f72a76b145605271c37996767fd6bbb64d8fb45ce18cb60944687ed4a5e8dacb

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample260929-qt23easvbw
SHA256 f72a76b145605271c37996767fd6bbb64d8fb45ce18cb60944687ed4a5e8dacb
MD5 7a7d9390442eb823cddc6610c81f2d22
SHA1 9d5a4dd1981ee14cf84af0d39e96d2c74bc01393
SHA512 9efeb3a75475b160112ed4e4e37e44923f710711ca86490927650e3b56556977cf98a5d06287ddc4cb3a5e9c52234d59dad6a0ac9ade703335314a291a7f5d3d
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4740	powershell.exe
7	4740	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 5912	4740	powershell.exe	90
PID 5912 wrote to memory of 6004	5912	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mgojfjxc\mgojfjxc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE181.tmp" "c:\Users\Admin\AppData\Local\Temp\mgojfjxc\CSC94CE0E9EBBE04F8A99AADBDB9ACDB27C.TMP"
    3⤵
    PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESE181.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE181.tmp
Size 1KB
SHA256 00475c8531899e619fa5055777b74e5dd9cfd80286d8e6f506c675310130f048
MD5 1967f780add8d47ae2245eccd2190c93
SHA1 58aa449aee372c09fea7a51afcc3379ae044a6f5
SHA512 62dc06b93813e097875baba192a788f6be2749e7c015f62bcfd0410560048612fd099bb268cdd994916735f72cfced7e7436de83c55fee9809ef4a7739f1b3cd
TLSH
T17721660583ED4B1EF073173269FA572FA238FD64AFA2975B8544422C2891504EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jdermcen.zy2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdermcen.zy2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mgojfjxc.dll

Path C:\Users\Admin\AppData\Local\Temp\mgojfjxc\mgojfjxc.dll
Size 3KB
SHA256 b070f8613f0a1ea5bd008cb16b5a9578df30200cabcd39519374c8e7b38f8bf1
MD5 6d778ce6adb1de9617308c2e700ef34e
SHA1 a66a968273aeef3e740f2c31a53422f165059aa8
SHA512 79997dc64c8fc2534a69d7a881bab071f80eb40c39b146de89014648060f86cb69ef5317f4489103b4379c7a32543fe6ae2bfe2ec1affc32dedb442fd7a79fea
TLSH
T11C51DE1A97E8466BE4770735AEF3836637B4F8209FB3935E1980025CBC617645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC94CE0E9EBBE04F8A99AADBDB9ACDB27C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mgojfjxc\CSC94CE0E9EBBE04F8A99AADBDB9ACDB27C.TMP
Size 652B
SHA256 601249b64dbad527e7ab4c18085885f642043eea32aee51873dce0bb0024010a
MD5 bb30e7ad6c5de75dd5bf398e22e9611d
SHA1 9f0c805e35c1de7233f3850f9aed374701d480f8
SHA512 7a34f36a3e129970972c986aeced373aed8ac76a129950ee2ea09bb21eebc373ab7a21f1a2904892170e873965d7598a1586c7af5af1d5e66879eb58c8335df6
TLSH
T1DDF05E0963F8020EF0F34B35BDF683A795A8BC64DE3293ED1484031D2864A108D62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mgojfjxc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mgojfjxc\mgojfjxc.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

mgojfjxc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mgojfjxc\mgojfjxc.cmdline
Size 369B
SHA256 b5f46de77c37a8ad12ea01873cdaf1ffa1bba8beec2976f93ffa7f1d87f436d6
MD5 9295663b19caa03bee71cc6abbacbf39
SHA1 9ecd5d7d34294b7ffd0647bd87926393eb416abd
SHA512 db9ae9e712404e4b9b5f1f2129ec3929288953a1f11dbe09d30545be21f67e12b8115ab8e76017995fbb89f912a617b4e396ab35de0ed908bafb985c8b92b07a
TLSH
T1E5E0DF3A529AC7BD15E9240B26BAC9AC827306872DC27F8CA155855DE1270046BE2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4740-1-0x000001C80DA60000-0x000001C80DA70000-memory.dmp

Download

memory/4740-0-0x000001C80DA60000-0x000001C80DA70000-memory.dmp

Download

memory/4740-2-0x000001C80DA70000-0x000001C80DA92000-memory.dmp

Download

memory/4740-10-0x000001C827150000-0x000001C827312000-memory.dmp

Download

memory/4740-23-0x000001C80DA30000-0x000001C80DA38000-memory.dmp

Download

memory/4740-24-0x000001C80DA60000-0x000001C80DA70000-memory.dmp

Download