1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18

Analysis

max time kernel
598s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
Size 759B
Sample260930-alaeesserb
SHA256 1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18
MD5 37037611b8d8035a889ff01694e0b5fe
SHA1 36266741b98e8efc5d68761d722bbad75824dc1a
SHA512 a05c8b47429cb7ecc7f79a9ac11474d2b182e9a53fd49d49509a657acb959e7770e877eef3873f2a6dd33ae732bf0ada27e0d2eb16f1233a2b255f47ef3d0477
TLSH
T11F01F21C65E8551E647F6BB7F40B904CFDB749736451A408368D96CC4F32C5D8693EC4
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4904	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2228	4904	powershell.exe	91
PID 2228 wrote to memory of 4104	2228	csc.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Comprehensive.Tests.ps1
1⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2jguarqs\2jguarqs.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E74.tmp" "c:\Users\Admin\AppData\Local\Temp\2jguarqs\CSCA930F2A85F484EE58A5CD735E898AD36.TMP"
    3⤵
    PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2jguarqs.dll

Path C:\Users\Admin\AppData\Local\Temp\2jguarqs\2jguarqs.dll
Size 3KB
SHA256 4ad2b9790e8de99256cd8173ac3a9697e08cc022f9d1de644cfd8f372c25abb8
MD5 30ce3e963daceaa09ee5cd86340c2ae4
SHA1 8d0b78dfc67e5a6c01a79ed7f4632fc6a5708e91
SHA512 d9f94ef8345c2b1ce3f0bc5f9f2f9b432035648bec686e9cf379a93934c992c69926ce185c157823521f306bd35cc0426d93500ae097656c20250797d6de4bc1
TLSH
T17951FF07A3E44A2BE9B74B316AF3471323B5F8209FB2539E1D80426C5C606606E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES6E74.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6E74.tmp
Size 1KB
SHA256 825f73b1b89b8604bc546a3a48ae5e9b3e51a028b4ed0c02461ba912fad7b637
MD5 f34019c939d8a5eb832b69ffa9e38378
SHA1 60e03c4de1058fd5c702207c1aa8defc35f3902e
SHA512 1b165176ef56fb0276d4268e59240935b367efedf62939ceb85c4447c506f7c8f04084e2b94867679bdc89526c2c17c3944bc9c8873d2cea1d5a013ad2ff901d
TLSH
T1A721CB0583FC470EF4B39B32ADF6172BA275FD55EF61576B854042681C01204EEB1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zfjsx2rk.qdq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zfjsx2rk.qdq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2jguarqs.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2jguarqs\2jguarqs.0.cs
Size 907B
SHA256 6d21e15bcaebe4b6461790fbe39381ef6dc736eec19a66e80ee15caf4680fe00
MD5 d98b32865e5bd9376502ce614141b7fa
SHA1 673d622933fbdb9aaafaf847c3cb8f1ce4b18cbc
SHA512 28f4ec12ba6b47af36e288a81de46ce017144416626c50c4266207f92ac5d4b532691e1ee5a3cf54abc0c567e5cd60fb3d3180e8829cdbfab98013d45377ddb0
TLSH
T160118B503083560718B33BB69F43CA48FB3AA03382D81758B94C04A00F70C1BA676F9A
MD5 SHA1 SHA512 TLSH

Submit Download

2jguarqs.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2jguarqs\2jguarqs.cmdline
Size 369B
SHA256 ca3d7d1bf4a30dc9856bda10d07d1a334208f755dd9f2d4f8130478f69467934
MD5 faec69f6f1ee5b43d7c10151d3fa3601
SHA1 c3232492df867d985176d7cc991a58e84c029c7d
SHA512 0f72b6cb2b7c5df38582b79f41e93165462ff2068f00e39e02593ee9ab824a81da63e0f7e5332513c187a00132360d683a96920b134e5105bc803506bbe0116b
TLSH
T186E0C03A524ECBBD45FE540721A9E4ACD77207472E803F88E2408C0DD0170086FD1B52
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA930F2A85F484EE58A5CD735E898AD36.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2jguarqs\CSCA930F2A85F484EE58A5CD735E898AD36.TMP
Size 652B
SHA256 ad9533b45e9c3678453bfad0e220396a2874c78144ab0648dc44b5926b5e0d2f
MD5 e810360351902b8ac4301e4d1f280020
SHA1 91d0af520c8ccdc4a51f7dc5a68d3427f73c7d1a
SHA512 726973cac91047792c886dd481832773d62373a2160d66129272bfbf472bbfc70cbb845a3de069c6fbe669a33b2115255caacd7ecb6195079e8a1a2b04a79695
TLSH
T137F05E4963F8520EF0F34F31BDF643A395A9BC65DE3293ED5490431928649109A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4904-11-0x0000028F53180000-0x0000028F531A4000-memory.dmp

Download

memory/4904-0-0x0000028F50280000-0x0000028F50290000-memory.dmp

Download

memory/4904-10-0x0000028F53180000-0x0000028F531AA000-memory.dmp

Download

memory/4904-9-0x0000028F52470000-0x0000028F52492000-memory.dmp

Download

memory/4904-1-0x0000028F50280000-0x0000028F50290000-memory.dmp

Download

memory/4904-24-0x0000028F50260000-0x0000028F50268000-memory.dmp

Download

memory/4904-25-0x0000028F50280000-0x0000028F50290000-memory.dmp

Download

memory/4904-26-0x0000028F50280000-0x0000028F50290000-memory.dmp

Download