2c9c75c138967a93641ee1423f637a1085a20115e51c28d6ae7cededd0d94a4d

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CartethyiaPet/cartethyia-pet.ps1
Size 64KB
Sample261001-nrccvszfre
SHA256 2c9c75c138967a93641ee1423f637a1085a20115e51c28d6ae7cededd0d94a4d
MD5 67dc1897b8f68405438f366167146e4d
SHA1 0db72c022cb772488c2fd6a35909ef7f58cb60c4
SHA512 67112a666e39813ee600b64ec3ae6d7371f995ba51771ea17612e1beec3113ec167b78ed81691b58a72832bdcd4bfb87cfb81193bc5ea083abeb806bdfe4e07f
SSDEEP 768:lJUJz1AM8o2422DPLAg/Mfzwg4QTgSyPbO8xzhZ3SV170EGDEcmFHhQZ:EJz1Nr2vgkrwg4btUVFgEfCZ
TLSH
T1A05394563D1AE22143DBD1239CBAC809E930223A531AD94873FE9285EF497D4CBBDD94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2936	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	powershell.exe
2936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeShutdownPrivilege	2936	powershell.exe
Token: SeCreatePagefilePrivilege	2936	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3904	2936	powershell.exe	88
PID 3904 wrote to memory of 3704	3904	csc.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\CartethyiaPet\cartethyia-pet.ps1
1⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ix2fr1od\ix2fr1od.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES876B.tmp" "c:\Users\Admin\AppData\Local\Temp\ix2fr1od\CSC2F099F6C6D4F0C92A60F511471A76.TMP"
    3⤵
    PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES876B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES876B.tmp
Size 1KB
SHA256 1f5da468a9ae2920ea3e7edfd993d6fba3cb7c5a329df9229e3939934318f2a6
MD5 ccc27b442282857370b7fbc3f1f1a3bf
SHA1 70dd88e87539753a66c776d4f89b643342b3e689
SHA512 f0d8772f80e5bf778c19204b3759b2293e526d83da40494d19dc1c9e4a30b6dcf6e4b63728d36b376eed11ca468fdcaf0f58d58072f6fca55955f471ffebe1c6
TLSH
T1DC21CC0583ED870EF0B7573169F5132FA274FD54AFA2532B844041282C92100EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_50jv5gzs.1lv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50jv5gzs.1lv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ix2fr1od.dll

Path C:\Users\Admin\AppData\Local\Temp\ix2fr1od\ix2fr1od.dll
Size 3KB
SHA256 bf35a122a507db47b995c1d0d3297000ab1714f7aa909a16353aaae902179a2f
MD5 0e1f1cea761b68ed1d2ce7ab0b284078
SHA1 942cdab3bb535d3cc9e077a4311085e6f82aa45e
SHA512 851a58d4d38fc8cbc83d18903bbaa9870ff27445396ad7d83ee4f5f0a4b7eeb3fc951ed292ac97c894a386de95a454ad8cc4a25e4020ae674e2552fc8966df21
TLSH
T14951EF0A97E88567F0B747356DF3476B7BB4F8608B73532E18800229AC226641E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2F099F6C6D4F0C92A60F511471A76.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ix2fr1od\CSC2F099F6C6D4F0C92A60F511471A76.TMP
Size 652B
SHA256 38772a385ebc379f2c6cb9bc5734b90a596a92a45d06a298a2ef316247b6ba25
MD5 2640d8be4022f7f68006868670505d07
SHA1 6646f7cc697043cde22e417b26cf85ecf2849bd4
SHA512 2f0744faaad8708d618f648c31a717243447e469c8c0b3b14b4a7334101894f4440e9a3dc1b5fcbb4d114192436e8caa2b774e4ff8803060ff5054ba5d7dab48
TLSH
T152F05E0963F8520EF0F38B30BDF6436795A8BC64DE3293ED148003292C746109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ix2fr1od.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ix2fr1od\ix2fr1od.0.cs
Size 361B
SHA256 57b8be887a023e65d748ecf6e5618e3d7b9a6babd91d250a07119ebd884cd5d5
MD5 3a6f7e47a5efec1ac4390d28d8f0b89e
SHA1 84a50f3d6db9ed7b9ce5cc0774540ede614f1fb1
SHA512 e92497dce6523f2ce6d801dd2dc3cac1c66123be24485a8457fb388df7ed26c1204fc559bac7eb93e6c6b30eb3c5b0c5770b9278659168d857d8d440edaff045
TLSH
T160E0C0146353B7B0803209226C44F6EBF70BC13652BE3801AD7D2B32CF931543438A48
MD5 SHA1 SHA512 TLSH

Submit Download

ix2fr1od.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ix2fr1od\ix2fr1od.cmdline
Size 369B
SHA256 c54647c556a51515a1d4af5c36d354ca6da96d91bfe28ce057beefe088df88ff
MD5 a8e025237c1452fb00be3ec8faae79ec
SHA1 f80da5000e1be2574a385e7bf24473b2c7699164
SHA512 8282bf957dbab96becd80e3f326884e58757f9d82c1ede1d4ec24ed4143d4b2f3ce0a5e914845ea2e9536c0024975aadacc8fd83269b3a4cf07bd42f28447131
TLSH
T1DCE0266AD396C6FD15ED100B226AC7FCC6B247873A85FFCC9150845DE22B0046BE2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2936-24-0x0000022837AC0000-0x0000022837AD0000-memory.dmp

Download

memory/2936-36-0x0000022837AC0000-0x0000022837AD0000-memory.dmp

Download

memory/2936-22-0x000002281F4D0000-0x000002281F4D8000-memory.dmp

Download

memory/2936-1-0x0000022837AC0000-0x0000022837AD0000-memory.dmp

Download

memory/2936-0-0x0000022837AC0000-0x0000022837AD0000-memory.dmp

Download

memory/2936-34-0x000002283ABC0000-0x000002283AD82000-memory.dmp

Download

memory/2936-35-0x000002283B2C0000-0x000002283B7E8000-memory.dmp

Download

memory/2936-9-0x00000228379E0000-0x0000022837A02000-memory.dmp

Download

memory/2936-37-0x0000022839E80000-0x0000022839FCE000-memory.dmp

Download

memory/2936-38-0x0000022837AC0000-0x0000022837AD0000-memory.dmp

Download

memory/2936-39-0x0000022839E80000-0x0000022839FCE000-memory.dmp

Download

memory/2936-41-0x0000022839E80000-0x0000022839FCE000-memory.dmp

Download

memory/2936-42-0x0000022839E80000-0x0000022839FCE000-memory.dmp

Download

memory/2936-43-0x0000022839E80000-0x0000022839FCE000-memory.dmp

Download

memory/2936-51-0x0000022839E80000-0x0000022839FCE000-memory.dmp

Download