3bfc42
- SHA512 6c16b05ca1c3021b347dca91258e7573aa1e3c969665e8452e478a320149c944176869f7d819de22a06034c5157cb4d09764769ba7b0fa521b0a0ccc0b222bf1
- TLSH T189014E638633C25426181DC79987FA80C9C3402B18EBD874B5B00D8DABA538E40A2C7B
- MD5 SHA1 SHA512 TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
- Target zScripts-main/Download-AppxPackage.ps1
- Size 35KB
- SHA256 ad7caa7102df8019c874f4888d545845753928f04dc29f3f96ac3f89a7c3b502
- MD5 773c92df21e712fdddeb1be39bde57d1
- SHA1 41f49df49fa2f192e1cb7523f3957ba9ab280e27
- SHA512 175bc8170aef6a2c347635c18432ddecf07516c569bd490ee8084ee6f34e82821af06a64e0b25972ab8740904073245d84e57b026a4b80581089e93524243013
- SSDEEP 384:s+FeVWFjpfpWngasC0vb7DfyBcy7xFmysi4KNgasC0vb7DfyBcy7xFmysi4Y:LeIjnWEDTydsysi/SDTydsysiH
- TLSH T17FF2941EB61A92258A73173DF99F5108DE1A103B30164881B4ADC5C8FFF159AC663FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target zScripts-main/EnableLoudnessEQ.ps1
- Size 3KB
- SHA256 4b29d773c89a8ae88711905c176cc45d91eff7eecc109e24d969118cd3ad6c28
- MD5 054956eb59e0660f126d984507f2ea02
- SHA1 dba87f3447e4a1ea695805e38f3f2aad6e072e10
- SHA512 7623ed10c7bbf65a1d2da886fd3cc0e9caf62a497ce9a3e5d580de5dd4ca02232894b099a9592b35bc37672b96cdf410874e30a90a3074ae8578947362cdca39
- TLSH T13A71731694458AA5C5F3AF59CF917603EE0AC0B709C384DC32BCA584AFF5C1B82A97D8
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target zScripts-main/EnableUblockChrome.ps1
- Size 1KB
- SHA256 cca05197b0336048db287731ab554b7928cd04e233050ce885746d1d4087e099
- MD5 f5c9f6c42d07f94547f4816880475da6
- SHA1 4d834cd9bfe1d8c0f58b7444156885b08ccfd9dd
- SHA512 83eb219684cd69ef301dcb7223d11ece70f84c3e9ddc40b033be9355bfdb0d81c5543e3ce797d42d4c5b0c757ec65e0c94a22632e1ffe177181afe57dd0acdcc
- TLSH T1282112B55BCE208909B8C5AACC21B407FD760BC65277994132F8670DF9C4F0643B50F9
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target zScripts-main/ExportDrivers.ps1
- Size 3KB
- SHA256 7917221851c6ee9719ee320c28fe8dd26eba3c4db38a52bb7fab608041f5d82b
- MD5 63523886196e02916e0bbc2950cc6a4c
- SHA1 787a3a4b400f72402398b3cc8585ce8f904f155e
- SHA512 e91f408ae16dd0b72a400149f6a9aea665cc0d39f5730df9a7150f664c0d778c526801ec9124c9cc390c7cbb882810ced8f901f771e119c300b351571dbcd97b
- TLSH T1C68110113F0B0E848DE18D34E8A2452FC696426F907D4C8CB4DD8688BF3759EFA456EE
- MD5 SHA1 SHA512 TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target zScripts-main/ExportWallpapers.ps1
- Size 3KB
- SHA256 f7d5f056619343b4d9158cc234bed9ba0a7e4b17dac1ec6d11e655fa64bd550d
- MD5 83e79ef388c9ab07bcfe5cf6d090d896
- SHA1 19bd7fde719734a8cb8b43612c40bea2c332bff9
- SHA512 2f644a5d192724a5428f889d69952699b13548af062d8055da386b1252a45ae6bc9a36b42837a823e3be5b404d447913a373d9b0735e096b192d4f3352863bef
- TLSH T1C261DF579A5212615633337A9A5F896DED6F413B81020304768EC38A5FB093DC6FDFE8
- MD5 SHA1 SHA512 TLSH
Score6/10-
Drops desktop.ini file(s)
-
- Target zScripts-main/FixDiscordLocation.ps1
- Size 2KB
- SHA256 dc98a307d81de60f8fd19309e26cfe2fb3e0aa7609dacdffb7299ae07277ebca
- MD5 79ac86b3e3b1c81591c77b91fbbe2d03
- SHA1 3c71c8576b71c26ad81c68b0aa3ee11f70bd2cb3
- SHA512 9e6c6bf28d72165a2a69cd130981582f9ce6889378d66c9e2e20a39c072b676d8a441ff0cd4512410e9b24266b0286d6c6762dee9675d5baa4bf038a66b3db0c
- TLSH T17F41AB5FF754849803725F7ECCA17204FD2A012302726816B9BC51D9AFF0E46C268EEB
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target zScripts-main/GameMode.ps1
- Size 6KB
- SHA256 e9fe10402d50d048caa410a2b1f7c6512369f1d5522f1db877c1704254a81506
- MD5 ca26261fd1eed82afd275cfc1ce3e135
- SHA1 0f303820526b55ce7eba9ff511faa58153fc8dfb
- SHA512 da83c26d88fe6e41f47ebb9a896a3cc4657347d7e6535bc363e0518ecdf68101fff1f9f74054c63f16dfb21d37160ec183abdf05daf6f893f459c80f2e3ed97c
- SSDEEP 96:CmFEbRFR7RFRZRUoR6RkRHhRHAY6A+K3QZHZ2zASHjHG+UcquEPxEGwdZF7IT5VL:CAEgQ/BPrzuE5dZF7IT5VBV58O
- TLSH T10FE1F015212B4177CE32BB28CDCB8286EFAE649F2186261035BD51067FA751F873D1DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target zScripts-main/Get-TeleDomains.ps1
- Size 723B
- SHA256 df03bd1bd6547d0e60d83c573df79583d9eed090f55496b342517592ee7fb49a
- MD5 faec8d3a818ec53c6232850257ddd07d
- SHA1 7450a87d48e446ab0d052f050f307ae5ddac1316
- SHA512 f01df5dfc78884d559421c526bffaa31c9e62f7da698b00e0251f231a8ca38c9389f5ce22cc3b462579ab478193e7348b194c1198e72bbadbb186e2d76837df0
- TLSH T12001C030700560A192AFE02FF41DB4F4DF875E878040F900746C01DE9FE0688A074EE9
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target zScripts-main/ModernFilePicker.ps1
- Size 3KB
- SHA256 050e12963f24accb678178e02182656840421b19f0366afce22324bd3a51bbc3
- MD5 b296022eccfa37b8a99912f1e6207419
- SHA1 db36f98cf3440f79189ed1265d9f7da753662aa0
- SHA512 0bd8f4e88196308cb67b5838195233b3841fde56c3b2b224da9983c7521d873e9450356eb5ac157a0fb2a18cf72a62f3b2eacf46c7da6188459f04d101f63645
- TLSH T1B461CC213F0B4D844CE15934E9E2542FC557026BE07C4C8978CE898D7F334AAFA56AED
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target zScripts-main/RegAPIWrapper.psm1
- Size 12KB
- SHA256 566aabe99fd5bc41fe8ab17e977030818dc8d82443e9b80eb4f45cadde5de8df
- MD5 7c317239f2027724a7d64bca61219136
- SHA1 63f461621e194d9a34945d45014037b701dea44c
- SHA512 bd7718a9ad17926fedb6cc0164a0b2f230bce3716f5dcc1f2f43eeeb9e6c7083bcb5d41a17bee3857dc4650c173ba016a6a0e48edceecdeafcf84e7cc020c530
- SSDEEP 384:qc9KhGjUGhoDI3mjk2CJ0rQTPijGcDEHniftIyVI0rQTL7M:9K0jUGhT2jk2CJ0rQTRif/u0rQTU
- TLSH T1B0526415BE45822394B352399D4AF44EEB63232B01E51941FDFC4390AF72849A2BEF5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target zScripts-main/RemoveAppsPolicyEditor.ps1
- Size 8KB
- SHA256 99e36eb4abcd62eacea73f6c0c8f63689dd21925462960c7b3dc9e3a223a51a1
- MD5 3bbea49b7b72119bbe45c378db43164d
- SHA1 a867242c4a846afd6436bdc088a59677a5b01f9e
- SHA512 45a5a1051f7afef6ea5832e24b59dd44edc11b881a55ef6acb010e39c75901a6ed783926d1c6ea7ce4e4322f897961b98e425a7c142a664afccc3d6e215ba163
- SSDEEP 192:fAEgVObTtRPDX7zT+tKIyjySVyIwU/I9DFgM3OVlrg9l05bh4Fb/tpf2r1f:tTDrTNvI1YKr0X4p7er1f
- TLSH T1320272B89897D01AC1733A6D488F5A41FD6940AB11418AC4BADCD1D81FF378DE33AE9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10