b930b360a3ef1f29e43eccca916a1c74fd629070d43ec5a599554b2d0d617ca4

Analysis

user interaction
yes
max time kernel
3s
max time network
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 2KB
Sample260815-mdncjatfpc
SHA256 b930b360a3ef1f29e43eccca916a1c74fd629070d43ec5a599554b2d0d617ca4
MD5 7f9c1ffd8249721728854f64c3b2dd4c
SHA1 93b0fb5a85c5c184e4f75b18ab3882cfa106a1aa
SHA512 48bca253eccb8515da6123e8548c4f26615aadf922c3316ffce101f8c0cdf6063e98769fcbd4a2641a347afc5adea54b87f14d102fea734b670afbf878c0a8b2
TLSH
T11751A776A65E9B9041B047B2E951F620FF6510FF05382185F7D9C16C1FF1E1C42924FA
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1052	powershell.exe
2496	powershell.exe
5220	PowerShell.exe
4680	powershell.exe
2132	powershell.exe
720	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5220	PowerShell.exe
5220	PowerShell.exe
720	powershell.exe
720	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	PowerShell.exe
Token: SeDebugPrivilege	720	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 720	5220	PowerShell.exe	90
PID 5220 wrote to memory of 2132	5220	PowerShell.exe	92
PID 5220 wrote to memory of 4680	5220	PowerShell.exe	94
PID 5220 wrote to memory of 1052	5220	PowerShell.exe	96

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Start-Sleep -Milliseconds 500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1d0773fee6487253ee25c0d9def690f84b2311dd85e84445e93123aa8fde9b6a
MD5 f4b84c6f74c09fb86973542bce5a6451
SHA1 46db7d27794e1b362d7c26d1036f0aeb58005897
SHA512 583fbb49957177ce09b4189ff5123e71b50b228a8909cf905d4ba7d54e3f24051dd885277f2e41293e1df7595fc526e6b0d88b9a9b26cb11864be0101703a86d
TLSH
T148215937B3DC8614DC9A413A50CEAC1136B6C7DB809ECFABBB84D544A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3cwwhv0x.upw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3cwwhv0x.upw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download