d69b3703f91c7eed198df5ab55453960e9e71bd060800890db4f564f3bdfbbb5

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-26nw4aaa35
SHA256 d69b3703f91c7eed198df5ab55453960e9e71bd060800890db4f564f3bdfbbb5
MD5 6bd02421a9a51d71375205733d42b705
SHA1 ceec98722773bf414b0112e9ffdb0bc529ce9acf
SHA512 c60ed02beff66431423c9af23c8b6ccff7873921a509c2ef2b1eb57a79612ec42010f788cc732ced92d2b8d14699c58f5f40bf5821084ef6c86d9e4fd98d3204
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2728	powershell.exe
7	2728	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	powershell.exe
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3312	2728	powershell.exe	88
PID 3312 wrote to memory of 4372	3312	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xwnmv4wq\xwnmv4wq.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8642.tmp" "c:\Users\Admin\AppData\Local\Temp\xwnmv4wq\CSCF5D61A1A36FB4659832823E94C36882.TMP"
    3⤵
    PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8642.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8642.tmp
Size 1KB
SHA256 cb341e69ffb8e7e4f49cdc849d346af579be6765064efbd1d6c755b96cf0aaca
MD5 3394ab465d93b0e3420611bc0df485f4
SHA1 5bfc48802f658b7050c684dcdb84971857f1c642
SHA512 0db73b6469b7a35787c22fa9e06bf8b641a836e35bbc728992405f7ecbc6ff9848c5383487ae054af5f7b2bb7c4c5a3448ea1156caa5a723704695203a8fd4eb
TLSH
T1AC21890553E94B1FF0779731ADF6232BA278FD94EF62539A854141292C41504EEF0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3ddrlbtl.0yc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ddrlbtl.0yc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xwnmv4wq.dll

Path C:\Users\Admin\AppData\Local\Temp\xwnmv4wq\xwnmv4wq.dll
Size 3KB
SHA256 63517f2e1fc9392d89499029e15ee2a2dd39f112147f304bd824d6f32191773e
MD5 607d721634e73a328ceaf54cd2c64b78
SHA1 5d6cc762c3f43ca0e7ee80d06df593671e4995da
SHA512 df9889262080daabdbeee5a450afe788f30ed02936afd17caa8189900deb4f8867c95fb43ba3d91e18e27378143c60ce8c02201d45e9dfd47af44c130b0a5b5a
TLSH
T1D251DB1A57E8466BE0770731AEE383273BB4F8508B73536E09800258AC657A49E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF5D61A1A36FB4659832823E94C36882.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xwnmv4wq\CSCF5D61A1A36FB4659832823E94C36882.TMP
Size 652B
SHA256 9103dba2fa2f1436ecb29fc4ed4ab98238f0999e006bd441dacbc06562056c99
MD5 82525ab2840b9fa398cb3b4cf2b75a94
SHA1 99090c7eab89f6dbedaa49c9b614895bce99f0c2
SHA512 d8f07430e53ec344d45733cc36ba1da89a9168a993d4e7129c05785aa9acbe3cdbd094efd6ece5564cad1489860982c4fc1d6d7f2f43c6eb15cbf594a7eafca7
TLSH
T1BBF05E0963F8420EF0F34B30BDF6936391A8BC64DE3293ED1454131928645148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xwnmv4wq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xwnmv4wq\xwnmv4wq.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

xwnmv4wq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xwnmv4wq\xwnmv4wq.cmdline
Size 369B
SHA256 9a7e0f7609a5b33a1cccc67b0c1d8a751e78e99fc8fa2fddbf9466f0ea6b3525
MD5 c2669ed50ea7303ea7a4f18bd828c932
SHA1 c0d3af0bd220c86057ccd640a8000052dfcbebe9
SHA512 38b2d2f4cd9c1f03e4a2f3569d7fcda8ee0cfe001629aaadb350faec8df37e7624fd4986a594452d73c791958d5d6b7c48235759adbf485dea3dfd2809ded1f1
TLSH
T1B2E0C02A5296C27D01FD21072969C4ACCB7227432940BF84D889880DD01FC00A7D17C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2728-9-0x0000023BFB750000-0x0000023BFB772000-memory.dmp

Download

memory/2728-10-0x0000023BFE8D0000-0x0000023BFEA92000-memory.dmp

Download

memory/2728-1-0x0000023BFB7D0000-0x0000023BFB7E0000-memory.dmp

Download

memory/2728-0-0x0000023BFB7D0000-0x0000023BFB7E0000-memory.dmp

Download

memory/2728-23-0x0000023BFB230000-0x0000023BFB238000-memory.dmp

Download

memory/2728-24-0x0000023BFB7D0000-0x0000023BFB7E0000-memory.dmp

Download

memory/2728-25-0x0000023BFB7D0000-0x0000023BFB7E0000-memory.dmp

Download