852fcf2342acb626740e30202f869a210709d8b2e4fd006989e4ae71e149be66

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample260929-rawa7a1grf
SHA256 852fcf2342acb626740e30202f869a210709d8b2e4fd006989e4ae71e149be66
MD5 35363ce8fbbb3b1633d5b77a8b4963d4
SHA1 02042e87a06edb156b6ab0f7cf5624202981410b
SHA512 988658b3e27ce233255f509c8cf9c5fb1cb73c8bd92d7d2ec33c60c1b2ab2294bc1f417ccda45422f0987329475cd735818d96fda119d39813cdd13eb86a2e2d
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2712	powershell.exe
7	2712	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	powershell.exe
2712	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3368	2712	powershell.exe	90
PID 3368 wrote to memory of 4808	3368	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ij31gezm\ij31gezm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE3C.tmp" "c:\Users\Admin\AppData\Local\Temp\ij31gezm\CSC5DBC10B4C4BE490BA95DA2F43233E3B2.TMP"
    3⤵
    PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESAE3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAE3C.tmp
Size 1KB
SHA256 41f9211dbf255bc37b5fbc0d7b88b9f7e9bb3c74e06db4a38891c2dc3e244982
MD5 8cdeac19b425d3cd3157592b7ce15927
SHA1 d9c4cb8a8e9841a8024c640326dea1661e8139ab
SHA512 8dd8f9075935eca66a6f5375a67d8a18f0eb9545d0bc27b19e16e398702108cd4802756c81bc15dd40cb1bce8c611587d26a12bcf430b888cf6554a4275cec2e
TLSH
T1A5218C0583E98B1EF0B3573269FA073B9134FD69EF61975F848042281C51504EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zfn2pjaj.rrr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zfn2pjaj.rrr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ij31gezm.dll

Path C:\Users\Admin\AppData\Local\Temp\ij31gezm\ij31gezm.dll
Size 3KB
SHA256 731fb52547cb37b38daf656500382d1ba41ab808688dbafe3ebb1939c4646a2c
MD5 71e7382d2c9f25ab4f5456d39afb07d4
SHA1 bc6c2c7f2b41bc1f760baf8486d2d4f08f3ec0ec
SHA512 63033558010b0eea0955a9e93546cd1ed3b50ed85b85660ef041e440aaef36f3bfaef6082ef240aa4c7c846f3b6d66372f542c1810e6a5038890b6392ffa4a74
TLSH
T17D51EC1A93E8466BE4770731AEF3832637B4F8109F73971E09D0025CAC617645E31BB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5DBC10B4C4BE490BA95DA2F43233E3B2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ij31gezm\CSC5DBC10B4C4BE490BA95DA2F43233E3B2.TMP
Size 652B
SHA256 ece88c81eeef95fe54ee06178516270b26a72984d3309c9f391b88f087e66b32
MD5 4aa9deb139ca96588debf509e0638fa9
SHA1 ee214f617cae736dca7f0e6d2610b9c63cdd9393
SHA512 a125e35261e37b9939e3f31eed30d173e72bcdfd4dc02b5b77b52422d13dc30f5abebc1a1bb6cd529d4fb83fd6342b22bb9584c97fd90a20bd83b9b7bc96a857
TLSH
T192F05E09A3F8420EF4F34B31BDF6836391A8BC65DF3293ED1490035928649108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ij31gezm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ij31gezm\ij31gezm.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

ij31gezm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ij31gezm\ij31gezm.cmdline
Size 369B
SHA256 590bdf6a71563a21a62de9a051b0112d79981c5f9186eadb020517093bfc51b7
MD5 d37bd50f812dfbf05981a6903d0b7c52
SHA1 8a6dfb9a00c37175975b9057534c4150d5c5a527
SHA512 9ee9effd9884cc6af8cc95a41e4a0ff3adc200f97a532d8ebc6e8324b62e67515d70dbe545be1993d3be5762efc4a039f883c4145a40fe4a3b7badeee338518c
TLSH
T188E0C02B82C6C37D01DD100F256ACCACC6761F472E853F8864404C0DD0A78002BD3753
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2712-0-0x000001FA942A0000-0x000001FA942B0000-memory.dmp

Download

memory/2712-10-0x000001FAB0990000-0x000001FAB0B52000-memory.dmp

Download

memory/2712-9-0x000001FAB0350000-0x000001FAB0372000-memory.dmp

Download

memory/2712-1-0x000001FA942A0000-0x000001FA942B0000-memory.dmp

Download

memory/2712-23-0x000001FAB0320000-0x000001FAB0328000-memory.dmp

Download

memory/2712-24-0x000001FA942A0000-0x000001FA942B0000-memory.dmp

Download

memory/2712-25-0x000001FA942A0000-0x000001FA942B0000-memory.dmp

Download