61ff765ebf2ec9f3df7f72d768c1131e344e4e9ac77892b8e34ba6d25d4b8631

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wix.ps1
Size 2.4MB
Sample260913-algthazydw
SHA256 61ff765ebf2ec9f3df7f72d768c1131e344e4e9ac77892b8e34ba6d25d4b8631
MD5 c5af03b613d1df8a212bfb1c57a0e8d6
SHA1 ca1a2fa0b2046953c5e82eaaa41131a5c5d9aea9
SHA512 a1b51949f8a8f4a2f46ee049567d5c91c42e464608993ab0ce12ac4a82db62a73d65d360dabcb0cb9ef418c2d3a70a935a873c65222e3009c3a9b9b7f36407e0
SSDEEP 49152:ciVEIklTuIgfeHuLPVUAPlHjQok9CFSYH+VwhmZO/bzqtI6zKIWzO6xHsqvwJNUU:6
TLSH
T19DC5D95E9651A930C1B49BA994FC44B37A60391B23A0C3A7B6BF4C143DAFD2497F6307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	powershell.exe
4008	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 3684	4008	powershell.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wix.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4008" "2120" "2080" "2124" "0" "0" "2128" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_4xo1eoc3.0ve.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xo1eoc3.0ve.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4008-1-0x0000018F4ABA0000-0x0000018F4ABB0000-memory.dmp

Download

memory/4008-0-0x0000018F4ABA0000-0x0000018F4ABB0000-memory.dmp

Download

memory/4008-7-0x0000018F4D5D0000-0x0000018F4D5F2000-memory.dmp

Download

memory/4008-10-0x0000018F4ABA0000-0x0000018F4ABB0000-memory.dmp

Download

memory/4008-12-0x0000018F4ABA0000-0x0000018F4ABB0000-memory.dmp

Download

memory/4008-11-0x0000018F4ABA0000-0x0000018F4ABB0000-memory.dmp

Download

memory/4008-19-0x0000018F4ABA0000-0x0000018F4ABB0000-memory.dmp

Download