cf05a3d7301697cf776a22d8f9126f26d52e95187e42bcdcfe265f2c3044eb95

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-2cb1favalc
SHA256 cf05a3d7301697cf776a22d8f9126f26d52e95187e42bcdcfe265f2c3044eb95
MD5 59599849f49c52479f93ce0db40400e8
SHA1 6b7ee0d525eb646bf2f55cad6f9851c6a214893d
SHA512 ec5e02cfdfed5c96535845243349b54962f5f27dc936c1c160fe32c86a401e2b52a67f8788280f7c7e3c33e5d9a50696297728fc2bd83ecac5d4f38869d6b77b
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5932	powershell.exe
7	5932	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5932	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5932	powershell.exe
5932	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5932	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 1724	5932	powershell.exe	89
PID 1724 wrote to memory of 1668	1724	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ok21h41\3ok21h41.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB72.tmp" "c:\Users\Admin\AppData\Local\Temp\3ok21h41\CSC275C5EF6E1104BCA8266DADEB8D3554.TMP"
    3⤵
    PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ok21h41.dll

Path C:\Users\Admin\AppData\Local\Temp\3ok21h41\3ok21h41.dll
Size 3KB
SHA256 a92ca93f55123214f73965e690817d463d92228a59251619b95a3ed5d6db3a58
MD5 2767c22b7292b3fc20e7f676664d6099
SHA1 bd896277b845fd4fdc1ba028ca07f2a0b39bf6e0
SHA512 d079f11e5bafd6d80e7fdb50c7576702391d55db6b554823552ea39d12f5d7c2d419f8ed04c831a2823cddf7d3dec96da8cb9c3a8393325fb310e490fb655b5c
TLSH
T10651CC1A57E8466BE4770731AEF3436637B4F8109F73536E19800258AC657645E31BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESFB72.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFB72.tmp
Size 1KB
SHA256 5daf678103dd23305ef140a9af1d0b187f22e6a8fa53f18f8c305ff5affddbd5
MD5 e60e82b830d43087508731a65d59f7f6
SHA1 b483fff58e74e8a63a93d48ea36c6b3052a3a841
SHA512 4fadf85abf616620bf0e22aee58738fc6d2508ffebb8347b9b761081eccb5ae7c4b4b5a264a550a62a64c79af0eb9cb33f5b7c92d60e83495fe2d5bc4af12ec9
TLSH
T14821A60493E98B0BF0735731A9FA072F9278FD58AFA2976B858042281C51108EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ktjuh55o.3eg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ktjuh55o.3eg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3ok21h41.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3ok21h41\3ok21h41.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

3ok21h41.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3ok21h41\3ok21h41.cmdline
Size 369B
SHA256 fea0e017138702d35db9cd6e4fd2c41eb16cfeaf4fde98d41f776fe6c0d0dcd6
MD5 170ab5368f2b79a72da21da24d5aaacd
SHA1 ffb8fa3f019df95ccd4d2a0b0f473b60a07158c7
SHA512 c355bb267bd67cb453f968e50b53d49c46bc270146c8a6360193b8528cfa0ec4f5cea4209feb06c789f8af139ab81fd78c2b308f7907c9cf128fb852a0fb5cbf
TLSH
T1C3E0C03B4657C67E53DD1397226BC4ACE2B2074739403F945840C43DD21F00A2BD2783
MD5 SHA1 SHA512 TLSH

Submit Download

CSC275C5EF6E1104BCA8266DADEB8D3554.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3ok21h41\CSC275C5EF6E1104BCA8266DADEB8D3554.TMP
Size 652B
SHA256 028723c9b2d8a69008e42f4456af1b249f1a99ce9aeefc882090f0434c50861c
MD5 a4dcde8add10a9842f82fd40e1229129
SHA1 9047c8bfe3b5f49abf20ed040b3557716cc3a421
SHA512 a02ad161e9beb7966cc9633f13faa0fcd2f924915cc03b29fe67655630499f6eb95f677011653638bee90ff991e2f064de6e7aa7bfb122961dfd3ad58925e477
TLSH
T122F05E0963F8420EF0F75B70BDF6436791A9BC65DE3293ED158003192C649109A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5932-0-0x000001D679E80000-0x000001D679E90000-memory.dmp

Download

memory/5932-10-0x000001D67C8A0000-0x000001D67CA62000-memory.dmp

Download

memory/5932-23-0x000001D679DF0000-0x000001D679DF8000-memory.dmp

Download

memory/5932-9-0x000001D679E20000-0x000001D679E42000-memory.dmp

Download

memory/5932-1-0x000001D679E80000-0x000001D679E90000-memory.dmp

Download

memory/5932-25-0x000001D679E80000-0x000001D679E90000-memory.dmp

Download

memory/5932-24-0x000001D679E80000-0x000001D679E90000-memory.dmp

Download