69972012891004a954d5bb6ce707b398cae7589b2f2c6475fc34460bea25a7b1

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-26nakaaa32
SHA256 69972012891004a954d5bb6ce707b398cae7589b2f2c6475fc34460bea25a7b1
MD5 c39c70cd11fb4e89c9509099a93f817f
SHA1 b05b26854f10a39a094e814e0e7fb7c8f8f9dec8
SHA512 423ac1f84bf7bd9920427cde23a8f62087b2d3e75117423d368ecdd401e27466047fee730932e5fa3f9312129fcb1e7fb37db3215e0ca411b6f222df9a5da77d
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2644	powershell.exe
7	2644	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2644	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2644	powershell.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3140	2644	powershell.exe	90
PID 3140 wrote to memory of 1772	3140	csc.exe	92

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5qqyi41c\5qqyi41c.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF920.tmp" "c:\Users\Admin\AppData\Local\Temp\5qqyi41c\CSC7DC8F44E33794387AEC46D0D45996C4.TMP"
    3⤵
    PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5qqyi41c.dll

Path C:\Users\Admin\AppData\Local\Temp\5qqyi41c\5qqyi41c.dll
Size 3KB
SHA256 145af21582bfd79500e9364bc783344cb760f45b902405e830b9821289c4d61c
MD5 02d9b12246b377569ef680e966ab0331
SHA1 78d6a7018e5ccc2872fcc66c5a5d2352bfafcc54
SHA512 e051ec65246433935cb1a42e8e87121eddd7e3a1bb80f694280ddf34479b4e557c4b90a9cd7ca0d64bbeebf67c7fadd53b80fe06069ef9c6e48ca1825c21e608
TLSH
T17751EC1A57E8862BE0770B31AEE3836737B4F9109F73931E59800259BC647685E31BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESF920.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF920.tmp
Size 1KB
SHA256 2daeefa9ec47dcce6017d5eceba8a5a52b3ae33b14f5a34dd65ba5b12bd25636
MD5 1f4753789ec794fb1488540728618cbb
SHA1 46ac789d35c44e79d81aae2591ccace622fcf982
SHA512 e6367c693bf2ae437451428636cc1f4ceb9abbae54ecd8c262c3db796c77d97f0b2a1bb17deae69dbaeac82186092113945060095f71b2154eb49174a9fca4df
TLSH
T10721AF0583E8871BF07747326DFA576F9278FE94EFA2535A954042292C51504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v0monouj.zp1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0monouj.zp1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

5qqyi41c.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5qqyi41c\5qqyi41c.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

5qqyi41c.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5qqyi41c\5qqyi41c.cmdline
Size 369B
SHA256 03b6c6d21623cd05548a46a58d643f4ffca2abf1220fa2b26a61005a4c6099c2
MD5 c5d977b2aad5ab6284fd0718fc735162
SHA1 5791302142b116f2f2b0f35598d2806f60234e28
SHA512 8bca31bcaf7e5bf4664dad8d5725b240b3fb372cd251f6bf0f687886945b717ae944dd7a1a658b5a255f8cea5cdece3555a325279a81f5219c3d059c4e349c14
TLSH
T1B3E0682E4697C37D05F96007396AC4ACC3720B5B6940BF885270C40ED02780827D1782
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7DC8F44E33794387AEC46D0D45996C4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5qqyi41c\CSC7DC8F44E33794387AEC46D0D45996C4.TMP
Size 652B
SHA256 c7b07b88b684c5d8df5dfa335438d80312b096b9a5810714255a08f39aa83fd8
MD5 cf663f95b5fd5ccdda974584a79632ab
SHA1 6665779cf8af0e9ffc7692cc2ffd4487f02d0a41
SHA512 9dd8a8319a134881ef8e0c966f4aba8057f6d6653bb15214071263754266a4329b293777d8fca6ef609d0843513ff6b580d2a3a859a8df79744ad0e90f4efd5a
TLSH
T176F05E4963F8820EF0F74F31BEF693A3D5A8BD64DE7293ED6440031928649149962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2644-10-0x000001B4EE740000-0x000001B4EE902000-memory.dmp

Download

memory/2644-0-0x000001B4E9DB0000-0x000001B4E9DC0000-memory.dmp

Download

memory/2644-9-0x000001B4EDE20000-0x000001B4EDE42000-memory.dmp

Download

memory/2644-1-0x000001B4E9DB0000-0x000001B4E9DC0000-memory.dmp

Download

memory/2644-23-0x000001B4EE1C0000-0x000001B4EE1C8000-memory.dmp

Download

memory/2644-25-0x000001B4E9DB0000-0x000001B4E9DC0000-memory.dmp

Download

memory/2644-24-0x000001B4E9DB0000-0x000001B4E9DC0000-memory.dmp

Download