cb2b273ae865d8337814e46da3dc3bbe960e4696857f16b2b8e513be6db9aba8

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample260929-raphmsts9l
SHA256 cb2b273ae865d8337814e46da3dc3bbe960e4696857f16b2b8e513be6db9aba8
MD5 bb380b5741413bc12a6d7b20585c8638
SHA1 1a2e740069863fbced12e6da8020c89b68736ae0
SHA512 b2b4d9663b453e6db8cf1aba044df63ac5e57505c300d92d48ca36f7256531297a53700ba644275335be857cb752044e10d30c841a57eedb4fd550ac7479e32a
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1624	powershell.exe
7	1624	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1624	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	powershell.exe
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 5052	1624	powershell.exe	89
PID 5052 wrote to memory of 4320	5052	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nzxz2khx\nzxz2khx.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA49.tmp" "c:\Users\Admin\AppData\Local\Temp\nzxz2khx\CSC7FBFFA9CC77A4AE88EC736BFBFAD51B5.TMP"
    3⤵
    PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESFA49.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFA49.tmp
Size 1KB
SHA256 7bdfb56d8f0ba533e8491bc4c86fe3f12a3067436a7067d88470ccca9157e4ce
MD5 032ecd3def84577d3c0beafb8058f9a8
SHA1 8dad041cb0da11dbb1a4d29929ec29f5c8239cd7
SHA512 87a5ece705f64dd414cd803a21c84132857f674aaa94c876d4dc9dd25116b5f4ec9dad4ab6468adaa2eb24b7d9d3b3587fc01701f2ce410126086f230532080c
TLSH
T10421AB0983E94B1EF077573169FA072B9778FD94EF62A75B8980422C2C51504EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u3mkwues.hur.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3mkwues.hur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nzxz2khx.dll

Path C:\Users\Admin\AppData\Local\Temp\nzxz2khx\nzxz2khx.dll
Size 3KB
SHA256 44fd8fc688b6a6dd8f1a8b4415593c95efe3db22afc0b14115827089fe3aeba5
MD5 040033205957d351c6a62ce997437d72
SHA1 767cc2751355268bc4e4f97146679c263f3fafb1
SHA512 c7570431761347050a0d794b9a6502c15b1cc39d78aa5a0cf58e0e06c664ff6fa9b10313d38338ed9337be76658267befac95b722641e4600cf8e801760c8e1c
TLSH
T10351DB1A97E8466BE0770731AEE3436637B8F8108B73931A4980025CBC617645E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7FBFFA9CC77A4AE88EC736BFBFAD51B5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nzxz2khx\CSC7FBFFA9CC77A4AE88EC736BFBFAD51B5.TMP
Size 652B
SHA256 b6e1685cf23bab4bef473358347edc55c492549ef45aaf9ac63caf5e9151469b
MD5 57dd55f1fe8336ebaa9719b8f5fee924
SHA1 ad47326ee0a2ac1cb04c194636a62d2d11d8641a
SHA512 2f7a1022ee68ec40ff61a765907173d73b05c1da370e3a6277c95c923d78e7607e81ea6b6ef356ae96021c6c1da1c6d9571db871c7fffa37fbf3a0b1946079aa
TLSH
T144F05E0967F8020EF0F35B30BEF6436391A8BC64DE3293ED1480431D28659149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nzxz2khx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nzxz2khx\nzxz2khx.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

nzxz2khx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nzxz2khx\nzxz2khx.cmdline
Size 369B
SHA256 f4f54a440d5c9894dd76adc8e60ce6665ce149ce332b804247750350dade6634
MD5 461570abdb9ce0766cc6daf35412f420
SHA1 ce5236496a377490a67e760738b59edfc0dfebd4
SHA512 4a53588e1ba5319376ea047eef70d50f85651f5c7f81290f9ec5a434c41bce9e0ad7ef8afe91529a4e4bd3c11b27ab272f42c6a2694f823e31c6224d7bc50123
TLSH
T189E0C62B4287C27D11FD120B226AC4FCCB7A0B832988BF88D860841DF0670027BD3B89
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1624-0-0x0000024F5E780000-0x0000024F5E790000-memory.dmp

Download

memory/1624-10-0x0000024F613A0000-0x0000024F61562000-memory.dmp

Download

memory/1624-7-0x0000024F5E740000-0x0000024F5E762000-memory.dmp

Download

memory/1624-23-0x0000024F5E720000-0x0000024F5E728000-memory.dmp

Download

memory/1624-1-0x0000024F5E780000-0x0000024F5E790000-memory.dmp

Download

memory/1624-25-0x0000024F5E780000-0x0000024F5E790000-memory.dmp

Download

memory/1624-24-0x0000024F5E780000-0x0000024F5E790000-memory.dmp

Download