487c88fa1fcd3fd45e74481d8bee9dac280887b5d8c736023a38fee0f358d2f5

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-2b5lcsvajc
SHA256 487c88fa1fcd3fd45e74481d8bee9dac280887b5d8c736023a38fee0f358d2f5
MD5 30bf5428f38dff586d2889a065b3c413
SHA1 b81c8b4b2075d2b1fd0ca70865e612a689fcd49a
SHA512 dfb1b78537ee1fc373564749bbaddbb85011951cc54946b8c95a74ad9d2b2da2ffb13206384fb46f765c4d1f8cdfafe7d83506c5c4401d413c44969ecbb4054b
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2332	powershell.exe
7	2332	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	powershell.exe
2332	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1456	2332	powershell.exe	89
PID 1456 wrote to memory of 3000	1456	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z3jtgnha\z3jtgnha.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBA3.tmp" "c:\Users\Admin\AppData\Local\Temp\z3jtgnha\CSC8F12D8B9A4DB489CACDEFCD2D6998CB3.TMP"
    3⤵
    PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESEBA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEBA3.tmp
Size 1KB
SHA256 66e06814e98629083825a6265dd40368febddb745ec71e7e8d222dbb6a4f0ccf
MD5 eb9dd747586b5d5bea3178a21a51540b
SHA1 5a0d1c38aa9927cb99b91b1face54bfcfe9d04ae
SHA512 a6689ee47c2baf5f56bcace1c1f0cf231a385f12d03be6657a7bcf849622098d6618d7dbb1ab9c0a7729b84ac1d5cf406f5ae3305c8b4954f389087110b9223d
TLSH
T1E721890483EC4B5EF077573169F6172F9364FDA5EF62A76B8540422C1851204EEA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iwx05sa1.oxe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwx05sa1.oxe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

z3jtgnha.dll

Path C:\Users\Admin\AppData\Local\Temp\z3jtgnha\z3jtgnha.dll
Size 3KB
SHA256 143c2a237fe20fe1d55bfff03a0dfffc94759a493ad5a6eaec576366d5a052ca
MD5 7a8366a9ffc96e24f2e6ee5a473d55b2
SHA1 f6ad551c006e655be22fd01a68344f5988c360c9
SHA512 b9f2ea33323f58b14c846084ddbc66d8ca14263cdf0356ec99bb4e9f2ce9b5cbe73537298da2d48706146276edc19e273d30713b1f7ecc3225aa8c136954a561
TLSH
T1C451EF1AA3E8466BE47707319EF3836637B4FC608F73935A1980025C6C613645D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8F12D8B9A4DB489CACDEFCD2D6998CB3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\z3jtgnha\CSC8F12D8B9A4DB489CACDEFCD2D6998CB3.TMP
Size 652B
SHA256 feed43e10716c644a9477983d3170366e203733fa5350911a41d4cabdde56c6d
MD5 2cc8c098471a6a6cee6cf203332a46f2
SHA1 3dd79f1fa8efc467a874e08f7684d062210957e9
SHA512 3dea6a46dd1dcd4aa03ec5f248e7a51d0a3dd2983678b06a2e86a38d78f7d2f88846ee6cdec14061c1046f702b72f6359838096b37745c5f4222485c3d1f6186
TLSH
T131F05E0963F8120EF0F35B30BDF6836791A8BCA5DE3293ED1440035D28646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

z3jtgnha.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\z3jtgnha\z3jtgnha.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

z3jtgnha.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\z3jtgnha\z3jtgnha.cmdline
Size 369B
SHA256 6659c943c63f7a9af61a71dd35f23a8f072ef2328521420ed1fe064400921d88
MD5 1f57a951b4db0a7e8db0254752f54956
SHA1 27699fbd613868dbd7ff9721c46156d44dad2a72
SHA512 6bb6521638f2a1aa066fbc6838d4001f5792c4c80d843d905acf31d0e795abe91a9cc796745a8c52a4b7f7ac38d256005dca8e0b9460571975b9c295d912b180
TLSH
T112E0682A9286C3FD01FD1047256BC4BC83B207536D883F847062C40DE21B00027D3B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2332-0-0x00000178C4940000-0x00000178C4950000-memory.dmp

Download

memory/2332-10-0x00000178C7060000-0x00000178C7222000-memory.dmp

Download

memory/2332-9-0x00000178C6AF0000-0x00000178C6B12000-memory.dmp

Download

memory/2332-1-0x00000178C4940000-0x00000178C4950000-memory.dmp

Download

memory/2332-23-0x00000178AC400000-0x00000178AC408000-memory.dmp

Download

memory/2332-25-0x00000178C4940000-0x00000178C4950000-memory.dmp

Download

memory/2332-24-0x00000178C4940000-0x00000178C4950000-memory.dmp

Download