b930b360a3ef1f29e43eccca916a1c74fd629070d43ec5a599554b2d0d617ca4

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 2KB
Sample260815-mdncjatfpc
SHA256 b930b360a3ef1f29e43eccca916a1c74fd629070d43ec5a599554b2d0d617ca4
MD5 7f9c1ffd8249721728854f64c3b2dd4c
SHA1 93b0fb5a85c5c184e4f75b18ab3882cfa106a1aa
SHA512 48bca253eccb8515da6123e8548c4f26615aadf922c3316ffce101f8c0cdf6063e98769fcbd4a2641a347afc5adea54b87f14d102fea734b670afbf878c0a8b2
TLSH
T11751A776A65E9B9041B047B2E951F620FF6510FF05382185F7D9C16C1FF1E1C42924FA
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1080	powershell.exe
2572	powershell.exe
3848	powershell.exe
736	powershell.exe
1992	powershell.exe
4256	powershell.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3096	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1080	powershell.exe
1080	powershell.exe
2572	powershell.exe
736	powershell.exe
3848	powershell.exe
3848	powershell.exe
2572	powershell.exe
1992	powershell.exe
4256	powershell.exe
4256	powershell.exe
736	powershell.exe
1992	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1936	EXCEL.EXE
1936	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3096	EXCEL.EXE
3096	EXCEL.EXE
1936	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE
3096	EXCEL.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2572	1080	powershell.exe	86
PID 1080 wrote to memory of 3848	1080	powershell.exe	88
PID 1080 wrote to memory of 736	1080	powershell.exe	90
PID 1080 wrote to memory of 1992	1080	powershell.exe	92
PID 1080 wrote to memory of 4256	1080	powershell.exe	94

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RestoreExpand.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RestoreExpand.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
Size 2KB
SHA256 2b70242a91a4b14da60c7ae9a33e7bf6059e910069fd6b6a0198f815fdf33aa3
MD5 88ad9e714df72c005c680d8c08b7ef18
SHA1 bd4a2d0bcc88ec9a2acfae109ba81d8f4cbbb928
SHA512 42a12c068e6295e34d1c3981f030179dcf76a504da067238a7349d8fba0ab5bccf878488086b53425755572b2c3efdba28abd74775e55bb9be01f6bd6edccae3
TLSH
T1E841532D1E8834A3B04A2E34E9CAAD838CF1956217D0D48ED1144A461571FCE9FCF4F3
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 1KB
SHA256 cec7577a9db6ccfdc4dd812ee64dcef1dfd7d6e8859c622ab8e3c7140f04a563
MD5 8b53d6d6b3e9785e18e502d6b4157d4b
SHA1 38c182224459b81a840efbe2a48a47e5b6846829
SHA512 9f0c1fb58a36c5cb419ca4ec3e014cbafe2c37ce9d237deade69390e2f8058f8c230a7d7c16fb07c72c0600efe46fdb76b6874fa793efe0b0148c4187984503a
TLSH
T17A31080356787A82BDC8B84475D55A133CF7ABC2ECD848571A1C82242E7A7D6F390E0C
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 08223831413d8389dea84cb199ae3a10456b90eae792aa05293e527b893635dd
MD5 50b60463af219d8075954ed8d8f785b2
SHA1 2ac5b22d13e0992222df31443b5ae12910804473
SHA512 b5fd0ef96069ce870d3982e093fcae626668498380ff365935d36af7c4a02a95590b95151ad390497a832e83b67a99dd07e1e68e899c3fb0b98f014498f76791
TLSH
T133D012309FB9530FF8FA527AAEE855C1BB24AF25B003CF044AB5120C0878F805D61E1B
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 426B
SHA256 22ff528d095b6e2d594dafe45af5d963da0eb43cb1838404ef0be48fe0addc14
MD5 d4f27d85c7d9e35f71961c1824ceefa2
SHA1 5fe3be19197a4f0ed2085f2873cc8f7555cf5583
SHA512 962b7338f875bec69a889a75c99e78f304f7c974186c541b28686c9207cd3480379e77ce8ead9c940c6b220781bcc0d745775d70f1c05135b33ea1043ea8df0c
TLSH
T194E0D85429FE9128E332EEBC1BEDA57E562DF2675C0457A81610521C1655D500E32B73
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

excel.exe.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
Size 8KB
SHA256 deb539049a836400787b38382de27e41cefee04800867b75733a1c84f2def00e
MD5 83b961b1cfdb0f3930a82c8afbbe06a5
SHA1 a9c61d8b2365805bb075f15c94c1a0ab28eefcad
SHA512 59ec1c2cbf7f8299c22a902cb60c37760c2eec6f7c151d9baa1482700606ae0492a72f1fe4aeeaaeddf1c9123a937c3685d671486ffa8bc6878ed5660c2c597d
SSDEEP 24:KfDqt8VtbDBtDi4kZERDuPTqt8VtbDBtDi4kZERDf:6DO8VFDYM6PTO8VFDYML
TLSH
T11C02C1C176787121E19A61F7C9B31367077D9169043392A32DB258929CC18CAD4261FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download