7773a920346edfad725390b7a4b303001130d1dc3f0427d585315e1a991bb52a

Analysis

user interaction
yes
max time kernel
298s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fileview-directa.info.ps1
Size 636KB
Sample260813-tkr3matdmf
SHA256 7773a920346edfad725390b7a4b303001130d1dc3f0427d585315e1a991bb52a
MD5 89766f538d53ac8b759758ac7156f5b0
SHA1 c310ba7adae7af3bcd1bfc37917afb85de96afdd
SHA512 f54025181d2c99b222a651fb5fcb28a070cf8df801b2e13d3d7a5464c37efc2a54dc06f726cc2f998c3a10eb5ff463cc533bcaf3f5b65d29528316c41e9d7b54
SSDEEP 12288:KhGanylx21bVh3aWT8dCWpODOfFnPICNaieRa6KudlfcUC6mcd3:8E2pVhKWQdCW4qNPICAsudlfuc9
TLSH
T195D4231219E23E080BF8237B3467AF2C36A51F336604D5613F9594ECA55E79B0B8367E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4280	powershell.exe
7	4280	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3480	node.exe
3008	node.exe
2472	node.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c8f375c1-0241-4b84-a35a-aabfc4b3eef7 = "\"C:\\Users\\Admin\\AppData\\Local\\Nodejs\\node-v26.4.0-win-x64\\node.exe\" -e \"require('child_process').spawn(process.execPath, ['C:\\\\Users\\\\Admin\\\\AppData\\\\Local\\\\Nodejs\\\\kqBvsoinbsw2gVYF.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\""	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4280	powershell.exe
5044	powershell.exe
3760	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
3760	powershell.exe
3760	powershell.exe
5044	powershell.exe
5044	powershell.exe
3576	powershell.exe
3964	powershell.exe
3576	powershell.exe
3964	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 2184	4280	powershell.exe	85
PID 2184 wrote to memory of 1528	2184	csc.exe	86
PID 4280 wrote to memory of 3480	4280	powershell.exe	96
PID 3480 wrote to memory of 4124	3480	node.exe	98
PID 3480 wrote to memory of 3760	3480	node.exe	100
PID 3480 wrote to memory of 5044	3480	node.exe	102
PID 3008 wrote to memory of 2472	3008	node.exe	106
PID 3480 wrote to memory of 3964	3480	node.exe	107
PID 2472 wrote to memory of 3576	2472	node.exe	108
PID 3480 wrote to memory of 560	3480	node.exe	111

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fileview-directa.info.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l0pfx34c\l0pfx34c.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EED.tmp" "c:\Users\Admin\AppData\Local\Temp\l0pfx34c\CSC2E566D242992471C965B4A8CBBAFC784.TMP"
    3⤵
    PID:1528
- C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
  "C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" C:\Users\Admin\AppData\Local\Nodejs\kqBvsoinbsw2gVYF.js fileview-directa.info
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"c8f375c1-0241-4b84-a35a-aabfc4b3eef7\").\"c8f375c1-0241-4b84-a35a-aabfc4b3eef7\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\kqBvsoinbsw2gVYF.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"c8f375c1-0241-4b84-a35a-aabfc4b3eef7\" -Value $command"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\SQMClient\" -Name \"MachineId\").\"MachineId\""
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:560

C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\kqBvsoinbsw2gVYF.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
  C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Nodejs\kqBvsoinbsw2gVYF.js
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 03ef59b8353eae626d77544758a4336849dac47a7afa30668ca67b48efd8d6ed
MD5 68885a588c3a18af3231775c1ce60817
SHA1 decf1b996efb13f99861bd3d95eccd1beba975b2
SHA512 b07ed2e47ac7850fa22eca8c5584532ab7c3a49f871bc5d4214bf879d5e2a1b1895ae55e7ea792023fcf1f462b8c14ee22d0e1dc993d28fab9c48c328a8f782a
TLSH
T1B871ED313275B0E4C9567F47192819C063BF8385FA98AF5CB65C621EDA2740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 5519209f2800c071d51e3f6f7997a5f19c862ff3a68cc53be01415029f69723d
MD5 0e002f1323d53f99831ca22c5af46993
SHA1 3be546382aac2abd6fb2aa37bc292f658b0b57b9
SHA512 09979bdc309161797401ffccc49bbe9337818f3f80ec81065ce245092491fdfe1ec592c18120bc77a2f230f0b28826ab3cc7ae28caa18aebdd24bc8e3766f82d
SSDEEP 1536:0UsTNhfkR+jH0Mv35iFHzdyyhl3Oi9flJdiNuhETYoWUpBa5EVi3j39MVvjpCKLW:0UsTNhfkR+jH0Mv3gFHzdfhEi9flJdiE
TLSH
T1E2434093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download