5c1e32ebfe41482a64998d151636c55de4a70897c7661dca04bcec9cad04f06b

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bombthreat.ps1
Size 47KB
Sample260910-prh13stbpe
SHA256 5c1e32ebfe41482a64998d151636c55de4a70897c7661dca04bcec9cad04f06b
MD5 2c39060618164ca0207d83a556dd4c2f
SHA1 3b263a5b5497fcdb55e86d49c9ac03eb3cc8b26e
SHA512 9512986056aebe99e524aee25e0fc65b6526314d9d62a18e966c9f6a7106e686dae5e2413ba927a774e08d2fd51c3a52334017383b1701ba0167974294927f96
SSDEEP 768:gMWgBpHvCldtfsO/GbPRTUZFiFy6APHbZ57tsGvVaN5KAnVwmSX+gc43K/i:gMjHEdtUNnFrYfcdnVwmSXU46K
TLSH
T1752302F9B8A6871105CA74BF50CBAFB37930BA3D7389AD4D764259BD32E1F1142B0601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5820	powershell.exe
9	5820	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5820	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5820	powershell.exe
5820	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5820	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 1536	5820	powershell.exe	86
PID 1536 wrote to memory of 3772	1536	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bombthreat.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zhkrlxpw\zhkrlxpw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A35.tmp" "c:\Users\Admin\AppData\Local\Temp\zhkrlxpw\CSC4125BD0FDF9040A980BEF3B0DBE8AA7.TMP"
    3⤵
    PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3A35.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3A35.tmp
Size 1KB
SHA256 47bd4638076eefcc2287345763c8a4ed778a58745144ae3dde6d56ae3cb69503
MD5 0e6d31b08f7b4f1520a19b955279d216
SHA1 1a081de3d59357c4cf5c488fd7dea9b5107f7515
SHA512 fd14cab4a424373d039d0715aaed52eadd87b8156ff27faae1556640da7016821852f63542e94904b22996cf98ddc89b993a9a524c209fbb80415195ab97072f
TLSH
T187218C0493ED471EF0774B316DF6132FA238FD54EF62575A8580422C1C61544EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iublbfiq.0nx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iublbfiq.0nx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zhkrlxpw.dll

Path C:\Users\Admin\AppData\Local\Temp\zhkrlxpw\zhkrlxpw.dll
Size 149KB
SHA256 6d2643c86a855e06824c5d9a0f087a1dab0fa6a6bdab73a8733b42d628d18c7e
MD5 2591e00b49e42b16973462085c69c41f
SHA1 f7955647f0ded8d5cd117fb8c6ac298b173387ed
SHA512 502c135e74155bdf086d30cae01b12163bc22e1d203f8f23fde2e34a14641f136e07f9071a3b3c86d999244ddd2377078846fe3ce50daff2e9fb806ea60b32f4
SSDEEP 1536:jcMiCl4WINqGgLWA9u12Gyi9rsxoTXYl19+FYAZXkLg2gTtdeATl3hdph8ZvyyVG:jcWl2NqZDHen/JU/xe
TLSH
T1D4E3FF29F9FA312ED122F2B18FD9C94ED756B475523B4A1F0292238B43658027F4277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC4125BD0FDF9040A980BEF3B0DBE8AA7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zhkrlxpw\CSC4125BD0FDF9040A980BEF3B0DBE8AA7.TMP
Size 652B
SHA256 f0454e9b9fbe1aa38ee0bbda1717b45110363bc3134ca7fc835a6e019d6e84aa
MD5 690b8e60a447a69473ad94f34ac2ef62
SHA1 ec10e2158669c984ecea8a853f7e4359bddbe0f2
SHA512 48ed79bfb13112837f0d039cdeb2f31f047d8c5f652af8e920cc7c9b11d5addc5c243e0b37f0a6f8e834b067c2b13b43724dee28a4adebbbc2e251e98d7cc17e
TLSH
T16AF03A0963FC120AF0F74B30BEF6836395ACBC64DE7293ED2480032D68655108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zhkrlxpw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zhkrlxpw\zhkrlxpw.0.cs
Size 78KB
SHA256 d0dde3dd8555fb7b7f21f080fbc8403f68d102e78739b95d30d75b265519aacc
MD5 3c5d21d1518c9e3813cc9314e3bf32b5
SHA1 86a1933edcc1cf3b7b17a138462b3c225495761d
SHA512 1ab24b76d3dedfc0942c1a98f0d14edb181937af84bb96344129dd66f59ebe66fd3d4b25e51e3864b2bf68768c6dfbe00bada87d3582f84b14e7c4f1babf5f78
SSDEEP 1536:s5MxoKZOib6BVerD7KV2CbnedyMc3ghHj5nuEH:s5MhN6BsxCb+yhWj5tH
TLSH
T1A283E819F9427F5C721D921129622C80642BB3232E097946736F48CC6F6DBDFAE7942F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zhkrlxpw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zhkrlxpw\zhkrlxpw.cmdline
Size 369B
SHA256 4fff601e47e31c726e67f8892a4745c97a264c281e9dd37a1c95f5a42d5781ed
MD5 50b5f56c1cb6ebad737284931f626dce
SHA1 b899ba68ede400d6b2d36ee1c7af8a59095e970a
SHA512 871fe85da01635e24a73a51e25b2d96b1cdc9d0f9128f38ce27e5c69516abcd6922e9494c489a01e4c37e163171491d308da06a571f363f838b8704952ed3130
TLSH
T1E8E0C02E4256C27D03DD10872179C4BCE27387832941BF8490C04C4DD2171022FD1745
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5820-1-0x0000025ACA4F0000-0x0000025ACA500000-memory.dmp

Download

memory/5820-0-0x0000025ACA4F0000-0x0000025ACA500000-memory.dmp

Download

memory/5820-9-0x0000025AE4C10000-0x0000025AE4C32000-memory.dmp

Download

memory/5820-22-0x0000025AE5110000-0x0000025AE513C000-memory.dmp

Download

memory/5820-23-0x0000025ACA4F0000-0x0000025ACA500000-memory.dmp

Download

memory/5820-24-0x0000025ACA4F0000-0x0000025ACA500000-memory.dmp

Download