a42189dc412e0f2faf6ffd3710996d641aa2db1c533776fcf60c6c5d29a4f492

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-2b8b9avakd
SHA256 a42189dc412e0f2faf6ffd3710996d641aa2db1c533776fcf60c6c5d29a4f492
MD5 2558a4f5aa1e0f2adb04a7d54f5b7324
SHA1 80d33303ba004b8079cd288a21f525f4fc5c790a
SHA512 91bb16c613a740c7d1825267b21e3e9bbc44902feaa72ea2b89ffa2e280c6faa112363224abcaec596d1b09ae3b3aeb2884f418dd18a75131fd9ac7496eda519
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2228	powershell.exe
7	2228	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	powershell.exe
2228	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 5600	2228	powershell.exe	88
PID 5600 wrote to memory of 888	5600	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ckbofzgv\ckbofzgv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8085.tmp" "c:\Users\Admin\AppData\Local\Temp\ckbofzgv\CSCFF89579CD9D94CD1A97C631E5C4725DC.TMP"
    3⤵
    PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8085.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8085.tmp
Size 1KB
SHA256 9be7f53d1e8a4b784d367e0d64e918b98f54c05dbff74fcc921a42f3559a21c5
MD5 c2564afc81bef80753677b6f56483fd8
SHA1 9326337603b5e90a872a0b9bd491260bbf86c5d9
SHA512 dcbd290e2db67eb8bc230af90f551ac5813c9518e2062c856cc2dcd981b2cd76f6f12cf06d47078ce25b9b7495ecd11403d1962197a9be745974b45b44678018
TLSH
T127217B0543F84B1FF073573279F6136BA678FDA4EF62A75B854042282C51554EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bgewqjhl.5sc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bgewqjhl.5sc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ckbofzgv.dll

Path C:\Users\Admin\AppData\Local\Temp\ckbofzgv\ckbofzgv.dll
Size 3KB
SHA256 afaff063e2fefdf946bcee5a4278dca151e5dc6de1bf8b7906524ed2b294f3df
MD5 c21d4f096ce02b5da647759800327c8b
SHA1 ab1b8d1fe86ca033c0b919d41f91c6a311c58c19
SHA512 c62a001d4f19f6266ae23e6bfb1cffaf7c3cf8f4cf34a56f9e8cb18ca0f529ac73934110578482cd08a921643279cea882137cd3594da590309dce0ef58134e3
TLSH
T19C51EC1A57E8466BE4730730AEF343673BB4F8109B73972A4A80025CAC647A45E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFF89579CD9D94CD1A97C631E5C4725DC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ckbofzgv\CSCFF89579CD9D94CD1A97C631E5C4725DC.TMP
Size 652B
SHA256 2efd2c564e3fbde8598aa5c1224a40a6794b35d271dcb45e5ccbe3c9e522e5b9
MD5 a363b61dcd9ae7bda17d8584538000f8
SHA1 2525c9d780206a0b536b7d5971c12bf29d128095
SHA512 780045704504c7fc49fabf411f7036387088a5498ce4e49361e62284b347e4d9c228721f71aa770a953c5b9a3958afe42752b5780bee165850fd24fa61be60ac
TLSH
T149F05E0963F8020EF0F34B70BDF643A3A5A8BC64DE32A3ED154003192C649208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ckbofzgv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ckbofzgv\ckbofzgv.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

ckbofzgv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ckbofzgv\ckbofzgv.cmdline
Size 369B
SHA256 55892790d073ab71033d0a6fa3e018c1034da162029e59b41a82f5820e2540a0
MD5 6e8c3e4070140dd03b5b32c52a203770
SHA1 bb6186f3674e24df3b6709df0a7bf6a6a734206e
SHA512 ec722ff0de0f025dd4583055d2417ef32c4cb362b53e4b593fb7dbfdc929c0ca1471f413ea8afc717b3afc3eff1d342b1168800ee44d1853f1c97f51a2d19a0d
TLSH
T1F1E0C02A426AC37D02FF20072169D4ACC272474329823FC49440482DE01F82067D17C9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2228-1-0x0000028AA8F50000-0x0000028AA8F60000-memory.dmp

Download

memory/2228-0-0x0000028AA8F50000-0x0000028AA8F60000-memory.dmp

Download

memory/2228-4-0x0000028AA8F10000-0x0000028AA8F32000-memory.dmp

Download

memory/2228-10-0x0000028AABB20000-0x0000028AABCE2000-memory.dmp

Download

memory/2228-23-0x0000028A90AF0000-0x0000028A90AF8000-memory.dmp

Download

memory/2228-24-0x0000028AA8F50000-0x0000028AA8F60000-memory.dmp

Download