8c7fe08f978be57d3f9aa0b622499ac51408b7c8e9b046aab74b63fbccaadef5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:12

Target
smart/number.ps1
Size 156KB
Sample260809-ws8fpatanf
SHA256 8c7fe08f978be57d3f9aa0b622499ac51408b7c8e9b046aab74b63fbccaadef5
MD5 8a6bc9a6699bc8cac22193fef8d520fa
SHA1 d64aab5517dd6d6ad030d6d88f160c11e9903b11
SHA512 db710ea67a66875ea40446c46ce50ad8c3df5311abadff028f7df5ddec22b49a8b0c0587758697aa66d4d9ee64c385fd5d200347660f2f8595ddb3f0e10cfdf9
SSDEEP 1536:tlvC0GY2ISIUng411Z1rUbnCWreKbY0dwPVksvu1mRmVksvjpYM6LVBXBKBqYnlZ:tlf1UgY1Z1rU7b/fBlqavHd
TLSH
T1E9F3B89112250C8D99AAFF37D0923B60C87A5E23D706F957A8D91F660F86181F3DB7B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
852	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	powershell.exe
852	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

__PSScriptPolicyTest_wbnrvkod.atw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbnrvkod.atw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH