dde85c33ec65788429415a8fa1d1c429e43c1082e6cc2ff983db08d2ab7289fa

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bombthreat.ps1
Size 47KB
Sample260910-pqa9vawzbs
SHA256 dde85c33ec65788429415a8fa1d1c429e43c1082e6cc2ff983db08d2ab7289fa
MD5 c069a372cdee0979b56d93d750a3c220
SHA1 f36e5128de2121566a102b4cb7db3a4207a73436
SHA512 9dcd77d9f2b12f1a0b4cd46a1696494693b9e6043228cd63e98cd2a96cfa86e0d7c6b62564d8cb8f0863ed440399cc9d349aff54289ce4de0e7dbc85d46ef940
SSDEEP 768:gxOPmhxNkb3Ey02EUFJM6Npe4/wHDYnE7Ucbcl+2FJjbs/JO5m3QejLmWO+opvuU:gxO+lkbU2zvFwHcn9hjjOJZS+jTvA
TLSH
T10723124103B2BC00A1F5D2DFF6821B594CECD414A321AD91E8F047E53D8B6A17FA7463
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1280	powershell.exe
11	1280	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1280	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	powershell.exe
1280	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3648	1280	powershell.exe	87
PID 3648 wrote to memory of 3676	3648	csc.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bombthreat.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mmfaoc4f\mmfaoc4f.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9F5.tmp" "c:\Users\Admin\AppData\Local\Temp\mmfaoc4f\CSCFF66B6BF18AA425BAEA6DD679A38EE76.TMP"
    3⤵
    PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESD9F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD9F5.tmp
Size 1KB
SHA256 899fdc81cb91fe88d14af0aa6af15d330a5a1b73508523c9bce8ea66445e6619
MD5 581b8ae08b806287c955329cc562a525
SHA1 2830772c537d1a88c55db81ff860fcdd6ad0ba33
SHA512 a5d6ca6f4cc60014f2168acd12c351f507da15f31cd991b60245c9e95b3a98e1919ad2cd96abe9c284f9222cddc9b8913e13e53d4417d593bac90a744dc611d0
TLSH
T165216A0583F84B1BF0735731A9F5136FA664FD64EFA2935A8540422C2C51544EFA0AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_50uwjnvv.xwk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50uwjnvv.xwk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mmfaoc4f.dll

Path C:\Users\Admin\AppData\Local\Temp\mmfaoc4f\mmfaoc4f.dll
Size 149KB
SHA256 dc509949626689d8f1ce3b1dc36b650e52610d561c048490092db057a52b7e64
MD5 15b11a2e72d3df968e17a80f8f44f38d
SHA1 d44a865d1a1e292607110c5940fe10cafabb0abf
SHA512 411dce244f4a3005a70c7aa36992be6ce4f3d564ad6f49e11e4bc2c56d46afd7757e0de5f5042388c0896fb087fcd5ba7be0ec834c2aa0fee25c7450bfaf5b86
SSDEEP 1536:ccMiCl4WKNqGgLWA9u12Gyi9rsxoTXYl19+FYAZXkLg2gTtdeATl3hdph8ZvyyVb:ccWlwNqZDHen/JU/xT
TLSH
T1BEE3FF29F9FA312ED122F2B18FD9C94ED756B475523B4A1F0292238B43658027F4277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCFF66B6BF18AA425BAEA6DD679A38EE76.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mmfaoc4f\CSCFF66B6BF18AA425BAEA6DD679A38EE76.TMP
Size 652B
SHA256 ee523a1d738df28f7078f1867a6f77dfa1bbc451f5a3fef16d18da96f2ce1eb5
MD5 c71a01e0c760f1b1ef3d3e5963a64829
SHA1 2cfe4dc501c17c6ffb40375258ceac7b5cfcc2c1
SHA512 8456977aa3ed781bb091b566d6ef89bc2742b8988caefca79d9e29c0e3f195d6f810f29e847c1b742eb8edf7fe04c8e70a6c1419ae7272789f58edc6c5403d58
TLSH
T1A9F0540963FC020EF0F34B30BDF543A7A5A8BC64DF7253ED1444031958645108A61FB6
MD5 SHA1 SHA512 TLSH

Submit Download

mmfaoc4f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mmfaoc4f\mmfaoc4f.0.cs
Size 78KB
SHA256 d0dde3dd8555fb7b7f21f080fbc8403f68d102e78739b95d30d75b265519aacc
MD5 3c5d21d1518c9e3813cc9314e3bf32b5
SHA1 86a1933edcc1cf3b7b17a138462b3c225495761d
SHA512 1ab24b76d3dedfc0942c1a98f0d14edb181937af84bb96344129dd66f59ebe66fd3d4b25e51e3864b2bf68768c6dfbe00bada87d3582f84b14e7c4f1babf5f78
SSDEEP 1536:s5MxoKZOib6BVerD7KV2CbnedyMc3ghHj5nuEH:s5MhN6BsxCb+yhWj5tH
TLSH
T1A283E819F9427F5C721D921129622C80642BB3232E097946736F48CC6F6DBDFAE7942F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfaoc4f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mmfaoc4f\mmfaoc4f.cmdline
Size 369B
SHA256 67068eda745177e48afcbe1a6189e3c096d34a4ce61795c0d8564111ae26f752
MD5 51d3c0e5084ab39872ac6c387ed8be4c
SHA1 8bb89cf7c554d62d42808ad21eea4eb670f28cf2
SHA512 af245c7f7e7d4f9187d0e2c74b64f71da7c20aea2fabe39d677e5da8d83cc53a37f7842b8aad05cfb541385392008cc78decc6848bb92600632421bc22bad5e8
TLSH
T19CE0C02A82CECA7D13DD100722A9D5BCC3F2074339423FE450404C0DD457000A7D1763
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1280-0-0x00000225336B0000-0x00000225336C0000-memory.dmp

Download

memory/1280-1-0x00000225336B0000-0x00000225336C0000-memory.dmp

Download

memory/1280-9-0x0000022535890000-0x00000225358B2000-memory.dmp

Download

memory/1280-22-0x0000022535860000-0x000002253588C000-memory.dmp

Download

memory/1280-24-0x00000225336B0000-0x00000225336C0000-memory.dmp

Download

memory/1280-23-0x00000225336B0000-0x00000225336C0000-memory.dmp

Download