e04d51956b68a863efc95c041ea45b5d4ef19fc0ad163ae7029187dd6596216d

Analysis

user interaction
yes
max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 13KB
Sample260822-2a9tpagf39
SHA256 e04d51956b68a863efc95c041ea45b5d4ef19fc0ad163ae7029187dd6596216d
MD5 6ab69991ca6c494293ec12863be7f145
SHA1 62e8c647b206a037fbc1e41be474fb994a634399
SHA512 97138ed896cf1f199bbad30b0860a68161d9545a66a8ed079ef16ef5854c2c6f57c80cbf2a73ed8e5dc16a93d690f6819039296c7e489053fe0a8f9bec3aecf4
SSDEEP 384:i06mGZDpsjUW+i8i1T0iti4lbl1R46JAsCWM:/QGxPx1Tpc4lhpJ0WM
TLSH
T18352B7623D4935619273DF39DAA39349FA36003B92170A14B99CD2D08FB4F2687E5F88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command \"while($true){Start-Sleep -Seconds 1}\""	powershell.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	4500	powershell.exe
12	4500	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4216	powershell.exe
4500	powershell.exe
4588	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
10	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3460	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4216	powershell.exe
4216	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4588	powershell.exe
4216	powershell.exe
4588	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe
4500	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeBackupPrivilege	2256	vssvc.exe
Token: SeRestorePrivilege	2256	vssvc.exe
Token: SeAuditPrivilege	2256	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4992	WMIC.exe
Token: SeSecurityPrivilege	4992	WMIC.exe
Token: SeTakeOwnershipPrivilege	4992	WMIC.exe
Token: SeLoadDriverPrivilege	4992	WMIC.exe
Token: SeSystemProfilePrivilege	4992	WMIC.exe
Token: SeSystemtimePrivilege	4992	WMIC.exe
Token: SeProfSingleProcessPrivilege	4992	WMIC.exe
Token: SeIncBasePriorityPrivilege	4992	WMIC.exe
Token: SeCreatePagefilePrivilege	4992	WMIC.exe
Token: SeBackupPrivilege	4992	WMIC.exe
Token: SeRestorePrivilege	4992	WMIC.exe
Token: SeShutdownPrivilege	4992	WMIC.exe
Token: SeDebugPrivilege	4992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4992	WMIC.exe
Token: SeRemoteShutdownPrivilege	4992	WMIC.exe
Token: SeUndockPrivilege	4992	WMIC.exe
Token: SeManageVolumePrivilege	4992	WMIC.exe
Token: 33	4992	WMIC.exe
Token: 34	4992	WMIC.exe
Token: 35	4992	WMIC.exe
Token: 36	4992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4992	WMIC.exe
Token: SeSecurityPrivilege	4992	WMIC.exe
Token: SeTakeOwnershipPrivilege	4992	WMIC.exe
Token: SeLoadDriverPrivilege	4992	WMIC.exe
Token: SeSystemProfilePrivilege	4992	WMIC.exe
Token: SeSystemtimePrivilege	4992	WMIC.exe
Token: SeProfSingleProcessPrivilege	4992	WMIC.exe
Token: SeIncBasePriorityPrivilege	4992	WMIC.exe
Token: SeCreatePagefilePrivilege	4992	WMIC.exe
Token: SeBackupPrivilege	4992	WMIC.exe
Token: SeRestorePrivilege	4992	WMIC.exe
Token: SeShutdownPrivilege	4992	WMIC.exe
Token: SeDebugPrivilege	4992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4992	WMIC.exe
Token: SeRemoteShutdownPrivilege	4992	WMIC.exe
Token: SeUndockPrivilege	4992	WMIC.exe
Token: SeManageVolumePrivilege	4992	WMIC.exe
Token: 33	4992	WMIC.exe
Token: 34	4992	WMIC.exe
Token: 35	4992	WMIC.exe
Token: 36	4992	WMIC.exe
Token: SeDebugPrivilege	4588	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4712	4500	powershell.exe	86
PID 4712 wrote to memory of 2184	4712	csc.exe	87
PID 4500 wrote to memory of 4216	4500	powershell.exe	88
PID 4500 wrote to memory of 3460	4500	powershell.exe	90
PID 4500 wrote to memory of 4992	4500	powershell.exe	93
PID 4500 wrote to memory of 1356	4500	powershell.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Modifies WinLogon for persistence
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m5xqeszo\m5xqeszo.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B72.tmp" "c:\Users\Admin\AppData\Local\Temp\m5xqeszo\CSC70110847A55F4B8BAD35540F584495D.TMP"
    3⤵
    PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\system32\vssadmin.exe
  "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3460
- C:\Windows\System32\Wbem\WMIC.exe
  "C:\Windows\System32\Wbem\WMIC.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\system32\mshta.exe
  "C:\Windows\system32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\\darkside_lock.html"
  2⤵
  PID:1356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "while($true){Start-Sleep -Seconds 1}"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

RES1B72.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1B72.tmp
Size 1KB
SHA256 918cc7b776c2b2ca7f702382b9b32dda4df245c56b6d2a679dfdef1ce396cb12
MD5 b695a0afcb402138fb43aaf1df70c6e5
SHA1 e3715e594c8976e23fc260785a1a07d4d027dfa4
SHA512 c24c3c0c1d6b0c12ae9840c3fe085555f5409ea2eaf34026d8d90c8b52e2164c43e58511ef816c90274bcd8f112fe4796be6cdaefe05a2b9ef6458ab5eb39d01
TLSH
T185218C0583E9871EF0779B3169FA136BD238FD54EF62635B8544422C2C81614EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_40cezycz.j4a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40cezycz.j4a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

darkside_lock.html

Path C:\Users\Admin\AppData\Local\Temp\darkside_lock.html
Size 4KB
SHA256 3f2534eae9f8b9ebb81b4e0156972c1b3820b3180a4a2d211560281a473048fe
MD5 3093f5e3b4eadd82fd49b61c3fc88e66
SHA1 0618fe1212a29f92d0df9cb5e2bf1239495adbdf
SHA512 721986e41320023bfe105085ad9bc25a689bcf5904e35587748ab51252c4a3b992941442e31af90bc2225651d8999460ccc77eabae8e6088b47ccac2e296ee98
SSDEEP 96:fZ7/nFNprgGPyFVr5olXdi8i1DPP0ifwei4stGG4bc:fZzXprgGPyFVtWti8i1T0iti4lc
TLSH
T153A18277691419626373F37AAB73C749F534110350030F68BD9C2592CFBA9120AE2FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m5xqeszo.dll

Path C:\Users\Admin\AppData\Local\Temp\m5xqeszo\m5xqeszo.dll
Size 3KB
SHA256 b145787185c482b67a6b490e5a6b61ed848ba2ef5485982ca09998f0e98b60af
MD5 25b4aa0b8aa459407bea83f74ab32439
SHA1 98d10da3ce96f12273414cbe8119a794aad100de
SHA512 753f09211a34b0b023fcf896dc9d19fa10472829c05c2c2bd0bd7f6cbddb37a2bcc3cb09b1bd8ea69aa7ffe74dc8ee6d428b22cba264b18162f808c9ed304903
TLSH
T1AF51AC1697E8852BE4B70B34AEF3475767B4F8509FB3536E48800228ACA17645D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC70110847A55F4B8BAD35540F584495D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m5xqeszo\CSC70110847A55F4B8BAD35540F584495D.TMP
Size 652B
SHA256 fc2b086702e9371c1993be705e119d823ebdb3c614d24a94334d1c66656524a4
MD5 9f4ae6949550183a9c7c6e58ca436920
SHA1 4e5d6ba674d1ed0f592478d145a9f83909d90795
SHA512 1c4aaba7039cd6a6878998181499947f77d916dacc9b57da36e65b2620f52274225c599e5cbd80c8b421ca58eeb73c0c4383a71231e7c113341988135f611db8
TLSH
T176F0540963F8420EF0F34F30BDF54363D168BC64DE3253ED1444035928A46108971F72
MD5 SHA1 SHA512 TLSH

Submit Download

m5xqeszo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m5xqeszo\m5xqeszo.0.cs
Size 170B
SHA256 55bb19b58f1e8cc33b461847e8079a910251e4e66e4ec6a22f4ec2bc1b308408
MD5 7c3b8651a72b2201b6cb4e9e4cab04ec
SHA1 cda010b1c8c58a8d8b20ee6bb77c46a6fafc0f21
SHA512 3bc0062442cafd277bbdaea4a1eb4a56c34c219b3f508cb3d6ec33a8b8c43c9f79f0ef618f4194d8d76fe51d16fa75982075372e626702071d4a32817b942b54
TLSH
T12FC080257E576AF600024D170C42F0FD77B711742667251596D55310FF4E00D4130A55
MD5 SHA1 SHA512 TLSH

Submit Download

m5xqeszo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m5xqeszo\m5xqeszo.cmdline
Size 369B
SHA256 9129d18923e8f81fb663fa947695a9f97d249ef57cb4b9f4965e0b7768fdd322
MD5 bfae48cb07b1b0b946939b22a7eaf06e
SHA1 184f09cacff880b2ed30fc8a78895ad20fc1ad91
SHA512 2acb25a9ba979b4040e5e6d12fec67efbb4f86e594e0fd9a77edc59abe5f334d0f5e6fcf2b6cc74d66c4d5c5dcacaf7841a66a4b521f89c5b1f16e9c720092ce
TLSH
T1E6E0C02AC247C77D2EDD700FA3ABD4ACD27647432B403FC45051440DD49B000A7D17C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4216-27-0x000002681EE20000-0x000002681EE30000-memory.dmp

Download

memory/4216-71-0x000002681EE20000-0x000002681EE30000-memory.dmp

Download

memory/4216-70-0x000002681EE20000-0x000002681EE30000-memory.dmp

Download

memory/4216-26-0x000002681EE20000-0x000002681EE30000-memory.dmp

Download

memory/4500-23-0x000001F7F0960000-0x000001F7F0970000-memory.dmp

Download

memory/4500-25-0x000001F7F1DE0000-0x000001F7F1FEA000-memory.dmp

Download

memory/4500-24-0x000001F7F1A50000-0x000001F7F1BC6000-memory.dmp

Download

memory/4500-0-0x000001F7F0960000-0x000001F7F0970000-memory.dmp

Download

memory/4500-56-0x000001F7F1FF0000-0x000001F7F21B2000-memory.dmp

Download

memory/4500-57-0x000001F7F26F0000-0x000001F7F2C18000-memory.dmp

Download

memory/4500-67-0x000001F7F0960000-0x000001F7F0970000-memory.dmp

Download

memory/4500-68-0x000001F7F0960000-0x000001F7F0970000-memory.dmp

Download

memory/4500-69-0x000001F7F0960000-0x000001F7F0970000-memory.dmp

Download

memory/4500-22-0x000001F7D82D0000-0x000001F7D82D8000-memory.dmp

Download

memory/4500-9-0x000001F7F0900000-0x000001F7F0922000-memory.dmp

Download

memory/4500-1-0x000001F7F0960000-0x000001F7F0970000-memory.dmp

Download