2c9c75c138967a93641ee1423f637a1085a20115e51c28d6ae7cededd0d94a4d

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CartethyiaPet/cartethyia-pet.ps1
Size 64KB
Sample261001-nrccvszfre
SHA256 2c9c75c138967a93641ee1423f637a1085a20115e51c28d6ae7cededd0d94a4d
MD5 67dc1897b8f68405438f366167146e4d
SHA1 0db72c022cb772488c2fd6a35909ef7f58cb60c4
SHA512 67112a666e39813ee600b64ec3ae6d7371f995ba51771ea17612e1beec3113ec167b78ed81691b58a72832bdcd4bfb87cfb81193bc5ea083abeb806bdfe4e07f
SSDEEP 768:lJUJz1AM8o2422DPLAg/Mfzwg4QTgSyPbO8xzhZ3SV170EGDEcmFHhQZ:EJz1Nr2vgkrwg4btUVFgEfCZ
TLSH
T1A05394563D1AE22143DBD1239CBAC809E930223A531AD94873FE9285EF497D4CBBDD94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	PowerShell.exe
File opened (read-only)	\??\U:	PowerShell.exe
File opened (read-only)	\??\V:	PowerShell.exe
File opened (read-only)	\??\W:	PowerShell.exe
File opened (read-only)	\??\B:	PowerShell.exe
File opened (read-only)	\??\I:	PowerShell.exe
File opened (read-only)	\??\S:	PowerShell.exe
File opened (read-only)	\??\Z:	PowerShell.exe
File opened (read-only)	\??\D:	PowerShell.exe
File opened (read-only)	\??\H:	PowerShell.exe
File opened (read-only)	\??\K:	PowerShell.exe
File opened (read-only)	\??\M:	PowerShell.exe
File opened (read-only)	\??\O:	PowerShell.exe
File opened (read-only)	\??\R:	PowerShell.exe
File opened (read-only)	\??\T:	PowerShell.exe
	\??\F:\	PowerShell.exe
File opened (read-only)	\??\L:	PowerShell.exe
File opened (read-only)	\??\P:	PowerShell.exe
File opened (read-only)	\??\X:	PowerShell.exe
File opened (read-only)	\??\Y:	PowerShell.exe
File opened (read-only)	\??\A:	PowerShell.exe
File opened (read-only)	\??\G:	PowerShell.exe
File opened (read-only)	\??\J:	PowerShell.exe
File opened (read-only)	\??\N:	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1312	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1312	PowerShell.exe
1312	PowerShell.exe
1312	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	PowerShell.exe
Token: SeShutdownPrivilege	1312	PowerShell.exe
Token: SeCreatePagefilePrivilege	1312	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2956	1312	PowerShell.exe	91
PID 2956 wrote to memory of 5832	2956	csc.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\CartethyiaPet\cartethyia-pet.ps1
1⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ciskerul\ciskerul.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES905F.tmp" "c:\Users\Admin\AppData\Local\Temp\ciskerul\CSCCF12C4564C784CF889667331E959ADE4.TMP"
    3⤵
    PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES905F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES905F.tmp
Size 1KB
SHA256 9fa01b05b44ae806501dd73e3fca18274edee9a9c9bab50b792b5f805b2aa774
MD5 871ffe8a225aa62fad631414aa77ba4b
SHA1 5fe9aec26a0018e93fd3447da080772cf1ad8fba
SHA512 706882bf4eef0b6b2f09d3a6e044854a950e64443bc0f12d85dde972408426dc657e4f1b8c99480de7d9d6b8bf9bf740585407e2f459f8facc9048ef069385db
TLSH
T1B821CC0143E94B1FF0B757326AF6572B9275FE64EFB2A35E8400522D1C51544EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aksoldwr.tg2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aksoldwr.tg2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ciskerul.dll

Path C:\Users\Admin\AppData\Local\Temp\ciskerul\ciskerul.dll
Size 3KB
SHA256 dd50c864a939e2fefdbf364df1c48a86600feb5d443616ed92e7493e74dea3b1
MD5 7f0e7d2c4d07edc50cec1fe3b3786343
SHA1 3fa92eadda08e296badc0924dedb3d349e187907
SHA512 a87322cee7e39e272be2922ca138958841266fae36588792051211d525255070bbf35dfe5db370593d9a16a09eb84cea2878a1bb3b1d791b5b2382972afe92d3
TLSH
T1D951EF1BA7E8496BF0770B356EF347567BB8F8609F72932E18804319AC216645E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCF12C4564C784CF889667331E959ADE4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ciskerul\CSCCF12C4564C784CF889667331E959ADE4.TMP
Size 652B
SHA256 79f4cb6ff7fd3b86886cde3debc26e75b3f7862c1c9137865dd8991fbf9939d1
MD5 b3bdfecd3d7b6d23226c3919574646a8
SHA1 f9cf85f9ad0eef1fc54ec5efe397d14128210e9d
SHA512 e64b7ab4b0e024010cde0426a0400f48d7251df294731b91c2f8c9dc61aa81d256c1a91dddb9d46aa97c941a9f1db1f0c78aad6bdad41a80ff77a4e30384d3b4
TLSH
T1A5F05E0A63F8420EF1F34B30BEF6436395A9BC65DE3293ED5440531968649148A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ciskerul.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ciskerul\ciskerul.0.cs
Size 361B
SHA256 57b8be887a023e65d748ecf6e5618e3d7b9a6babd91d250a07119ebd884cd5d5
MD5 3a6f7e47a5efec1ac4390d28d8f0b89e
SHA1 84a50f3d6db9ed7b9ce5cc0774540ede614f1fb1
SHA512 e92497dce6523f2ce6d801dd2dc3cac1c66123be24485a8457fb388df7ed26c1204fc559bac7eb93e6c6b30eb3c5b0c5770b9278659168d857d8d440edaff045
TLSH
T160E0C0146353B7B0803209226C44F6EBF70BC13652BE3801AD7D2B32CF931543438A48
MD5 SHA1 SHA512 TLSH

Submit Download

ciskerul.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ciskerul\ciskerul.cmdline
Size 369B
SHA256 24730e8a0df2e7e829058a32a2979b74308d37f8fa073873fa63b82bd7ab134a
MD5 90ca38082f9ccc441af36cd018740ce3
SHA1 7a96642f28e5c19ed571cf5df2030ba9a9389558
SHA512 9945d7a4b0d45dd570bf3258d9e5435e136e471b634f412eeebc46f65e11b0517441a6a9991e527ceb18e2a8a62f8661f7bc241a6f846389e977560fb92f47c7
TLSH
T1C4E0C62B4346C27F81EE300B226ED7ACC272078339803F84A4408C8DE067002BBE2BA1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1312-27-0x00000225635F0000-0x00000225635F8000-memory.dmp

Download

memory/1312-31-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-18-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-12-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-11-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-10-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-9-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-0-0x00007FFC88F9F000-0x00007FFC88FA0000-memory.dmp

Download

memory/1312-6-0x0000022563290000-0x00000225632B2000-memory.dmp

Download

memory/1312-29-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-30-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-13-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-32-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-33-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-34-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-35-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-7-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-43-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-44-0x0000022564910000-0x0000022564AD2000-memory.dmp

Download

memory/1312-45-0x0000022565490000-0x00000225659B8000-memory.dmp

Download

memory/1312-47-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-48-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download

memory/1312-49-0x00007FFC88E10000-0x00007FFC897B4000-memory.dmp

Download