Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
19/09/2026, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
eqnr.ps1
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
General
- Target eqnr.ps1
- Size 131B
- Sample260919-r1wpmsgd87
- SHA256 47bf256f29e00238a4d356530e9355371d76d9b8bfe8b46ff729d1ddf43d1239
- MD5 3a90ef2326a20b4ceba8e17377ff276d
- SHA1 d2a57fabc9bdd1b63429aa34431e4262b3dd1e23
- SHA512 e2589a521f72af619f8eeba63a3fd2f43a29125c6d918e6be28d0c39fecd0107c9c70087003c17758d5bc2255251d2389e9685558905b0cd0bd8fe48f30f5960
- TLSH T139C092235AA4282ACFDFDD58918123069F427006592A07932B79A835BE119DBC2AF846
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
-
pid Process 4644 powershell.exe 5320 powershell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 powershell.exe 4644 powershell.exe 5320 powershell.exe 5320 powershell.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5884 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 5320 powershell.exe Token: SeDebugPrivilege 5884 taskmgr.exe Token: SeSystemProfilePrivilege 5884 taskmgr.exe Token: SeCreateGlobalPrivilege 5884 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe 5884 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4644 wrote to memory of 5320 4644 powershell.exe 84
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\eqnr.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "while(True) { Start-Process powershell -ArgumentList '-WindowStyle Hidden' }" !key enter2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5320
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 b48a73ab337521561796ec712c9a5d88b66978787772c0abf69766b6052294c7
- MD5 c1af58a68af7bbb05a761ab787c5dad2
- SHA1 39ed5a3a1643ef3ffbac74747e3922c7ca6fee4b
- SHA512 4600a2ce1c4fdf3a8aa11d9f192bc772232f5bdd5db2406eb57caf71265e1152d8b621f907b481ab1ba85037e01cd90ef6b8ee86ceb33d110e261316de6df115
- TLSH T15451ED3132B5B0E4C9577F06192C1AC063BF8346FA98AF58B658521ED92741B9B222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 531acc2267245807285645914f860464cedb72e4972067b397d4d848491fb6a1
- MD5 9eb4edc84b9ad7e08c56be07f8333692
- SHA1 9ca1b619a7d00a31d611c49f82615ff440b47c7d
- SHA512 203c50c872b7280d741fde2fffade2136014663a10db5463409016b4aba47cb744e82a28ee7b2ebb0a4b333d3064977c4d32e1144cb8ca8d823489e069f0511c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ndcjrk5b.rjs.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH