Overview

overview

8

Static

static

1

file01.ps1

windows10-2004-x64

8

file01.ps1

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    900s
  • max time network
    553s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 06:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file01.ps1
  • Size 16KB
  • Sample261001-hl554ascjb
  • SHA256 a630514bb4785e60c43d896860704b13b7176ce96cf6c10291887277d7061eb0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 29 IoCs
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jsxisze2\jsxisze2.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6A6.tmp" "c:\Users\Admin\AppData\Local\Temp\jsxisze2\CSCD52838A05C59462688209AE493492E44.TMP"
        3⤵
          PID:2560
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\396c8525286740dc9df588a4bec3deb2_MouseJiggleStudio.msi" /qn /norestart
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3412
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DB5FD1B4D9DCD5AEE61B49C9618A8DE2
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWGVC.exe
          "C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWGVC.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4532
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4384
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:5184
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4064
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4056
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:5724

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59b252.rbs
              • Path C:\Config.Msi\e59b252.rbs
              • Size 13KB
              • SHA256 b0e7352e9233c9b49071acf6ee7a9abe6c01a30ccd3aed5974d76adcbb6cf029
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DrawingAction.wav
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\DrawingAction.wav
              • Size 1018KB
              • SHA256 f83fd904036d8da2e48da9317e9868c409de256a924dee30fd6fad45b6e12027
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWCommon.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWCommon.dll
              • Size 171KB
              • SHA256 42466eba7e0798c551b4b9099e0228e34800ab5a16ea245e533c5f6263e6ba59
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWCrypto.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWCrypto.dll
              • Size 193KB
              • SHA256 441a3ae0bb1eb2f76052396c962f2081f570f9daf1ed43cefe16bb63a4ef1a1e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWGVC.exe
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWGVC.exe
              • Size 7.2MB
              • SHA256 cac4f3b08b0093bf9a824c5604d4f2169a320d59f889cc59fa420a774c6ceadb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWIPHlp.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWIPHlp.dll
              • Size 552KB
              • SHA256 a6262810e2d3eb56d74b7fd1f9bf2b924a3fb47b010bdd5f73d3b7286271d973
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWIsaCmn.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWIsaCmn.dll
              • Size 5.9MB
              • SHA256 5b1efb141137d1059d7cb15afaafb766d0972356878e8cad96b46512e48cdba6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWLog.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWLog.dll
              • Size 201KB
              • SHA256 30a75e597299174308bae4476ab9c409f114509f89f0b56cfe81dbc093801b2a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWPkiApi.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWPkiApi.dll
              • Size 5.4MB
              • SHA256 3c8472e49489e193a2e4216953aaea3e37547b4cadcc7d892eaf95098a16eeb7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWSA.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWSA.dll
              • Size 5.4MB
              • SHA256 b5b81fea7f5b4219116b860a8841a5fe0fe059dca76e8e510f8791aea2475dba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWSynch.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWSynch.dll
              • Size 422KB
              • SHA256 47d96fb56c6b5e6fc8ae38aa3c8faa02753b3dfd0de2ee24fdf79b7611ee6506
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWXMLAPI.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWXMLAPI.dll
              • Size 5.4MB
              • SHA256 db9a993c43b791f927fe01fe36b5cca3b475f20d8f32248bb941727e4fa422e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SWbigNum.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\SWbigNum.dll
              • Size 442KB
              • SHA256 201f4a3c0ff1149dc2160283542eea1391cd250e3eee7446bcf7fd4d6180ef3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZLib.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\ZLib.dll
              • Size 527KB
              • SHA256 d0f25efdc463e814e735ce3de373e0777e1bdc5a01da70f2e3307d918256ec40
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              flt_DDS.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\flt_DDS.dll
              • Size 45KB
              • SHA256 7f141f188f64b44172bf3970c808ca0ed3694460910ec629f3da559f840ab882
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msvcp140.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\msvcp140.dll
              • Size 544KB
              • SHA256 90bc62d4947a5878f1dc1057312f3be2137eb376039f4afda2f64c06353f2198
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              playback.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\playback.dll
              • Size 66KB
              • SHA256 7c1957e8986a3379060516e2cd0ba9194ec454d0a6178d3f02216b8d5b43dc46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              toolJ.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\toolJ.dll
              • Size 60KB
              • SHA256 35aeda95e1d86c4d8ea51522fb798a15f64869000a376393976d02de6c7d270e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\vcruntime140.dll
              • Size 121KB
              • SHA256 dfec5c8efcdb4a44f8adb18504c9a76ea3eb440d61a250c07685359b8b3c706e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140_1.dll
              • Path C:\Users\Admin\AppData\Local\Programs\SWL Centralized Deployment Manager\vcruntime140_1.dll
              • Size 48KB
              • SHA256 a535ba88d242ad1924077f1cb6f3287eb053a83d27a1aacb61e6e8ab277e81bd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              396c8525286740dc9df588a4bec3deb2_MouseJiggleStudio.msi
              • Path C:\Users\Admin\AppData\Local\Temp\396c8525286740dc9df588a4bec3deb2_MouseJiggleStudio.msi
              • Size 17.8MB
              • SHA256 d111c8148d2226aa15aeca359c6dbd8d323b32992f55d9db0a9ca53e8e1f9e92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RESA6A6.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RESA6A6.tmp
              • Size 1KB
              • SHA256 ad59add36dccef927bff88660cdc6ccf59d2907e688e95fbc64ddcdaa4fc9581
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              jsxisze2.dll
              • Path C:\Users\Admin\AppData\Local\Temp\jsxisze2\jsxisze2.dll
              • Size 3KB
              • SHA256 af38343c5e83042e2d1fd430680e17cf8c2967ff55591d02bab0148fca27e0ba
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MSIBD0E.tmp
              • Path C:\Windows\Installer\MSIBD0E.tmp
              • Size 234KB
              • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CSCD52838A05C59462688209AE493492E44.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\jsxisze2\CSCD52838A05C59462688209AE493492E44.TMP
              • Size 652B
              • SHA256 3f9ddc2a3b449ac18287c72f1f419d0c629c416421947d388e0c836f2827f868
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              jsxisze2.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\jsxisze2\jsxisze2.0.cs
              • Size 195B
              • SHA256 42cb19ede897489b723a61608357a745c7d0d431305dfb598e4ca1f3172d2963
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              jsxisze2.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\jsxisze2\jsxisze2.cmdline
              • Size 369B
              • SHA256 6a1b9f8cbdc0d85c1be818543d19f85fc16e0e3a86e85baae29a29c7eccb890d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/4056-186-0x0000029E82920000-0x0000029E82940000-memory.dmp
              Download

              memory/4056-169-0x0000029E801E0000-0x0000029E802E0000-memory.dmp
              Download

              memory/4056-188-0x0000029E82E40000-0x0000029E82F40000-memory.dmp
              Download

              memory/4056-214-0x0000029E94280000-0x0000029E942A0000-memory.dmp
              Download

              memory/4056-200-0x0000029E82DC0000-0x0000029E82DE0000-memory.dmp
              Download

              memory/4532-119-0x00000000010C0000-0x000000000162F000-memory.dmp
              Download

              memory/4532-127-0x0000000001750000-0x0000000001CB7000-memory.dmp
              Download

              memory/4532-129-0x0000000001CD0000-0x00000000022C5000-memory.dmp
              Download

              memory/4532-105-0x0000000000990000-0x0000000000A1D000-memory.dmp
              Download

              memory/4532-108-0x0000000000A20000-0x0000000000A57000-memory.dmp
              Download

              memory/4532-111-0x0000000000A60000-0x0000000000AE7000-memory.dmp
              Download

              memory/4532-114-0x0000000000B00000-0x0000000000B2E000-memory.dmp
              Download

              memory/4532-121-0x0000000001640000-0x00000000016B2000-memory.dmp
              Download

              memory/4532-124-0x00000000016D0000-0x0000000001740000-memory.dmp
              Download

              memory/4532-117-0x0000000000B40000-0x00000000010AC000-memory.dmp
              Download

              memory/4644-12-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-16-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-0-0x00007FF9F964F000-0x00007FF9F9650000-memory.dmp
              Download

              memory/4644-11-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-9-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-34-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-13-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-14-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-15-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-10-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-17-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-30-0x000002A533A50000-0x000002A533A58000-memory.dmp
              Download

              memory/4644-8-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-7-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-6-0x000002A5339E0000-0x000002A533A02000-memory.dmp
              Download

              memory/4644-3-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-2-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/4644-1-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
              Download

              memory/5184-334-0x000000000CED0000-0x000000000CEDD000-memory.dmp
              Download