a5c2c6d99ecbedd455f2b1d928a708e561158f64cf6b18ba6f43f35e3d7a1e19

Analysis

user interaction
yes
max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.ps1
Size 265B
Sample260819-rnalmsfe83
SHA256 a5c2c6d99ecbedd455f2b1d928a708e561158f64cf6b18ba6f43f35e3d7a1e19
MD5 d610c374bd08ca34fdcfb4abffe70379
SHA1 f0bb917b213cd3bbed96b36ffbee5e2c11e9df14
SHA512 f73939f7591db102ca32bdf7c8664b512509be43f81ba22b50e56e3c59e07493f5bfdc70e8294d3aa841be5d0ffcbef4f770c5bb845d7712b8084bf8395a87f0
TLSH
T1D4D02B746715FBBE4A5809A5D51AE151F033345172825191B2EA5C0CDA4340BAA6C03E
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe
5228	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5228	PowerShell.exe
5228	PowerShell.exe
2044	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	PowerShell.exe
Token: SeDebugPrivilege	2044	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 2044	5228	PowerShell.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" "& { = New-Object System.Net.WebClient; .Headers.add(\" "Metadata\, \true\); .DownloadString(\http://168.63.129.16/metadata/instance/compute?api-version=2017-12-01\)};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 baa371d01007bfa9bad185a3d0a62fa2e20b1733fca380ae97a22abc7d939747
MD5 c1365ed2a14966dfcee9769b2199651e
SHA1 e6330f8e7da4d0b9de145d4a8961752c7e097bf4
SHA512 98ee4557d17ef4b2f366d5b6777ad5e8c194e0d16926cc6fc618445fe646c1dc20beb2c0eea80a2e7f39e29d8a476d21ff546808778c59182b875320aaab479a
MD5 SHA1 SHA512

Submit Download

memory/5228-0-0x00007FF9348CF000-0x00007FF9348D0000-memory.dmp

Download

memory/5228-3-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/5228-4-0x0000015FD5820000-0x0000015FD5842000-memory.dmp

Download

memory/5228-5-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/5228-6-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/5228-7-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/5228-13-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download