c6bc91613bfdcebd8f1b46871a4f3bce0639bfe4a0438f1452e156778c90140a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LAUNCHER.ps1
Size 4KB
Sample260814-my5sbasthx
SHA256 c6bc91613bfdcebd8f1b46871a4f3bce0639bfe4a0438f1452e156778c90140a
MD5 a835b3ea37f73108673ef30fef2ec6c5
SHA1 531db6db8009af8a3dce954a1a730636daa8e700
SHA512 4ee80883c61d08dd176148afe323d23936c6bba6d92b2093affd782f6f5a212a1c1c3ec2d39860047ceab09cc18483ea548f8bec16929421c962b7e6068134d4
SSDEEP 96:aNmi3mPELpcET9NpIxBH8TC38zM2UJ8zr:Pi34EdcWIXH8FUJO
TLSH
T126A12135F105250E85F6169E0502B26CFC96C07752CB09C4B15C82AABBF6BAE4B36DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3736	powershell.exe
1424	powershell.exe
1572	powershell.exe
4600	powershell.exe
628	powershell.exe
1764	powershell.exe
752	powershell.exe
3044	powershell.exe
2984	powershell.exe
964	powershell.exe
4364	powershell.exe
1652	powershell.exe
4624	powershell.exe
4108	powershell.exe
4132	powershell.exe
4208	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1760	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3044	powershell.exe
3044	powershell.exe
1424	powershell.exe
1424	powershell.exe
4364	powershell.exe
4364	powershell.exe
4108	powershell.exe
4108	powershell.exe
1572	powershell.exe
1572	powershell.exe
4600	powershell.exe
4600	powershell.exe
628	powershell.exe
628	powershell.exe
1764	powershell.exe
1764	powershell.exe
1652	powershell.exe
1652	powershell.exe
4624	powershell.exe
4624	powershell.exe
2984	powershell.exe
2984	powershell.exe
964	powershell.exe
964	powershell.exe
4132	powershell.exe
4132	powershell.exe
3736	powershell.exe
3736	powershell.exe
4208	powershell.exe
4208	powershell.exe
752	powershell.exe
752	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1760	3044	powershell.exe	85
PID 3044 wrote to memory of 4356	3044	powershell.exe	86
PID 3044 wrote to memory of 4764	3044	powershell.exe	88
PID 3044 wrote to memory of 1424	3044	powershell.exe	89
PID 3044 wrote to memory of 2164	3044	powershell.exe	91
PID 3044 wrote to memory of 4364	3044	powershell.exe	92
PID 3044 wrote to memory of 4108	3044	powershell.exe	99
PID 3044 wrote to memory of 1572	3044	powershell.exe	106
PID 3044 wrote to memory of 4600	3044	powershell.exe	108
PID 3044 wrote to memory of 628	3044	powershell.exe	110
PID 3044 wrote to memory of 1764	3044	powershell.exe	112
PID 3044 wrote to memory of 1652	3044	powershell.exe	116
PID 3044 wrote to memory of 4624	3044	powershell.exe	119
PID 3044 wrote to memory of 2984	3044	powershell.exe	121
PID 3044 wrote to memory of 964	3044	powershell.exe	123
PID 3044 wrote to memory of 4132	3044	powershell.exe	125
PID 3044 wrote to memory of 3736	3044	powershell.exe	127
PID 3044 wrote to memory of 4208	3044	powershell.exe	129
PID 3044 wrote to memory of 752	3044	powershell.exe	132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LAUNCHER.ps1
1⤵
- Drops file in Drivers directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:1760
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy delete v4tov4 listenport=443 listenaddress=127.0.0.1
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4356
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=443 listenaddress=127.0.0.1 connectport=4443 connectaddress=127.0.0.1
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe
  "C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe"
  2⤵
  PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 3e563de739ed63c41f4ceaac40974cebee5b84143ec0c2cbfc4a7269bf10f19a
MD5 2d992ecc53662522510c70ec02adac62
SHA1 36ede4e9e2b755e0afa536829bf84219019bb55e
SHA512 720c198c34f8ee4a5e8bcb363a89e2983e6cc1fb743688e068379c911cb7fc2e7422afb37021407de24cc67a261e9c07fbdf5852bfcea80e2143082b225f8ee9
SSDEEP 1536:hC+jH04tAHkjUpx9SMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+Eya7:hC+jH04tAHkjUpxwMrxyNhftflJdvYoG
TLSH
T158434093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3azeepv1.r11.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3azeepv1.r11.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3044-0-0x0000026275020000-0x0000026275030000-memory.dmp

Download

memory/3044-1-0x0000026275020000-0x0000026275030000-memory.dmp

Download

memory/3044-8-0x0000026274FE0000-0x0000026275002000-memory.dmp

Download

memory/3044-12-0x00000262777C0000-0x0000026277936000-memory.dmp

Download

memory/3044-13-0x0000026277B50000-0x0000026277D5A000-memory.dmp

Download

memory/3044-14-0x0000026275020000-0x0000026275030000-memory.dmp

Download

memory/3044-22-0x0000026275020000-0x0000026275030000-memory.dmp

Download

memory/3044-23-0x0000026275020000-0x0000026275030000-memory.dmp

Download

memory/3044-24-0x0000026275020000-0x0000026275030000-memory.dmp

Download