bc5c6707094aa3989a242b0f1f920a74dee42d4589b49eb6ecf1dfbe4eaafdf5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_bc5c6707094aa3989a242b0f1f920a74dee42d4589b49eb6ecf1dfbe4eaafdf5.ps1
Size 884B
Sample260909-2chg8a1gph
SHA256 bc5c6707094aa3989a242b0f1f920a74dee42d4589b49eb6ecf1dfbe4eaafdf5
MD5 9f00f9f7b43b93acc9e478017b93b001
SHA1 15f0ff9fc06bf45a7f262d4f52c2c82e0cdd7212
SHA512 fa377efad351910d85c134cf9900a0ead84729d16d054777543dd6056dfb06cf67ea46859eb7d711269a21e6b24c868db4d812eb62256c27d61a64793b6c6158
TLSH
T10711C0186243C3345483640ED685C02DEA3F76712A789A50CDE9D6029E97C48D7FEBA3
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2688	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2688	PowerShell.exe
2688	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4420	2688	PowerShell.exe	91
PID 4420 wrote to memory of 5424	4420	csc.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bc5c6707094aa3989a242b0f1f920a74dee42d4589b49eb6ecf1dfbe4eaafdf5.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aicl5p0h\aicl5p0h.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52E9.tmp" "c:\Users\Admin\AppData\Local\Temp\aicl5p0h\CSC91B096DCC1B4E73A6F75572263160.TMP"
    3⤵
    PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES52E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES52E9.tmp
Size 1KB
SHA256 89553daa706a7d2d0bf18f608c127f9bd4df78f2cf7c6d40f8f5e80c3c271357
MD5 5004af59e44aa098949682c558a03b93
SHA1 bfc9cf323f507c731d1942e768f2bd8982684a9e
SHA512 a2f1ab37cd818292bb6fe7f2b22b16ae2bd9bd757dbcefa9b7306aadfcf1b1625ac1e9a7592473ba8621f16205c10b4b1571fc37bca3007cdf9e0dc97294a8fd
TLSH
T1FC21AA0593E94B1FF0B3573269F6031BA238FCA8EF62A75A954452182C41144EFA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

aicl5p0h.dll

Path C:\Users\Admin\AppData\Local\Temp\aicl5p0h\aicl5p0h.dll
Size 3KB
SHA256 9c94557ffcbc28dbbe16bca81d7d9bfd1b78b23f108371340c7cb35f98f7bc0e
MD5 5731911cd51e396c5060ea13402094c9
SHA1 952d918fc971fe45cc2334ea9d9bcdfa1ee327b6
SHA512 23c539d56aa5fbd726c55298058f755673692081ebaaf73d3c557c5bf806e130405ea536b50a403f94e92a1e7564b8f842d7d7e0548bbe118797a8d70dc992d5
TLSH
T13371E117E3D84667F4B707316EE3031623B4E8648B7397AF0D8102197CA02700E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC91B096DCC1B4E73A6F75572263160.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aicl5p0h\CSC91B096DCC1B4E73A6F75572263160.TMP
Size 652B
SHA256 792605f230bf2affc9fb9d40fe68b7382eea6884e03f038dada8978e1807ce03
MD5 6545de6fb46b693634d3934811a7fa7e
SHA1 3bdec428b16750d4714a4cb69aa969cda0d852e4
SHA512 7f263b55ca5e0720ff3d4ef1ba8da7ce16f77719e375995daed2cc2d8389602f02bbf38df30846ffcceceb2fbe88600ce7b4699d6620a3cec4783a8bb4680cd2
TLSH
T106F0544963F8120EF0F35B30BDF54363956DBC65DE3253ED1481131928645108A61F71
MD5 SHA1 SHA512 TLSH

Submit Download

aicl5p0h.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aicl5p0h\aicl5p0h.0.cs
Size 455B
SHA256 0ac1698f8c7bfa8318fba310fd5e9e42697c3896f4fe0abb2979525166e880e8
MD5 b1688ab4e34fe42bdbe1e6a95f640868
SHA1 e8521f3db3baba9f4e77fe4a377d12ea996ef70b
SHA512 d2a8a72afc04d12ddc3b32dd824a123c911078bd247951f6b2fa36298f681f1a7601880d3114c00b528b553d8f50faa3bf53896acd95e4af9f685e22d7cea0f0
TLSH
T14AF05C082782F7390483A81DC942C03DF727617037B51A1086E957128ED740CD77E737
MD5 SHA1 SHA512 TLSH

Submit Download

aicl5p0h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aicl5p0h\aicl5p0h.cmdline
Size 369B
SHA256 a984a5622d43060b6cc7dd5e3d5dbf2cd7ca0f266edc0713f6d518678aa1ed92
MD5 b24665e79c9722f23cb360d18e61186b
SHA1 8e7a39d9f243144f3247733fd09e3c4b1be5fceb
SHA512 a58c178c198ef287583ff88446ca14e4457ca0072304197c79356addbfcd1f2276f89e35ca29d22a462af3c6fb47502ff1e718517e594e7ae03b41e076dd5b8b
TLSH
T1E7E06F3BC34EC27E05E9200B666AC4ACC27306832986FFE8A248840DE0370002BD278A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2688-7-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-8-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-12-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-0-0x00007FFB0CABF000-0x00007FFB0CAC0000-memory.dmp

Download

memory/2688-6-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-5-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-22-0x00000253B8210000-0x00000253B8218000-memory.dmp

Download

memory/2688-4-0x00000253D07B0000-0x00000253D07D2000-memory.dmp

Download

memory/2688-1-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-23-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-24-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download

memory/2688-26-0x00007FFB0C930000-0x00007FFB0D2D4000-memory.dmp

Download