7cb05ded7feb53c62f1d263314ac4822f333aead4becafb5aa09ba6ce7b36beb

Analysis

max time kernel
299s
max time network
277s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jdszm.ps1
Size 20KB
Sample260910-w15prswygz
SHA256 7cb05ded7feb53c62f1d263314ac4822f333aead4becafb5aa09ba6ce7b36beb
MD5 6b785555636feb232d52ff61ff76b74f
SHA1 0268133bf60c94f9057da70c790efdb9fc4c9500
SHA512 01dd60a2419b04ff5bded7513479b2b455e279b6e8b7bbc618dcabd5a63068dd8c92bc65ecc2af4c83df2415e5dab84317108dcb40a8dd258ae739fb0ffa6c23
SSDEEP 384:5qbFTLBgEqRLM9oqr+hplz+FkOFR5JEav:5qbFTLGEqR49oqr+hplz+75JEav
TLSH
T195927E3DCDA8422ED2B7C229C9DE4503F852691F362CEE4960C7B35A5663143F89376E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1196	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1196	PowerShell.exe
3612	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4740	ipconfig.exe
5844	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1196	PowerShell.exe
1196	PowerShell.exe
3612	powershell.exe
3612	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	PowerShell.exe
Token: SeDebugPrivilege	3612	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4740	1196	PowerShell.exe	90
PID 1196 wrote to memory of 5844	1196	PowerShell.exe	91
PID 1196 wrote to memory of 2112	1196	PowerShell.exe	92
PID 1196 wrote to memory of 1520	1196	PowerShell.exe	93
PID 1196 wrote to memory of 3376	1196	PowerShell.exe	94
PID 1196 wrote to memory of 3612	1196	PowerShell.exe	96

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jdszm.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /release
  2⤵
  - Gathers network information
  PID:4740
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /renew
  2⤵
  - Gathers network information
  PID:5844
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2112
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ekqvj2qc\ekqvj2qc.cmdline"
  2⤵
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\wvnkq_01.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 909e408a7eece6a690c67f98d89dc3f0c8704c8f2fed1c25e31477412c7668a4
MD5 9a258c52b9e317fe303538c5d71da718
SHA1 ec2793fef2e5ffdd1772e38dacc8e54cd507d8c9
SHA512 feecda7c8d03460587f3c612b8b2f47ffeb50999fa31801275fe8a473d6af1b457903f9889386ae25a6a98bf220bceef3ece7b5ecb71663ffb416c984a2083a0
TLSH
T180215937B3DC8614C89A413A10CEAC1536B6C7DB80DECEABBB84D544A42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

wvnkq_01.ps1

Path C:\Users\Public\wvnkq_01.ps1
Size 1KB
SHA256 a06aabff92d8c3c80b8e6061b661cb5b82654afe0322516f5a593cc65cdc68fa
MD5 44dd7cec3c164d2027a6a32d55010015
SHA1 4e49d22a7efb3197bbee2a48688f6b71bea98108
SHA512 1e668240675e4c31c1df37a5c43748add2ed9d8d249d89e7f47490ef377bab55c23030a255a9896a98e1838f071bcc7a3eeb1d27158cb139b200232ff4e1dc75
TLSH
T1293146109AD9A605B6731B09E9FF70925C37B96D6D79C64C0045C28F17F1A44CC77B39
MD5 SHA1 SHA512 TLSH

Submit Download

wywhs.txt

Path C:\Users\Public\wywhs.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ekqvj2qc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ekqvj2qc\ekqvj2qc.0.cs
Size 451B
SHA256 60067dd22c122f276ea5922ef351e37ceb4dc3d16eda823d7854a6e4e19918f1
MD5 6223a25f01ffe45a5e3f164866d55d25
SHA1 00ba615e9acff181df41968cc6ad7ba67a96cae3
SHA512 1c2116ed59e067aac9eb65d2ea793717857997d312dcfee2053a6e27d1c308104441ce7e288e1ec7d1eefb102332f80badbe131e2481322416422edd520eb5e5
TLSH
T146F0271836E2D6650887C82B84DAD0ECF673D1771BBF1F11AAEC07409E8340940BAF06
MD5 SHA1 SHA512 TLSH

Submit Download

ekqvj2qc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ekqvj2qc\ekqvj2qc.cmdline
Size 369B
SHA256 7b61736b2849dfb1e738df2c62d878cc619ff3546f3b098e171dfca3dacfa633
MD5 4dc8f5e4bd1c92168b5e1fb0ae23f834
SHA1 47e4d832feed39a9cf9e353698ad39acc2d332e7
SHA512 da09e3f6504b72e7a2c8699c80b68f85d409801b3d7039841bac076cf3dc991fe44903cd626526ec600906812fef079d4fdcec5a1c0df7dd8d791475747d7973
TLSH
T1C2E0262E5396C7FF25ED102B327AD7BCC2730F8729817F949160886DE0670066BD2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-12-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-8-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-10-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-11-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-0-0x00007FFC6D6AF000-0x00007FFC6D6B0000-memory.dmp

Download

memory/1196-13-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-14-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-9-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-7-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-24-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-6-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-5-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-4-0x0000014DFEF20000-0x0000014DFEF42000-memory.dmp

Download

memory/1196-3-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/1196-35-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download