fdf89d69ba35945343e2fb0becb6007ecc5c99dd399a9761c921039cef9f7bd7

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-2cbdxavalb
SHA256 fdf89d69ba35945343e2fb0becb6007ecc5c99dd399a9761c921039cef9f7bd7
MD5 3ba9c3e45843634c3f6fc031072ac6a6
SHA1 28a00942e08411990e12650e8faa1d545d34a2a5
SHA512 c8c2576cb52bd31fdc017b24b87070b035d802c6b6f1e515d412e60e0fdbcefc3fd33d3962514e8977a2923ab49164da9fd33d080688ceccab92303603d184c5
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2224	powershell.exe
7	2224	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2224	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	powershell.exe
2224	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1764	2224	powershell.exe	92
PID 1764 wrote to memory of 1652	1764	csc.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bgkkgn0e\bgkkgn0e.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7606.tmp" "c:\Users\Admin\AppData\Local\Temp\bgkkgn0e\CSC64D2CB6C14E4680B337EC97F148436E.TMP"
    3⤵
    PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7606.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7606.tmp
Size 1KB
SHA256 dc6fa9ef6040528dd109b7d4a2288e803574d033952fb637ae81863a1f724805
MD5 c72e65737c8231deec18cb684abba758
SHA1 48bec431098bb824a2324f66a742589d10638f09
SHA512 dd0cc9c6c1b840e80f512b4c15ea959e0997bbe7984eee548ca6089e7a7c236aebb3cb077c95e53aac5c341da32f8660532c1a46c636fe1e5a8b73eba343bad4
TLSH
T11521AB0593ED475EF0734731A9F6176FA228FDA8EFA2979B9440422C1C91148EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sxiqcacn.cbu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxiqcacn.cbu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bgkkgn0e.dll

Path C:\Users\Admin\AppData\Local\Temp\bgkkgn0e\bgkkgn0e.dll
Size 3KB
SHA256 212d318e2b3abdaf485602ab944752f8b0b8e924fd3e2543b266a831b18df260
MD5 dc8c351c319bf6a8acf9bd9e86260dca
SHA1 9677e73e822aad4f62cd5c1280773092a31a8eac
SHA512 aa497c45acd94215b231795c53e87360e04aeb27fafcd7dca75c24287db15e5c119b947cba94f7fc975fc4fd4710dbdb40a032faebd499133aeb51288a7ef0b8
TLSH
T11151DB1A93E8066BE4770730AEF3436637B8F8109B73576E29800258AC643A85E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC64D2CB6C14E4680B337EC97F148436E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bgkkgn0e\CSC64D2CB6C14E4680B337EC97F148436E.TMP
Size 652B
SHA256 c21e96e605a0aa90f01e667c70ece40ef658cb79151ef89e54d361714abc51e0
MD5 37782bb0ad893947350361aabfc04839
SHA1 86e64308fd2b967960b58491ee48156c698f9f03
SHA512 7e25605c7a0c7044636ce3c2779e9ee9ae9e034ad2fbf43f536dee7ea90ee0b39717f1cadab62a325081ee287f257023831c2537f47852f88c01306899d39913
TLSH
T192F05E4963F8020EF0F34B30BEF643A391A8FC65DE3293ED244413192C645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bgkkgn0e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bgkkgn0e\bgkkgn0e.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

bgkkgn0e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bgkkgn0e\bgkkgn0e.cmdline
Size 369B
SHA256 aefdfecf5f062a21749e4c54055e14f9cb29785547c3b7c3e43dda86b0110933
MD5 7fcc8e6e8c5e762a3a20edd1aa6bd9c0
SHA1 daa54fa2b1aeb8c9654dc5a1fe909adfc9751c6f
SHA512 4fb3502d0268f5fb7ced5910d9f66b5b9e387c463afb71cac78aff9b9440d40d8f39108f0a32f9ab28fff0bb21129dc69efa09729ba6bba4841e4f3511aa4922
TLSH
T1BEE0C03A4247C2FD19ED1007216AC8ACCEFA0F832A407F84F458440DF03B00127D1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2224-1-0x000002C5747B0000-0x000002C5747C0000-memory.dmp

Download

memory/2224-10-0x000002C5772A0000-0x000002C577462000-memory.dmp

Download

memory/2224-2-0x000002C576830000-0x000002C576852000-memory.dmp

Download

memory/2224-0-0x000002C5747B0000-0x000002C5747C0000-memory.dmp

Download

memory/2224-23-0x000002C5747A0000-0x000002C5747A8000-memory.dmp

Download

memory/2224-24-0x000002C5747B0000-0x000002C5747C0000-memory.dmp

Download

memory/2224-25-0x000002C5747B0000-0x000002C5747C0000-memory.dmp

Download