3a3ac7d29150412e7a3341c035f81f11ab220b6a4593015559d4f82e57b50f8c

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debug/net8.0-windows/JHNM_PowerShell.exe
Size 148KB
Sample260822-xbchcsszhs
SHA256 3a3ac7d29150412e7a3341c035f81f11ab220b6a4593015559d4f82e57b50f8c
MD5 6b784b944fe08191eff96753f79dbcdc
SHA1 c97afff51a01344d535366b68afd85ecfe83151e
SHA512 9fca9252065188d849c2ab78a5bcab4cc10bb744c1f24f24da027a97be9097fe01d56fd56ea424bc6259ce9d2096fcfcbbaa2cc75f04df0d64c120236e755f28
SSDEEP 3072:sqeXA/4yIg9vkNPNu6H6xCYOiVUE265fJa:svgvkNFNaxmNE/J
TLSH
T186E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	JHNM_PowerShell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1980	powershell.exe
116	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Debug\\net8.0-windows\\JHNM_PowerShell.dll"	JHNM_PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1980	powershell.exe
116	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3416	cmd.exe
4360	cmd.exe
4912	cmd.exe
680	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4500	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1212	notepad.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1980	powershell.exe
116	powershell.exe
116	powershell.exe
116	powershell.exe
1980	powershell.exe
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4136	WMIC.exe
Token: SeSecurityPrivilege	4136	WMIC.exe
Token: SeTakeOwnershipPrivilege	4136	WMIC.exe
Token: SeLoadDriverPrivilege	4136	WMIC.exe
Token: SeSystemProfilePrivilege	4136	WMIC.exe
Token: SeSystemtimePrivilege	4136	WMIC.exe
Token: SeProfSingleProcessPrivilege	4136	WMIC.exe
Token: SeIncBasePriorityPrivilege	4136	WMIC.exe
Token: SeCreatePagefilePrivilege	4136	WMIC.exe
Token: SeBackupPrivilege	4136	WMIC.exe
Token: SeRestorePrivilege	4136	WMIC.exe
Token: SeShutdownPrivilege	4136	WMIC.exe
Token: SeDebugPrivilege	4136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4136	WMIC.exe
Token: SeRemoteShutdownPrivilege	4136	WMIC.exe
Token: SeUndockPrivilege	4136	WMIC.exe
Token: SeManageVolumePrivilege	4136	WMIC.exe
Token: 33	4136	WMIC.exe
Token: 34	4136	WMIC.exe
Token: 35	4136	WMIC.exe
Token: 36	4136	WMIC.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeIncreaseQuotaPrivilege	4136	WMIC.exe
Token: SeSecurityPrivilege	4136	WMIC.exe
Token: SeTakeOwnershipPrivilege	4136	WMIC.exe
Token: SeLoadDriverPrivilege	4136	WMIC.exe
Token: SeSystemProfilePrivilege	4136	WMIC.exe
Token: SeSystemtimePrivilege	4136	WMIC.exe
Token: SeProfSingleProcessPrivilege	4136	WMIC.exe
Token: SeIncBasePriorityPrivilege	4136	WMIC.exe
Token: SeCreatePagefilePrivilege	4136	WMIC.exe
Token: SeBackupPrivilege	4136	WMIC.exe
Token: SeRestorePrivilege	4136	WMIC.exe
Token: SeShutdownPrivilege	4136	WMIC.exe
Token: SeDebugPrivilege	4136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4136	WMIC.exe
Token: SeRemoteShutdownPrivilege	4136	WMIC.exe
Token: SeUndockPrivilege	4136	WMIC.exe
Token: SeManageVolumePrivilege	4136	WMIC.exe
Token: 33	4136	WMIC.exe
Token: 34	4136	WMIC.exe
Token: 35	4136	WMIC.exe
Token: 36	4136	WMIC.exe
Token: SeBackupPrivilege	3324	vssvc.exe
Token: SeRestorePrivilege	3324	vssvc.exe
Token: SeAuditPrivilege	3324	vssvc.exe
Token: SeDebugPrivilege	116	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1212	3544	JHNM_PowerShell.exe	85
PID 3544 wrote to memory of 3416	3544	JHNM_PowerShell.exe	86
PID 3544 wrote to memory of 4360	3544	JHNM_PowerShell.exe	87
PID 3544 wrote to memory of 680	3544	JHNM_PowerShell.exe	88
PID 3544 wrote to memory of 4912	3544	JHNM_PowerShell.exe	89
PID 3416 wrote to memory of 4500	3416	cmd.exe	94
PID 680 wrote to memory of 1980	680	cmd.exe	95
PID 4360 wrote to memory of 4136	4360	cmd.exe	96
PID 4912 wrote to memory of 116	4912	cmd.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.exe
"C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.exe"
1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe" C:\Users\Admin\Desktop\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1212
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4500
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableBehaviorMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.dll
C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.dll
1⤵
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a6f2f05965718bc072ca71644afcbed776fdbd3db33e6c460a501177fa5e21e6
MD5 8d1deade86a558baa0001eab3f74b16b
SHA1 3fa436638817cf90a5ddc691d6958b32c6e1f037
SHA512 1d2eac199777a1fa0f4a39c28df940536883bd60c2d96c5902b9da7a55fe709ed81c6a8d82524ccbf3460feef9bfe1f9b240de11ec994c9f4c5c26a0dbc5e6c9
TLSH
T17D112223F38D8920CC96563A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_abxasxxa.0va.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abxasxxa.0va.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini.iv

Path C:\Users\Admin\AppData\Roaming\Fi\desktop.ini.iv
Size 16B
SHA256 fe94d7ea163560221fa9d3dad18fff4b0d82c4d581a0c2d02593668f2422e029
MD5 5dea471ce99fb314b2f57bca310f9003
SHA1 c6fa12d6b7cae6263e7528508c28ef05748a074b
SHA512 1c1d55312d8ebee92abeba937534d0b187d86e8f1d4f29e2ea9133e248f32f1a3d701650626174a52b38ceef45186cb61942aa33b3c155bc4791303855ef1134
MD5 SHA1 SHA512

Submit Download

desktop.ini.key

Path C:\Users\Admin\AppData\Roaming\Fi\desktop.ini.key
Size 32B
SHA256 2089369463c4b36205ab8aaab5fe05c699e6e5c45f31e863e7d23188162af51f
MD5 73f2200869b47c387af9bcf410a6d807
SHA1 f69848c104b218cbca8192a0f8c53f767ebbe4e2
SHA512 ce7101e4d4f7acbdb1f755ba4a397ae1f05912a801a214f52bddea7d887fd6aa8c3fc0c45a303918eb084a7798f93a2d415ca9390e5fa46626adb5a3eafb88b6
MD5 SHA1 SHA512

Submit Download

README.txt

Path C:\Users\Admin\Desktop\README.txt
Size 121B
SHA256 5c6f95084cfabbd01db434b19504aea31dfdbf21e150d8cad221f44dea57351c
MD5 56b292c7ab34cde63d0916d7a04ed2da
SHA1 953b03af7bef8be7bcea26de7de2b3df81aa287a
SHA512 8e0709bc0a6512a0055c1bfc0e57b7d731af0c7cdb346fd42434b8b41988d15671ee470546881d20e85c1cc91af73fb68e3db84e7851b442dccdc6b7680c5306
TLSH
T148B02B2F780F9D0081D021C1171AF04BF700AB0D400607003C0480CD1120985C5C38A8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1980-112-0x000002882B970000-0x000002882B992000-memory.dmp

Download

memory/2772-122-0x000001ECBA310000-0x000001ECBA31A000-memory.dmp

Download