6689dacbd5da7e93a1e9bc1d32363052634fa2a862aad9e9c0e513d56cf4aabf

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample260929-rhdfca1hpc
SHA256 6689dacbd5da7e93a1e9bc1d32363052634fa2a862aad9e9c0e513d56cf4aabf
MD5 9be85d2346411f2f1de7385d382e4226
SHA1 1b87b4e4964ad769f9253bba245857aada05dedc
SHA512 80b0984f489df6db308317a9d5d600b804e25587eadcd187d5556a02c71eec74b4098f7d936083bee3252501e391ffd90505bf960fedd7097891402a96a3c43f
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4396	powershell.exe
7	4396	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4396	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4396	powershell.exe
4396	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1808	4396	powershell.exe	90
PID 1808 wrote to memory of 1780	1808	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4f2omqvq\4f2omqvq.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9575.tmp" "c:\Users\Admin\AppData\Local\Temp\4f2omqvq\CSCD5A00BE578CA4781AA489267639AC283.TMP"
    3⤵
    PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4f2omqvq.dll

Path C:\Users\Admin\AppData\Local\Temp\4f2omqvq\4f2omqvq.dll
Size 3KB
SHA256 12765a57f10c72b18e891b9c7f6dc19e8c1887d62034e2398b193c388f8a4848
MD5 2a2b600453da0ad4ebedeb408aca32dc
SHA1 b4f66e89a647ac5f3ff91501c5e44ec5773838e5
SHA512 55d6570bc7d233e27d605bc964e3a4c9e0b011abf765e7b4d07fcaece6ba8f51f53140806e520a486759d10424e8f0f5d62b4acffe8650cf500856cfdfba09b8
TLSH
T10351EC1A93E8466BE4B70B31AEF3436737B4F8508B73531A19C0025CBCA07645E31BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES9575.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9575.tmp
Size 1KB
SHA256 58bf5f122e45c7a6a5e8843414a408de072cc8311dcc04b997c5abd914f04ce3
MD5 40e4e0a496d688b04ff2347ab7c961de
SHA1 b28de9389ce002e9aa0a82f9891e897914bf3c22
SHA512 77ec099ade408ea63bc23eb98de7d5b6e66aafe41fe75824db4452e62f518d4354a06d54d7805208e4cb41cefbb8f8407b4c3002eae9392c1b8230d2534ba63d
TLSH
T1D5218C0583EC871EF0774B31A9F6171B9274FE95EF61975A8580412C2C91544EEB1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_10plo1fg.dw0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10plo1fg.dw0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4f2omqvq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4f2omqvq\4f2omqvq.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

4f2omqvq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4f2omqvq\4f2omqvq.cmdline
Size 369B
SHA256 dbb775c30ccc845b2ca5ce3115b701f87edce76514879fb9fc343639ee00c1ab
MD5 963550a0e7e5d65c126b248948330272
SHA1 46f182c888178ff9c647ca134e804fe0e8e2d8fc
SHA512 493b69858d37b0d2a566e4a427f0c40ab0aee564992ca1b084e28a43f26bee5125fbd773243c140b77fe794302b30ebd132ef41d0a30fb8c95af62aeffb55d9f
TLSH
T14DE0683A4346C37D81DD105723AAC4AC827207C339403F84508B480DF057C4027E17D1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD5A00BE578CA4781AA489267639AC283.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4f2omqvq\CSCD5A00BE578CA4781AA489267639AC283.TMP
Size 652B
SHA256 9cafd19ec8cb677e7431003f930601dda856c348200bcc253a3a8cb12940aedb
MD5 eb5660e2431d88a596df734c6c97dd9c
SHA1 3c8524de1641c3bc16e425276f1f41383926e344
SHA512 5ed774c09104ea0daafee0aad3b57dbf2e77e7daadb5939d6145d1bca7380e625269b5534ae61ccfa728a0b86e532c97786efa2625989c7bde20acd9aeb6dd73
TLSH
T1A3F03A0963FC420EF0F34B30B9F6536391A8BD64DE3297ED5490035968A46149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4396-0-0x000002B335C20000-0x000002B335C30000-memory.dmp

Download

memory/4396-6-0x000002B335E20000-0x000002B335E42000-memory.dmp

Download

memory/4396-9-0x000002B350A30000-0x000002B350BF2000-memory.dmp

Download

memory/4396-22-0x000002B350630000-0x000002B350638000-memory.dmp

Download

memory/4396-23-0x000002B335C20000-0x000002B335C30000-memory.dmp

Download

memory/4396-24-0x000002B335C20000-0x000002B335C30000-memory.dmp

Download