e1eddd2f0df92a4d7e56561d26a0a9a81e7e019d011410dc777fd9c45e462939

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 604KB
Sample260810-wyhr8aep71
SHA256 e1eddd2f0df92a4d7e56561d26a0a9a81e7e019d011410dc777fd9c45e462939
MD5 dff97751a6f3f36cec11171e5c736d54
SHA1 c86659d1066746104c9fe64fed35e9f78849751e
SHA512 7e62d2d6ed8e66b2bfbc2ab51269924eba17d3e0e147c6e25481c63d507dfcde052b0d7247b9814d15633da235cc5cc9c73fa517868802c7a71c55640f81d574
SSDEEP 12288:vZv9Y/sPQk443g0LU2t5u23rZW8mslckZnsa:vZVFHLA23rg8mslckZX
TLSH
T1DDD47E707A422EFF5BA820C248C5C11C563C36B9C9682DF56ACB4CA3390D77627B79B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4824	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4824 set thread context of 2880	4824	PowerShell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe
4824	PowerShell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2740	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4824	PowerShell.exe
4824	PowerShell.exe
4824	PowerShell.exe
4824	PowerShell.exe
4464	powershell.exe
4464	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4824	PowerShell.exe
Token: SeSecurityPrivilege	4824	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4824	PowerShell.exe
Token: SeLoadDriverPrivilege	4824	PowerShell.exe
Token: SeSystemProfilePrivilege	4824	PowerShell.exe
Token: SeSystemtimePrivilege	4824	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4824	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4824	PowerShell.exe
Token: SeCreatePagefilePrivilege	4824	PowerShell.exe
Token: SeBackupPrivilege	4824	PowerShell.exe
Token: SeRestorePrivilege	4824	PowerShell.exe
Token: SeShutdownPrivilege	4824	PowerShell.exe
Token: SeDebugPrivilege	4824	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4824	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4824	PowerShell.exe
Token: SeUndockPrivilege	4824	PowerShell.exe
Token: SeManageVolumePrivilege	4824	PowerShell.exe
Token: 33	4824	PowerShell.exe
Token: 34	4824	PowerShell.exe
Token: 35	4824	PowerShell.exe
Token: 36	4824	PowerShell.exe
Token: SeDebugPrivilege	3704	whoami.exe
Token: SeIncreaseQuotaPrivilege	4824	PowerShell.exe
Token: SeSecurityPrivilege	4824	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4824	PowerShell.exe
Token: SeLoadDriverPrivilege	4824	PowerShell.exe
Token: SeSystemProfilePrivilege	4824	PowerShell.exe
Token: SeSystemtimePrivilege	4824	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4824	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4824	PowerShell.exe
Token: SeCreatePagefilePrivilege	4824	PowerShell.exe
Token: SeBackupPrivilege	4824	PowerShell.exe
Token: SeRestorePrivilege	4824	PowerShell.exe
Token: SeShutdownPrivilege	4824	PowerShell.exe
Token: SeDebugPrivilege	4824	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4824	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4824	PowerShell.exe
Token: SeUndockPrivilege	4824	PowerShell.exe
Token: SeManageVolumePrivilege	4824	PowerShell.exe
Token: 33	4824	PowerShell.exe
Token: 34	4824	PowerShell.exe
Token: 35	4824	PowerShell.exe
Token: 36	4824	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4824	PowerShell.exe
Token: SeSecurityPrivilege	4824	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4824	PowerShell.exe
Token: SeLoadDriverPrivilege	4824	PowerShell.exe
Token: SeSystemProfilePrivilege	4824	PowerShell.exe
Token: SeSystemtimePrivilege	4824	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4824	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4824	PowerShell.exe
Token: SeCreatePagefilePrivilege	4824	PowerShell.exe
Token: SeBackupPrivilege	4824	PowerShell.exe
Token: SeRestorePrivilege	4824	PowerShell.exe
Token: SeShutdownPrivilege	4824	PowerShell.exe
Token: SeDebugPrivilege	4824	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4824	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4824	PowerShell.exe
Token: SeUndockPrivilege	4824	PowerShell.exe
Token: SeManageVolumePrivilege	4824	PowerShell.exe
Token: 33	4824	PowerShell.exe
Token: 34	4824	PowerShell.exe
Token: 35	4824	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3704	4824	PowerShell.exe	91
PID 4824 wrote to memory of 2880	4824	PowerShell.exe	92
PID 4824 wrote to memory of 2880	4824	PowerShell.exe	92
PID 4824 wrote to memory of 2880	4824	PowerShell.exe	92
PID 4824 wrote to memory of 2880	4824	PowerShell.exe	92
PID 4824 wrote to memory of 2880	4824	PowerShell.exe	92
PID 4808 wrote to memory of 2740	4808	conhost.exe	97
PID 2740 wrote to memory of 4464	2740	cmd.exe	98
PID 4464 wrote to memory of 5992	4464	powershell.exe	99
PID 5992 wrote to memory of 5168	5992	csc.exe	100

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:236

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\05e4sljk\05e4sljk.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5992
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES594D.tmp" "c:\Users\Admin\AppData\Local\Temp\05e4sljk\CSCF9503C065D5B476CB04B68426564326.TMP"
        5⤵
        
        PID:5168

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 321KB
SHA256 e7a577439dea901335417c0c5082a9fa7e42258c18b3f3d4956a080a307b48f3
MD5 1cb6c57301c92294813eb70601022715
SHA1 427d6d420136ae6ffba22dc212368930b9fb25b0
SHA512 9e04ed62bb2056f370fbdbfe0efce54f9f783b7be0a68993bd6f36c38322a772175edaf5d85a1f72195041a4f76e335d8226f36e8eb61367be1b4b8d4db14da5
SSDEEP 6144:fEj6HSzMQnQskVDo1mTckYGOAQ6UOUzBE1+ZJwCLvbN7lU6zZcigH:fM6yRnGZck5UVA+Xwg9S6zKia
TLSH
T1F0647E347A422EFB5BB820C248D5811C562826B9D9682CF57ACF4CA33F0D77617B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 525a933027f03840ced261eb6feda3655007d1b57484b077c8805e6badcbd5a5
MD5 5e81bdac4f59721a21b6db67f320b34e
SHA1 7f7c855e47c00e014b98a8b44bb522315ba174ea
SHA512 b1801d111647f20a8d07c87b713854be5b28af7fe27073db5180c38b6e1dc98f45350e476b04e4dd607e10f04c2a11bba89fd165d96c28e9f5a32b228301a7b3
TLSH
T1D841A833B3DC82D0C88960BADCDD6C147AB693D7809FCEDB6B80E115E56F698DAA4050
MD5 SHA1 SHA512 TLSH

Submit Download

05e4sljk.dll

Path C:\Users\Admin\AppData\Local\Temp\05e4sljk\05e4sljk.dll
Size 3KB
SHA256 85f4becf84b6ddcd95706f4f9efb9d81e8a4dc3c33461eb35e155b51197262dc
MD5 6bc36ae9b8dfaa0cf5926f84b3e23c37
SHA1 519f9d4e1959661e97264bb97ff62274d0925b55
SHA512 2d83101127f583fc2adad32df1077ff6fec57abfd6fc3d00fa538eea966c57fdabd6738bd35bb33431a916f0abc495b5d7aadf775afcabf5bfd91e47f401c889
TLSH
T1E6715007E7E44BA6E0B70338A9F343525378F8609F37575E19846328BC657646E32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES594D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES594D.tmp
Size 1KB
SHA256 3d1a9389bffb2070d8ff1856b786f7a10ee775f092983042c5df67540dc56039
MD5 cde06b2dc6b4bab7f8a7d958fafa9466
SHA1 a0886709acdcbd2173ca40ee74e7f90ad203c14e
SHA512 e0d2afd1a6d8626cea5d24cd39ccefe615f1b77d1e481a846c2d8e60dddbef03fcfb60e105c1499c140854c2c18ada51c5e2b198246b6c169b25fe490828feff
TLSH
T1E121AB0993ED471FF4734B31A9FA172FA678FD64EF61536E898002282C51214DEB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zijkoj4f.txr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zijkoj4f.txr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

05e4sljk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\05e4sljk\05e4sljk.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

05e4sljk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\05e4sljk\05e4sljk.cmdline
Size 369B
SHA256 f6fa0f1bcd6f2fbd6f61dcf93e4c6929684df6c8abee1aacb5b1cb5d69805581
MD5 3c96d83441bcd8480ca492b64e8f9415
SHA1 d11098feca7bc4aa94aba210062d691ed0b06e37
SHA512 4e1537f010175bb3da897ebc4657b89a6e2ba38b53157645424a8c842c07b08245f7f8dc20b2614d36461d5b05f6c99ccae780eec75e5c2aec53bc87d66684a8
TLSH
T19FE0C02EB286C2FE27DD1107266DDCACC3720743F9443F845245440DD017010B7D1F41
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF9503C065D5B476CB04B68426564326.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\05e4sljk\CSCF9503C065D5B476CB04B68426564326.TMP
Size 652B
SHA256 9b44911e6f875a96477b25ba59b1e5eb32ac9c1d1927792bf89bb00510ab7a0b
MD5 3106ecccd8e22422930f06861d2e3b0f
SHA1 4bb229ca593da2b1ad4c58190c16f96e75b996e8
SHA512 16889d9ca7ad16b695ab6e8a48ff1f9452d405f86a62aced90db0389f034c2bc7321fb5fed7ad4146b85294ca08c2caddcbd056e31acc192b661377ce13ce571
TLSH
T1A8F05E4AA3F8020EF4F34B30BDF64363D1A8BC64DE3293ED284003196864520C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2880-31-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4464-72-0x000002AAF4290000-0x000002AAF4298000-memory.dmp

Download

memory/4824-13-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-12-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-14-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-15-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-16-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-17-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-19-0x000001E8FF9A0000-0x000001E8FF9B2000-memory.dmp

Download

memory/4824-18-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-20-0x000001E8FFE20000-0x000001E8FFE70000-memory.dmp

Download

memory/4824-24-0x000001E899FB0000-0x000001E89A062000-memory.dmp

Download

memory/4824-25-0x000001E8FF990000-0x000001E8FF99A000-memory.dmp

Download

memory/4824-26-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-23-0x000001E899F90000-0x000001E899FAE000-memory.dmp

Download

memory/4824-28-0x000001E8FFDD0000-0x000001E8FFDF4000-memory.dmp

Download

memory/4824-27-0x000001E8FFDD0000-0x000001E8FFDFA000-memory.dmp

Download

memory/4824-29-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-30-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-0-0x00007FFA6C02F000-0x00007FFA6C030000-memory.dmp

Download

memory/4824-32-0x000001E9001D0000-0x000001E900392000-memory.dmp

Download

memory/4824-33-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-34-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-35-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-36-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-11-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-40-0x000001E8FFA00000-0x000001E8FFA1E000-memory.dmp

Download

memory/4824-41-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-55-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-10-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-9-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-8-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-7-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-6-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-5-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4824-4-0x000001E8FF9D0000-0x000001E8FF9F2000-memory.dmp

Download

memory/4824-3-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download