56d8200df14c6574dd1152dff9b83a515fd80b990173f09cd9ff03852d4e9dde

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-26ptdsaa36
SHA256 56d8200df14c6574dd1152dff9b83a515fd80b990173f09cd9ff03852d4e9dde
MD5 7fe8e932c5235efac9fb03e510ac6349
SHA1 c252bc9214f01f32928650fd54dd365a247ae3b6
SHA512 9d7e209a2e35d17404abc0c79f9ceba9567e3eeab4aee1943b783e6350af0f721212c8be594543ee9ddbca0932ca279c0179d009576e1f456341759cfa1fd8cb
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1996	powershell.exe
7	1996	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	powershell.exe
1996	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1384	1996	powershell.exe	88
PID 1384 wrote to memory of 1496	1384	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cg0rfsdy\cg0rfsdy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB292.tmp" "c:\Users\Admin\AppData\Local\Temp\cg0rfsdy\CSC294E015E88EF432996E515EDFB8E96D8.TMP"
    3⤵
    PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESB292.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB292.tmp
Size 1KB
SHA256 668d12835a0e8295780bf22af41179cdcc591d3b6df0653ea42ff9af952c87f0
MD5 87a751a5809bbbb6a38d9c6b4a5fc52f
SHA1 8a827b309f79fc5aae9c3dd9cf60ce6efe3aaaee
SHA512 67c50b61625c54aeeb67b30d432e0c086e311db01bf0cc10be43dcf40d4f139f488345d29804fdb89f567fb548d270c85f2ca93726240e6d2cbfa335c400aac4
TLSH
T10221AB0593E84B0EF07747326AF6172BA274FD64EFA1575B854082281C52604EFE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_khjrikqc.tt5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khjrikqc.tt5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cg0rfsdy.dll

Path C:\Users\Admin\AppData\Local\Temp\cg0rfsdy\cg0rfsdy.dll
Size 3KB
SHA256 0ab15bd69cda637c86828b5b8e2832e20adda68b64417aff8444e4a73c364f0d
MD5 082a73b678725e6cd4646df4bfbfcf3d
SHA1 fc55a2b1e15c9c3a356cfe3a2aaa84b96ffd8c7b
SHA512 589fc953adfdbcfd398fa5b3732dcd24ba75a75b5d24ef048362652cc43e0103e71d6a89ce5b9b467ada06556e08160ade8c72e21e75e238a9b9a5b70bb4b384
TLSH
T13E51EC0A93E84A6BE0730B31AEE3836737B4F8108F73531A1980026CAC617649E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC294E015E88EF432996E515EDFB8E96D8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cg0rfsdy\CSC294E015E88EF432996E515EDFB8E96D8.TMP
Size 652B
SHA256 64f6caa861e6c990a80f5878924bcb9974dab318c057d9274d9b785787e73f60
MD5 e8dcb8b328ea4f0a8e4c8bc22a8609cf
SHA1 bc0103e2e79f1c98a7dc8f3207daf405f82b78ca
SHA512 b930277eca2dc49ec083efbd1fd26941c1def2ede09fed48f09a5a16aa701ab38bb691ef2f9422db4310ba4d96340dfe349add27bf2f5ce3852c64f1d0e35834
TLSH
T11BF0540A63F8060EF0F34B30BDF643A3A568BC64DE3253ED184003591C64A108A71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

cg0rfsdy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cg0rfsdy\cg0rfsdy.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

cg0rfsdy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cg0rfsdy\cg0rfsdy.cmdline
Size 369B
SHA256 998056d4729a30ca682bbae296e8f564019570e5f2140b8ff18a1bb590347631
MD5 0245e093ec646dc0d30b29405746df19
SHA1 77036857ebfd972abb5c38459ec59e5de0013a2a
SHA512 441073578281c92eebaf04bd5bc9856db9aa9df0aff4333b1745744aaf4243489b3ac396c677f52a867f187e0b04e50ba18a4fd71528cce92a84326852609bdd
TLSH
T1D2E0C02A52C7C3FD15EE10072169CAADC2B38FC3A9C93F84D441446DD017008AFD1755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1996-7-0x000001366DBF0000-0x000001366DC12000-memory.dmp

Download

memory/1996-10-0x000001366E230000-0x000001366E3F2000-memory.dmp

Download

memory/1996-1-0x000001366CCB0000-0x000001366CCC0000-memory.dmp

Download

memory/1996-0-0x000001366CCB0000-0x000001366CCC0000-memory.dmp

Download

memory/1996-23-0x000001366CCE0000-0x000001366CCE8000-memory.dmp

Download

memory/1996-25-0x000001366CCB0000-0x000001366CCC0000-memory.dmp

Download

memory/1996-24-0x000001366CCB0000-0x000001366CCC0000-memory.dmp

Download