8daae9c82bc326d38bc5cab74ee800febde17fc6569d6fae3f7048f3223b5c85

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-tk1prswgra
SHA256 8daae9c82bc326d38bc5cab74ee800febde17fc6569d6fae3f7048f3223b5c85
MD5 f6e1c1fc7a2a848d983d073e23044343
SHA1 bdea46807edfa196a0b152559d51c822b0439091
SHA512 e3b483f86202b52c9090a556543e345c537ed9d11c1bdbaedff596052cf9315cd47c63bc5270a3e3684e62567d08895b594a5a7a063bf3d133075f3012a9b52f
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4076	powershell.exe
7	4076	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4076	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	powershell.exe
4076	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4252	4076	powershell.exe	87
PID 4252 wrote to memory of 2264	4252	csc.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3trxeiku\3trxeiku.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6B8.tmp" "c:\Users\Admin\AppData\Local\Temp\3trxeiku\CSCD07CF29281D44FA38B6668CAB9343DD.TMP"
    3⤵
    PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3trxeiku.dll

Path C:\Users\Admin\AppData\Local\Temp\3trxeiku\3trxeiku.dll
Size 3KB
SHA256 8a35e12369370dd8527a25ceec29b87199ca894caed8f2ac187f0021edce5431
MD5 e4552567fa3b7bc017759c3452e29af9
SHA1 880bd8d754b15f23f5c6b489ffbf488ceff3fc51
SHA512 6130028a9a0ec4811d46d1da30f2c8d93df2b66634069be01dee5d4bab90bca2abc8b2ca1c219f9eca53f60f1d558b6e173ced4b754112d9f153fd346e5b4333
TLSH
T1B7510C0A97E80A6BE4730731AEF3432637B4F8208F73932E0980025CAC603A45E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESB6B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB6B8.tmp
Size 1KB
SHA256 b6167759b52e59f752b2c9f6bc5d207c35a759d49781c435db60382dfa8594fd
MD5 1e08412e78dec5abdddf03c4fbadaac6
SHA1 df6014f821684da9fc4db589dc76f3f7acf63a1e
SHA512 a7097d2e4da67fad1446de7d3d4ffa89691039a1667310fa7b728a0be3f140b67ab2d5dcd8f918fd41421a71d868251071bcb42eae3024e91a724a30168b17e8
TLSH
T12A21AF0583ED4B1FF077173169FA072B6275FD55EF72975A8540422C1D51104EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5tnoryzi.h3t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tnoryzi.h3t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3trxeiku.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3trxeiku\3trxeiku.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

3trxeiku.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3trxeiku\3trxeiku.cmdline
Size 369B
SHA256 b6edaf5fec66a422d83c3f5ce4eff043ed295b7bce92912434aad74a212336a1
MD5 511e4dfc994d5c211796524b1cae414d
SHA1 a54883b5d588a952cdd3f41f1f2d40305586ee0c
SHA512 5e143a89db8c6ae1b27b581b94b0a578d02a3cb2692b30d3e9becec66ca9db0607b6b42d46d354a9194d2cf7efad82a79c58a85a04d90d59c94a56ca29ec7740
TLSH
T1D1E0C02AC68BC3BD05DD1007326BC6ACD2B2074F2E413F845241444EE79701227E1F55
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD07CF29281D44FA38B6668CAB9343DD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3trxeiku\CSCD07CF29281D44FA38B6668CAB9343DD.TMP
Size 652B
SHA256 b6343975957879ded175b4c46547a1a6443d257e4cae2b37440e8020b509e327
MD5 ba4618ca15d2c4cae584b92c95271d3c
SHA1 76e5aaa5d130fb369513a51d6810d511005c6b1d
SHA512 d99349c0aa6129bdbfb9dd7bfea736f66dd75d4f587ca399860393838a39901ea1e00dc1d6fd15eac4fd97592d574dcccf812966bc9938f47bb9fa59452df807
TLSH
T1CBF05E4963F8020EF1F34B30BDF64763A1A9BC65DE3293ED1444031D68745108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4076-10-0x000001DE519C0000-0x000001DE51B82000-memory.dmp

Download

memory/4076-0-0x000001DE36A10000-0x000001DE36A20000-memory.dmp

Download

memory/4076-9-0x000001DE36B10000-0x000001DE36B32000-memory.dmp

Download

memory/4076-23-0x000001DE36B40000-0x000001DE36B48000-memory.dmp

Download

memory/4076-1-0x000001DE36A10000-0x000001DE36A20000-memory.dmp

Download

memory/4076-25-0x000001DE36A10000-0x000001DE36A20000-memory.dmp

Download

memory/4076-24-0x000001DE36A10000-0x000001DE36A20000-memory.dmp

Download

memory/4076-28-0x000001DE51390000-0x000001DE513C5000-memory.dmp

Download