e24d1adaa770f5a99d57446bf70dc2549ddb19a56d7f4e92b1d776117fe654c9

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample260929-ql79fshd29
SHA256 e24d1adaa770f5a99d57446bf70dc2549ddb19a56d7f4e92b1d776117fe654c9
MD5 9ebe55a5a3e774e151f152f2378e4b67
SHA1 89294d94bd2e403caa92341408d278b95d4d861a
SHA512 e90a39de17e01740e1f969363f49334f31a5600ab9a0526f1c207616d0b7e1331969c980c6cff56cb038751f5ae8e6d6b12f4c4be42d2b3cebbbfdbeb5fac26a
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5068	powershell.exe
7	5068	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5068	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	powershell.exe
5068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3964	5068	powershell.exe	89
PID 3964 wrote to memory of 3888	3964	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r1g01jbf\r1g01jbf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9287.tmp" "c:\Users\Admin\AppData\Local\Temp\r1g01jbf\CSCA501E8283D144202882A1E35179FD2.TMP"
    3⤵
    PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9287.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9287.tmp
Size 1KB
SHA256 07e14dab3eade3a6181e0708ca578d489dcf0d10e1b84559eda6ce55d4cfced8
MD5 09f646a1876d2da1df85bce2c1b2a275
SHA1 f73094f83078653aaf103173508048ee3f11d489
SHA512 b1f81e345a9548ef8d22938e4ed217d0de53549b1fbc196e2450c7ed26637600485e7fa5a64fb9d8abaa7fa9be6cca912d0287822f6eedd7322cced92dcf2ac9
TLSH
T1C2218C0543E8471EF0775732A9FA175FA678FD54EF62976A8541422C1C91104EEE0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tvjgyrrp.bem.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvjgyrrp.bem.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r1g01jbf.dll

Path C:\Users\Admin\AppData\Local\Temp\r1g01jbf\r1g01jbf.dll
Size 3KB
SHA256 1a7452de57c7eeb34809a6b6aa3ff9566c48c3ef1453578523bd4eb413790570
MD5 141e715bc2dc32e14bc1cd5e102df89c
SHA1 26138402e7c1310b375d0d5be090d8cccb31ccc8
SHA512 778088dd1c8fbc839ce9a105d54cb19a6cbfbb721b42f20def20f562a27099f38f763d78aa0ef980a3848627b895683f4ef575c7b9b58ef364490ed9e6d198d1
TLSH
T19351EF1B57E8062BF47707309DE3436737B8F8109B73576E198003586C603645E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA501E8283D144202882A1E35179FD2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r1g01jbf\CSCA501E8283D144202882A1E35179FD2.TMP
Size 652B
SHA256 069f74767e82a2dca33336abfe397b1a9fdc4f763884e090f9999bebb0077051
MD5 476e0a0bd314f7632c5b933abdeb9d12
SHA1 6b28f1b1f7f66bef83efe01f38ced41c150ad3fd
SHA512 34c0794c03ce1b047abb6e2c727bbcbb82b712b74e0d184fdde405d958a8a9b0fd5335f64d9c4a3ef8ea28269eebd41d20c906b473139be74e6f12620132d8f9
TLSH
T135F05E0A63F8020EF0F75B30BDF643A3A5A8BC65DE3293ED1490035928645108A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

r1g01jbf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r1g01jbf\r1g01jbf.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

r1g01jbf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r1g01jbf\r1g01jbf.cmdline
Size 369B
SHA256 9439c8abc2a8a0cf08ec7d028d5d8f681e564c0672c9a2fec10b37a23c80ef50
MD5 788be0abf307abf8e2879fcd69d5d23b
SHA1 3a10498a4c70ed1c89b0d575e18f6b6228468a47
SHA512 e1324b034fec407af50c56f25decd04338e89b0c793f0c355967ef2adba61f1cdb48eeed11a2b211d5a945cae08fdd760a9d86199189cf3b3fcb57f827e87658
TLSH
T1DBE0C02B5346C67F2AFD90072269D5ACC27617432A42BFB49C58440DD01700D27D1BC7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5068-0-0x000001D8E1A00000-0x000001D8E1A10000-memory.dmp

Download

memory/5068-10-0x000001D8E4170000-0x000001D8E4332000-memory.dmp

Download

memory/5068-9-0x000001D8C94E0000-0x000001D8C9502000-memory.dmp

Download

memory/5068-1-0x000001D8E1A00000-0x000001D8E1A10000-memory.dmp

Download

memory/5068-23-0x000001D8C9310000-0x000001D8C9318000-memory.dmp

Download

memory/5068-25-0x000001D8E1A00000-0x000001D8E1A10000-memory.dmp

Download

memory/5068-24-0x000001D8E1A00000-0x000001D8E1A10000-memory.dmp

Download