8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
Size 12KB
Sample260910-pbt4eabq5v
SHA256 8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef
MD5 58360eb1e4a6564a371004455f5fb6cd
SHA1 f7b40e83c240d6abdb05c281e1739cb2c6348afc
SHA512 8f166861ea2dd485b54623840ecbc004d6ae2c20cb73b05e53e5965bac1ede54fe58672bb64118ee4731a00258d8cf805d0d6f36706624efe03647fce53cc508
SSDEEP 192:wpHsyZ3dPpvGd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJt2:wpHpZtPpGd1JNsvYlGwAXJk
TLSH
T12E4271E56725922A8872611DCECEA04DF60355331EBB1B15BEBC87312F3A064F27A74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2288	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
3352	svchost.exe
1420	svchost.exe
4888	svchost.exe
3056	svchost.exe
3296	svchost.exe
768	svchost.exe
3260	svchost.exe
2728	svchost.exe
556	svchost.exe
2328	svchost.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 3352	2288	powershell.exe	90
PID 2288 set thread context of 1420	2288	powershell.exe	100
PID 2288 set thread context of 4888	2288	powershell.exe	103
PID 2288 set thread context of 3056	2288	powershell.exe	107
PID 2288 set thread context of 3296	2288	powershell.exe	109
PID 2288 set thread context of 768	2288	powershell.exe	111
PID 2288 set thread context of 3260	2288	powershell.exe	112
PID 2288 set thread context of 2728	2288	powershell.exe	116
PID 2288 set thread context of 556	2288	powershell.exe	117
PID 2288 set thread context of 2328	2288	powershell.exe	121

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2288	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 4956	2288	powershell.exe	84
PID 4956 wrote to memory of 4000	4956	csc.exe	85
PID 2288 wrote to memory of 4036	2288	powershell.exe	88
PID 4036 wrote to memory of 3732	4036	csc.exe	89
PID 2288 wrote to memory of 3352	2288	powershell.exe	90
PID 2288 wrote to memory of 1420	2288	powershell.exe	100
PID 2288 wrote to memory of 4888	2288	powershell.exe	103
PID 2288 wrote to memory of 3056	2288	powershell.exe	107
PID 2288 wrote to memory of 3296	2288	powershell.exe	109
PID 2288 wrote to memory of 768	2288	powershell.exe	111
PID 2288 wrote to memory of 3260	2288	powershell.exe	112
PID 2288 wrote to memory of 2728	2288	powershell.exe	116
PID 2288 wrote to memory of 556	2288	powershell.exe	117
PID 2288 wrote to memory of 2328	2288	powershell.exe	121

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\urhq5sni\urhq5sni.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES15B6.tmp" "c:\Users\Admin\AppData\Local\Temp\urhq5sni\CSCE9FB8C1F632947479FC878D79222B0A9.TMP"
    3⤵
    PID:4000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wlg2nhic\wlg2nhic.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BD0.tmp" "c:\Users\Admin\AppData\Local\Temp\wlg2nhic\CSC4A58C98BAB744C7BA7C2BE389186AF16.TMP"
    3⤵
    PID:3732
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES15B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES15B6.tmp
Size 1KB
SHA256 80c1624b12f1c0bb01fbf489af71c3d8f1c80740ed4a1ce08ce53c0065df1207
MD5 ab8e19c3208ec6bda8eef61ff9cedd9f
SHA1 15eaee4a95a4810e50a993e7f5637d82da92bf0d
SHA512 13a66fc76cafcccb3d178ca0146af4df68e60d6a0e0243e87ecca800af8bd753802b31b29d6a6b907b41b04e8b82df81855a3f4af7b347fb3130b74cb4ff245a
TLSH
T1B821AF4183E8471EF0B35B316AF6172FE275FD65EF65939B854141281C51108EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES1BD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1BD0.tmp
Size 1KB
SHA256 85db70050d21a2251744d8ee6957a9de52f813e2923c369f4b1e3150ded8b199
MD5 6a615f2a540dad7796eb6dedb3d779ce
SHA1 42fd1e1caa9b18f935b0a5263a08b93316b8ca17
SHA512 e7580c24849740889cc62d1fbe47de29347ea500329915036a515b6126cdf185e01b1d3d2edb8e8dcd09f7690622e7dc737d912e2dacf6faea4275fdb2aa1d43
TLSH
T18D21AF1583E84B1FF0B757317DFA136FA234FD94EFA2935B854052281C91544EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wnz345ve.wlo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnz345ve.wlo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

urhq5sni.dll

Path C:\Users\Admin\AppData\Local\Temp\urhq5sni\urhq5sni.dll
Size 3KB
SHA256 c24a376d608ca809e213932142baf3b10031092e46c4689aac9dfa5794477427
MD5 23787174a9db724297f060aeb26c402b
SHA1 1bb714394e9773b8b3ee0c0a2302dcf8fe92c1c6
SHA512 f68a76869fa4c5a31c20c00c4c6b5a92f5d87dcc47817c67ea10efdf40301b1506c7123f997a2a0ed40bc3b6578d4e38347c699486fe8e42b1971e2d17469750
TLSH
T1F151CB0697E84667E4770730AEF3472637B9FC148BB3635E09904218BCA57545E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

wlg2nhic.dll

Path C:\Users\Admin\AppData\Local\Temp\wlg2nhic\wlg2nhic.dll
Size 7KB
SHA256 9f13f3b3aa17665b8180063acaca1097f0804011a4571c450d242582741507b8
MD5 0d6f431e345b0523c5381f58dcf22678
SHA1 919d20efbe52c25e2ef2118461788b75716fa17f
SHA512 d965fb719b4326a072cb73bbf78a5c20f871a4c817e278a47764cd65952a58f209ad80047c0d7c086c89ef34bb7a88d03eda23546152121f21108dfff6492834
SSDEEP 96:LguYgZxIVIkaxN3rISmCU2YCaMNdQXkLaQwK:LguYgEda/3yJCrvZay
TLSH
T1CEF1F95ECB8C8276E95E0B39A8F3060167B4C4448F339A5B19ECD1073E67B991B633E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE9FB8C1F632947479FC878D79222B0A9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\urhq5sni\CSCE9FB8C1F632947479FC878D79222B0A9.TMP
Size 652B
SHA256 38c460faae0a85e0cfd105a69164832c4e4a0966cc8fb455953fc593e422304b
MD5 48b134db04f3d7c56b09392a6ec10c3b
SHA1 129e25589cac39caf743414e693a354520514aac
SHA512 c1600d27cef989ec88bce95bc24b65a08787360fc4a409f0b9901e8e60afb6c5d71e1b8c9f196674df3543ff5ae75b1728aaef2be2767f3e3f93a26b6b34a102
TLSH
T17BF05E49A3F8420EF0F34F30BEF6936391A9BC65DE3293ED1580032928646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

urhq5sni.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\urhq5sni\urhq5sni.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

urhq5sni.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\urhq5sni\urhq5sni.cmdline
Size 369B
SHA256 a41a36ac44a6e1e11580147aef4183746166b69623920384942d040b03a66dd7
MD5 534723b4011808308c0cb72c064af5c6
SHA1 f1ed7e95468be26c15fa19d5711b72937bf0871f
SHA512 8c31e727841aaf8f486c55a7188ad7e6b48476f22185e172a89349ab952d56ffaff3a39f23b3a0e51c22a17cb1c5974c886cd06dac3cbb37a105f9599868ecbd
TLSH
T1A6E0C62BC2C6C37E12ED184B227AC6BCC2760F832980BFC4A248840DE02F2003FD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4A58C98BAB744C7BA7C2BE389186AF16.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wlg2nhic\CSC4A58C98BAB744C7BA7C2BE389186AF16.TMP
Size 652B
SHA256 2e6cb772b2e509b507c83222d8728a3e91449428844c405678018317f250abd4
MD5 64340e4549a1ea9a300e17100f50507b
SHA1 73f43e01a613b3dbe1707167efcc324b31c5b5fa
SHA512 9e95d3089a9187be0d67b123c3f8ae3a1fdd29d15bb15d7d3500e2364a9211e89281a6bbe3bbe25765dc34903ab302754a061ae70d9ccdbc1cddbe6ca1d5dba3
TLSH
T15AF0540A63F8060EF0F34B31BDF553A79568FCA4DE3253ED1480131918649149971FB1
MD5 SHA1 SHA512 TLSH

Submit Download

wlg2nhic.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wlg2nhic\wlg2nhic.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlg2nhic.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wlg2nhic\wlg2nhic.cmdline
Size 369B
SHA256 73cec7b23c8d387c5dd6d276ddbdee43dc152e2b2ce0e9da4e0020baea9a26f8
MD5 83633e14df97b05ccb40b0b0705f9f3c
SHA1 8e70daa38c45bd3ca0f80162c16cdf63fbfd3dd7
SHA512 53dbfe26f0018015ae237d6537093a808155c914dcf4e8175ba51a45f48a1b0bc9b5d453cee734d84c98e65c3df7e39637c9ac642bdda331eb655bf54aad81b7
TLSH
T12CE0D83B9266C67E15E91007216EC5AC93720A4F6A417F84D191885DE027164A7D1B96
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-55-0x00007FF6BA9A0000-0x00007FF6BA9E8000-memory.dmp

Download

memory/768-49-0x00007FF64BA80000-0x00007FF64BAC8000-memory.dmp

Download

memory/1420-41-0x00007FF7C4470000-0x00007FF7C44B8000-memory.dmp

Download

memory/2288-35-0x000001D872B30000-0x000001D872B38000-memory.dmp

Download

memory/2288-0-0x000001D86FE00000-0x000001D86FE10000-memory.dmp

Download

memory/2288-39-0x000001D86FE00000-0x000001D86FE10000-memory.dmp

Download

memory/2288-38-0x000001D86FE00000-0x000001D86FE10000-memory.dmp

Download

memory/2288-1-0x000001D86FE00000-0x000001D86FE10000-memory.dmp

Download

memory/2288-22-0x000001D86FDF0000-0x000001D86FDF8000-memory.dmp

Download

memory/2288-9-0x000001D86FDC0000-0x000001D86FDE2000-memory.dmp

Download

memory/2328-57-0x00007FF7170F0000-0x00007FF717138000-memory.dmp

Download

memory/2728-53-0x00007FF633320000-0x00007FF633368000-memory.dmp

Download

memory/3056-45-0x00007FF732B50000-0x00007FF732B98000-memory.dmp

Download

memory/3260-51-0x00007FF642A40000-0x00007FF642A88000-memory.dmp

Download

memory/3296-47-0x00007FF60A6A0000-0x00007FF60A6E8000-memory.dmp

Download

memory/3352-37-0x00007FF6B6C60000-0x00007FF6B6CA8000-memory.dmp

Download

memory/4888-43-0x00007FF7E5E80000-0x00007FF7E5EC8000-memory.dmp

Download