7171d4de4a8b75387d02685c8a33e3292589d92d7e8459300aeaddb0fbc53e13

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-2b9kbavake
SHA256 7171d4de4a8b75387d02685c8a33e3292589d92d7e8459300aeaddb0fbc53e13
MD5 40d9a1901be93aab91b3cf4f62a9e197
SHA1 f61f2ed841f21bba31e23b3942a20ddba27438de
SHA512 131277535f71f4204014c9886413cfc4175603135fa0b06993f0701912f85b34297cd90aa642f853ac2a3476ec2dc87b575c3902b388fe88220d940149454a56
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3908	powershell.exe
7	3908	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3908	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	powershell.exe
3908	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4728	3908	powershell.exe	90
PID 4728 wrote to memory of 3512	4728	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nbeuw5e4\nbeuw5e4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF18F.tmp" "c:\Users\Admin\AppData\Local\Temp\nbeuw5e4\CSC13E2DF1CF263453B89199B8ECC9EBB.TMP"
    3⤵
    PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESF18F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF18F.tmp
Size 1KB
SHA256 672fd76231538fb67c40052cf1404cb873b1c1adf480f4d5177fcbe68164fd7a
MD5 a5a46e9033f5a40b80391420d17f7f48
SHA1 1a62312bed108f7c04a75fecef01cf470ad3a8ad
SHA512 5c1ac3e1c03fced766364a5b1e037730d7708d701d80639a7d3cfcdcc3f924f366c15d4f20f3457923305710380fe228840c81572607d80808aa811a3f319030
TLSH
T103218C4583E8471FF077173269F6172FA274FD65AF62935B854052281C91504EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o30vkdxh.4jr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o30vkdxh.4jr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nbeuw5e4.dll

Path C:\Users\Admin\AppData\Local\Temp\nbeuw5e4\nbeuw5e4.dll
Size 3KB
SHA256 5b7808520e04a523bbe9ba17fb8884ff92cc27ac901ff82a7e1909f4da3241c9
MD5 4df88b81b5260fdf4e944b469e472e91
SHA1 8d298e94e9ef8c31bcb3812e40145294391e3a48
SHA512 7406ade2291178d5cd1cca36392715fb9c1f67e059a3d079c081fe1cada2259d6d9aa7a7cbf89e2f59d2f187b7946a75ce9ef37da3a0ff57758e2d5cb493dcdc
TLSH
T14251DC1BA3E8466BE4770731AEF3436637B8FC109F73935E19800258AC653A45E35BB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC13E2DF1CF263453B89199B8ECC9EBB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nbeuw5e4\CSC13E2DF1CF263453B89199B8ECC9EBB.TMP
Size 652B
SHA256 13458c1d396c5c1da83ba43cb10aee25da1b90d7051bbaadb05fe8fb3bc38cdd
MD5 59aa169c82bd78239777b82c91f5c1bf
SHA1 a328b7b6238a3eba5a47e40c5656a047a8ebb09b
SHA512 73a9b2d80ca32413d84635e909d8ad5b29eb6847d8ce7afc1b23a1088639f917cdbde0f5e318d6eaa7533e16635ae6a746e80ff8dfc45686d245e1a830ecbb07
TLSH
T1AFF05E4A63F8020EF4F74B31BDF643A3D6A9BC65DE3293ED1840031928646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nbeuw5e4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nbeuw5e4\nbeuw5e4.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

nbeuw5e4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nbeuw5e4\nbeuw5e4.cmdline
Size 369B
SHA256 8abac1904442c53110a6abb93c4059bf9d6a3318ed934701394798f39719c783
MD5 37d1718ded316f5af6fccec908f0aacf
SHA1 ada0c92788664ab55a3110c7fc98e430a6b258a6
SHA512 53c8807ec33a9d676b586756a0441297b7324bb55bf58a89970e31a1fb48daed8e59d7192f4be728eb074f3e7bf7c35efa0032f81b57dd80ed51877245351d54
TLSH
T182E0C02A52ABC27F93ED1007216AE7ECC67707432940FF845070440DD4170042BD1B6D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3908-1-0x000001A45C9B0000-0x000001A45C9C0000-memory.dmp

Download

memory/3908-10-0x000001A475AC0000-0x000001A475C82000-memory.dmp

Download

memory/3908-9-0x000001A475550000-0x000001A475572000-memory.dmp

Download

memory/3908-0-0x000001A45C9B0000-0x000001A45C9C0000-memory.dmp

Download

memory/3908-23-0x000001A45CA00000-0x000001A45CA08000-memory.dmp

Download

memory/3908-25-0x000001A45C9B0000-0x000001A45C9C0000-memory.dmp

Download

memory/3908-24-0x000001A45C9B0000-0x000001A45C9C0000-memory.dmp

Download

memory/3908-28-0x000001A4750C0000-0x000001A4752DC000-memory.dmp

Download