cd17c6b555f761d60373659824bf805e1510538226e4c7028e19d7494937a333

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootstrap.ps1
Size 3KB
Sample260810-21vsfs1bnd
SHA256 cd17c6b555f761d60373659824bf805e1510538226e4c7028e19d7494937a333
MD5 bcdb5ddf3b60a9cfa8f0d8803552a0dc
SHA1 b0be54fbb7d8f977763edbb84e373c3cc568c05b
SHA512 0418723fc6107785bab6cf6e831b91b25ddd5e301b17466a09682b820394b47d4b2c1123b3aedc96e407bddb4cf98248aaaea80118b5d16857f4ebf1fa3d0308
TLSH
T13961441B4371427251A1130295CFB246B3A140BF8A4D6E2479ED9704BF96A3CDBE37B7
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4272	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
1196	claude-2.1.226-win32-x64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
1	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4272	PowerShell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5696	reg.exe
3844	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	PowerShell.exe
4272	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1196	4272	PowerShell.exe	82
PID 1196 wrote to memory of 5696	1196	claude-2.1.226-win32-x64.exe	84
PID 1196 wrote to memory of 3844	1196	claude-2.1.226-win32-x64.exe	85
PID 1196 wrote to memory of 4920	1196	claude-2.1.226-win32-x64.exe	88

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bootstrap.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\.claude\downloads\claude-2.1.226-win32-x64.exe
  "C:\Users\Admin\.claude\downloads\claude-2.1.226-win32-x64.exe" install latest
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:5696
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:3844
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe git
    3⤵
    PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.claude.json

Path C:\Users\Admin\.claude.json
Size 50B
SHA256 06510ae275922c30d171b067f0cb1a0cc622488a14a2b32c2601f5164196be1e
MD5 859f85fac21195349f7ab4f40bfc5ed8
SHA1 c49ee46d2fe9d717b63b53dc09ff03bdc5c380f9
SHA512 0b0dffa66be6e6adb32b867e20ac309a077322f678e6d2532a309433004d83f60acc6664b22a56bbfa44280faa5fd18c0603101f460d59ea9f5c31d8d908431c
TLSH
T1739002841C7950865C9200546C1C8BA54B116A2321014A15131A570440515611D7F570
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 133B
SHA256 61858d1059c72a23655a73c8771758dfefd8fdd2941d2ee7247e71c14e18976a
MD5 ca829b7c41fadf937d0708b34cb9edb9
SHA1 cf8145bbfccbb99ffd99a7bd9fad0c6159b891f0
SHA512 d34d5e88f90832a3d03589a2ba254fbbc897fc95e9b0f707b6185e8c2b6502a83b2bff63fcd22c266007381d0184e9b1b0f652151ad8773e48af2ebd2189a03b
TLSH
T174C02BA0AC990482EFC080085D5F0F617B311F2B100031F0530F21040024EF10C3E020
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 169B
SHA256 1c88b074e3b6589ce120df832c9ede3739710a724d1ed8d092cc0a12a7fb0894
MD5 176a5c976bb5aa9fe7d401aa7aa23bbf
SHA1 0d08d1bf72d6c675bb04f79994133c79e19b3cef
SHA512 1c770a2688e8790cb1119439c7727017330a19c48bbcaa682be12b389bbfb6aa0fbc96b2e05d57c566eb3672bfa7ca6544cca94a49ca816f6948ed96ae5254a0
TLSH
T1FCC080906E5544429BD18109AF5F4F2567711F2B110035F4930F51140019EE22D3E434
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 208B
SHA256 897ab75e9a92358aa0c0c7ab4d8f97085a4cc54b35aaa45162d1ec929c5f9348
MD5 57cfcc4487bb0124371c676135e9abfd
SHA1 e0c8404bddabafed3b671d1b5f826a1cded23056
SHA512 0994c1b1c933df612022be7916e09fbfcc0a449905565e1adf0f584c6aa05749a41a106fcc73097d12b3feba8e7fa90fde2746b38f1c5c4890e6525121a45513
TLSH
T14CD022906B5A84129BE2820AEF8F4F222A705E2E120038F4834F5218002CFF33E3F0B4
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 235B
SHA256 71fb78dca6a88c39af4427ff9c0acc13473a7c3c039f3b2d8d3424df7a74f604
MD5 2f05449c0c25977d67085956d7688f42
SHA1 da8e631e545a33380735fb0a1148d9525038ca13
SHA512 2f2d6f7fceb157a7d8d344b84e44a9bc35a381ee0008fe26546402c7adb6939ae76946f5ef277263805c94f707dd1d5dd729030745d33fba95d1aa7f66327d1a
TLSH
T1F1D0A7906A5A44525BE2810B9F9F4B512A719E2E124034B4534F5514001CFE33A3F4A4
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 283B
SHA256 478b2ebf5595a914d9bf1148cb000b00617398bf16c0babccefe03d4d787274f
MD5 d00f536ffba5e4f49be35f762a481332
SHA1 f61b4ea63c05d613872348070e9084019c9eec39
SHA512 d5f3946b1c8410393e336111a3b2d8033220b4309ac524927334d5448d01bf9fa28ae6fe813ef618438a7205cd5a799ec7b637be378507d6bb10fc83699492ff
TLSH
T1DBD02B907A5994665BF1810BEF5F0A5219719D2E064034B8434F1A14001CFE33E7F570
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 309B
SHA256 22627a8651e118d8f018341b330c62fcdc8642bd41026652aa29378bce16239d
MD5 58f9d049936bd13d6f255ab0ff79cb28
SHA1 182cddcc49718a952efe016fe29c268058e7dc42
SHA512 357671c1fe9b37d772b0002c2a40696487356b64a85c65c857ebf86a2938d094ae9e4ac756849c02a7318a927cd70330b8895bdd96bee01b5f33e5af9fc56165
TLSH
T1EEE0CD907969946597E14207AF5F4A515E719D1D164034B8034F5618101CFE73A7B570
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json.tmp.1196.796a68232591

Path C:\Users\Admin\.claude.json.tmp.1196.796a68232591
Size 430B
SHA256 99360df08ab1fce1897d4135fbcdf33c78d10629e577d8a57c9b2e0929cb9047
MD5 5d14193b88b471a4fce5138b32ba5bf5
SHA1 894e90f3b5e4b392f5b784b4445e607bb7de330c
SHA512 3d13b1f79759b3d41c33a9e378f31c2c126ab599e346887503db61061e37362bebeed775969814adedfd48e5232f8c3c269c8f41afb18b59b0caa317c87a0e75
TLSH
T1A9E055E4B96980A797E1420A9A9E096285F89E39025130A9030FAA08002CFA7797F670
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\.claude\settings.json
Size 37B
SHA256 c0eb33614d13cccdc2db798e2a73c82af9e6f291d8261c6b711b620a8d18648d
MD5 a303e4a792338ba1128c5d9e22677aed
SHA1 df4ade37e2674a7fb00abf44cec28295a8672968
SHA512 161773fbbdf4f8468e06dd012253b84e89832380fd6a069c0358135ce4111dfe8f7c883aa667fb7a9d972b4bab871dd2d36b38bff71af2aa8b98a03bd3b4f408
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5nwusp03.grh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5nwusp03.grh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4272-1-0x00000267C4740000-0x00000267C4750000-memory.dmp

Download

memory/4272-0-0x00000267C4740000-0x00000267C4750000-memory.dmp

Download

memory/4272-11-0x00000267E1080000-0x00000267E15A8000-memory.dmp

Download

memory/4272-2-0x00000267E03D0000-0x00000267E03F2000-memory.dmp

Download

memory/4272-77-0x00000267C4740000-0x00000267C4750000-memory.dmp

Download

memory/4272-78-0x00000267C4740000-0x00000267C4750000-memory.dmp

Download

memory/4272-9-0x00000267C4740000-0x00000267C4750000-memory.dmp

Download

memory/4272-101-0x00000267C4740000-0x00000267C4750000-memory.dmp

Download

memory/4272-10-0x00000267E0980000-0x00000267E0B42000-memory.dmp

Download