223a47ff44875cd58815c363ab48eabc7f57b4e0426175e58c11f40e0fd2da69

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-2b6hnavajf
SHA256 223a47ff44875cd58815c363ab48eabc7f57b4e0426175e58c11f40e0fd2da69
MD5 93d50ffc28ad6d49845320e7dc7c64df
SHA1 1d7052c34e83d5fad9209b174e309c495bab8211
SHA512 4b6a42f64bf3c6966530df08588a340b6caa7b9728664e6ddbe95e7d1a7a2ce120185fb072d0eabbb04623b7305ad5405bc397f591a032505ab447b2b0a3a872
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2780	powershell.exe
7	2780	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	powershell.exe
2780	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3780	2780	powershell.exe	90
PID 3780 wrote to memory of 4212	3780	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yhg3yfxf\yhg3yfxf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AFC.tmp" "c:\Users\Admin\AppData\Local\Temp\yhg3yfxf\CSC7FAEEF02A395462FA8A3577CC06C7A86.TMP"
    3⤵
    PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5AFC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5AFC.tmp
Size 1KB
SHA256 bb0f24f98d7ddd1f936be9f07d47393175cad92a06e19d5a449bb83f820c4909
MD5 8b89de8f41739070a0461508a86bf5ca
SHA1 73ff330fc843e179cd9f05cd04c191458a79bdc1
SHA512 1a5713904d23c7607a97e2ae53dc1c9987c5a783ad03c48c65d8d96009a02067c7e08b5a9d9108af8703b5588b1d107c23b0b72d9fdc40ae632eee31e5a74e9d
TLSH
T10721EB0587E84B2EF0B75732A9F6132FA274FD94EF62935B8540422C2C41604EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_irotboyz.t5d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_irotboyz.t5d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

yhg3yfxf.dll

Path C:\Users\Admin\AppData\Local\Temp\yhg3yfxf\yhg3yfxf.dll
Size 3KB
SHA256 e5b3473d0f69e37dd5d13e22e53bed4d33e2fb0414db70c02b2fa6cad9e6a69c
MD5 0822089a60c4ff75525c088585fce7b9
SHA1 4f0bbdb0219ac14a735316b6196bb91bc835b89f
SHA512 d68040a997401e6b46972577added58da923c0d207eb449a875b252a415fa230782c2eb392fbf215484459c771736dc8465f0a0b22b138d54f59482c11e51e34
TLSH
T10B51DC1AA7E84A6BE4770731AEF3436637B4F8109F73571E5980026CAC617645E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7FAEEF02A395462FA8A3577CC06C7A86.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yhg3yfxf\CSC7FAEEF02A395462FA8A3577CC06C7A86.TMP
Size 652B
SHA256 1d24aafb0d1010ae9cb48314acf73d09b289e44650db6bda6f496632cd2da1b6
MD5 432b7a8f44e7866207f5cf254707ae8b
SHA1 3a2511d46d5d02d1cf1f50e86b836ddf9626dfba
SHA512 4020fb626c8d669b8e8861c8061b5a395c103f25dfa2d91145ffede73bb46e6b96d3f30f5070ba8008aa7a8ce481fb77a5e10c95412e0b683c6ceb0741c634d7
TLSH
T18FF05E0963F8020EF4F75B30BDF64363A1A8BC65DE3293ED5481031D2864A208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yhg3yfxf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yhg3yfxf\yhg3yfxf.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

yhg3yfxf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yhg3yfxf\yhg3yfxf.cmdline
Size 369B
SHA256 a6d47247c65cd1673f9e1c8e6dd36c8cd6a4f7e53af509ecadb4ca5ade704502
MD5 929eaad171b83f64e02d6e56316487f5
SHA1 967c10d24fb6925116ef820138fd94d1e95f766f
SHA512 6ade7fba3832321a8f143fe271bd620b724e9f5876d000ce23da3cee32d081f171c54cf1564732a8a5e93c281b0add2392add6806bace74abf1d45465e991984
TLSH
T1BDE0C02E426ECE7D01DD20072269C5ACC6F24B5329407FC49060440DD0B7000ABE1B65
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2780-7-0x000002B9FCEE0000-0x000002B9FCF02000-memory.dmp

Download

memory/2780-10-0x000002B9FDEA0000-0x000002B9FE062000-memory.dmp

Download

memory/2780-0-0x000002B9FAC90000-0x000002B9FACA0000-memory.dmp

Download

memory/2780-1-0x000002B9FAC90000-0x000002B9FACA0000-memory.dmp

Download

memory/2780-23-0x000002B9FCEA0000-0x000002B9FCEA8000-memory.dmp

Download

memory/2780-24-0x000002B9FAC90000-0x000002B9FACA0000-memory.dmp

Download

memory/2780-25-0x000002B9FAC90000-0x000002B9FACA0000-memory.dmp

Download