5c1e32ebfe41482a64998d151636c55de4a70897c7661dca04bcec9cad04f06b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bombthreat.ps1
Size 47KB
Sample260910-pr2s7atcjh
SHA256 5c1e32ebfe41482a64998d151636c55de4a70897c7661dca04bcec9cad04f06b
MD5 2c39060618164ca0207d83a556dd4c2f
SHA1 3b263a5b5497fcdb55e86d49c9ac03eb3cc8b26e
SHA512 9512986056aebe99e524aee25e0fc65b6526314d9d62a18e966c9f6a7106e686dae5e2413ba927a774e08d2fd51c3a52334017383b1701ba0167974294927f96
SSDEEP 768:gMWgBpHvCldtfsO/GbPRTUZFiFy6APHbZ57tsGvVaN5KAnVwmSX+gc43K/i:gMjHEdtUNnFrYfcdnVwmSXU46K
TLSH
T1752302F9B8A6871105CA74BF50CBAFB37930BA3D7389AD4D764259BD32E1F1142B0601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2096	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2096	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2096	powershell.exe
2096	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 736	2096	powershell.exe	85
PID 736 wrote to memory of 1484	736	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bombthreat.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2f5jxj1h\2f5jxj1h.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB28.tmp" "c:\Users\Admin\AppData\Local\Temp\2f5jxj1h\CSCEE04537DA8934758AA647EE1D1C231E8.TMP"
    3⤵
    PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2f5jxj1h.dll

Path C:\Users\Admin\AppData\Local\Temp\2f5jxj1h\2f5jxj1h.dll
Size 149KB
SHA256 c4d380097d62c238c5a12336e81116018aedb27a750e8db601f1d48b6b8a25a1
MD5 0724ef513d1974ec2c38a104209bf70c
SHA1 284c8826fb1aa8c2061c72bfbd277cd4d6896064
SHA512 4917227a402bb4d006717828c555162995c6b4b88b47ebc0f4b3b5d1c1d140f9c265af94839c7f91c0b42a6788df2f4d7b143cd6c43afb91abe25eac171413bb
SSDEEP 1536:RcMiCl4WcNqGgLWA9u12Gyi9rsxoTXYl19+FYAZXkLg2gTtdeATl3hdph8ZvyyVb:RcWlSNqZDHen/JU/xz
TLSH
T1DFE3FF29F9FA312ED122F2B18FD9C94ED756B475523B4A1F0292238B43658027F4277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESDB28.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDB28.tmp
Size 1KB
SHA256 4bd0efa2bb3726f03517ab869e2ae37ba99eece4289f968b57ae6e72a845cb06
MD5 1b0d68742a65582fd338cb3883b44181
SHA1 500b023eccadc102f62f691c4c5a64d4c1eb390c
SHA512 3a218fa4afed1fefb89901186043eb816b52747cb24378bd904c8152cd1559c6d726992314d96cf5312156ee41f914325291f95402c0b89face3ac41db6316d2
TLSH
T17D21AF0593E84B1FF07347326AF6471B9239FDA4EF62A35B854141282C51504EFA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u0hgw5nb.wsa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u0hgw5nb.wsa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2f5jxj1h.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2f5jxj1h\2f5jxj1h.0.cs
Size 78KB
SHA256 d0dde3dd8555fb7b7f21f080fbc8403f68d102e78739b95d30d75b265519aacc
MD5 3c5d21d1518c9e3813cc9314e3bf32b5
SHA1 86a1933edcc1cf3b7b17a138462b3c225495761d
SHA512 1ab24b76d3dedfc0942c1a98f0d14edb181937af84bb96344129dd66f59ebe66fd3d4b25e51e3864b2bf68768c6dfbe00bada87d3582f84b14e7c4f1babf5f78
SSDEEP 1536:s5MxoKZOib6BVerD7KV2CbnedyMc3ghHj5nuEH:s5MhN6BsxCb+yhWj5tH
TLSH
T1A283E819F9427F5C721D921129622C80642BB3232E097946736F48CC6F6DBDFAE7942F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f5jxj1h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2f5jxj1h\2f5jxj1h.cmdline
Size 369B
SHA256 7997450e83c7bba98029c64ab87eed86ec2672f208a46af41a27ed905032a382
MD5 407594fd2aec2559c3b8e71d6e0a578f
SHA1 b26f79710bda384489f6d2e2aba3b46f3615b881
SHA512 70a54ae00d9d0a03bd6710ae3bacba91b1e53b0c5f6cc18cc18c591e089cfd40b5d6aff2688e475306142450f8445dc7489058f5a15a894716c12790715b4c74
TLSH
T158E0C03A569AC2BD85DE100727E9C4ACC273179339483F846040884FD05701067E1FC1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEE04537DA8934758AA647EE1D1C231E8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2f5jxj1h\CSCEE04537DA8934758AA647EE1D1C231E8.TMP
Size 652B
SHA256 56aacf8fc0b69e89caa7a20501076a428920a0aad3dd30b304a0bb68e68075fe
MD5 1992ce4b9677aed68d0e0bb45838038c
SHA1 5702fca05d837a3d1301ba8ca7a79324a50021af
SHA512 d0e4edbfdcf07273b878f6164dc711f3c61a55cd8c7de5c0742aced36a95eac71fb81e5c16a825c3ff07a8f6ea814ca2c1dec2372080a236d8d2f90dccaf0c64
TLSH
T1A3F05E0963F8420EF4F38B71BEF683A395A9BC64DE3293ED5581032928655109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2096-1-0x000001BAFF080000-0x000001BAFF090000-memory.dmp

Download

memory/2096-0-0x000001BAFF080000-0x000001BAFF090000-memory.dmp

Download

memory/2096-2-0x000001BAFEFF0000-0x000001BAFF012000-memory.dmp

Download

memory/2096-22-0x000001BA9A3D0000-0x000001BA9A3FC000-memory.dmp

Download