5d4d51422a6d605bc3957819eb1d7834d3d55665c2ee3bca083c84363ef54deb

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-tk2xtsdg73
SHA256 5d4d51422a6d605bc3957819eb1d7834d3d55665c2ee3bca083c84363ef54deb
MD5 871608e71ab740364495d96cc74217d5
SHA1 84bcb3e8b73052669eb31aa6e605a955a7a34008
SHA512 3aec1082b26819f1378a956c8ddc65d0725fd56db1ffba725fe0b4a7f433b24cc040de6783b3de7208badac0316d0ce8c970e35100692598b6f899b229cead86
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4880	powershell.exe
7	4880	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4880	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	powershell.exe
4880	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2668	4880	powershell.exe	88
PID 2668 wrote to memory of 1092	2668	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lw2jq513\lw2jq513.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD99.tmp" "c:\Users\Admin\AppData\Local\Temp\lw2jq513\CSC2AAD2DF024D54A4AB57BA9379F72BF.TMP"
    3⤵
    PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESDD99.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDD99.tmp
Size 1KB
SHA256 52522d5f6f5bb4b572a3bd41aec90a761d944c9ed1c66cec66e877fbbef86e46
MD5 062b3114f9b57906d535ce3c52e52c45
SHA1 ac4fcf609592ceec6ae50a1db36a6f3e9648babb
SHA512 eeaed498c33e31f41bc1e0464b559ba32239619b65acdaab46f1d78eae590321a7f71f1646c468b25f8b1f2a095d31eef1e114743f831851ae2cb0b3b931be41
TLSH
T12B218C0583ED471EF07357316DF6272FA278FDA4AF62579B954042282C51504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0y3y2new.vwo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0y3y2new.vwo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lw2jq513.dll

Path C:\Users\Admin\AppData\Local\Temp\lw2jq513\lw2jq513.dll
Size 3KB
SHA256 1b573b3fcb53d75e751ac662fc7ae7ac0a61830cfb95e4b141c0d9dc11aec218
MD5 46b2e1d11d8e70c1dc2c3fa189245370
SHA1 f592ac2b515a78e136092392e71927f8c943cc8f
SHA512 9f9cd53e4c218a11d1aa2270444e25178da3dfddfdbc80bb6a013855b4a031a78d8a310e0a80b082e02b657b96e3b0f3f59b7abbed51966be6b2d2e6a13da0e8
TLSH
T1F651EC1A57E8466BE0730B31AEF3432A37B4FC519B73935E59C00258BC613A45E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2AAD2DF024D54A4AB57BA9379F72BF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lw2jq513\CSC2AAD2DF024D54A4AB57BA9379F72BF.TMP
Size 652B
SHA256 88c335b56655963f9b18605e54c0a4e4ae44062ebeffd094814b91ac4575c836
MD5 3e29ef01804600261669250886444ab0
SHA1 1cd467591e2cb18ee442e1544955589e6dde4597
SHA512 177d2bf2b4249b89662b57f6793cd2ad1069abc1733b505c7d0eb09dd7048ea5b284c14f2c10b629cd65caf08e0c3d5aaf6563bf97e9e1e5f3e34afa7dc49ef2
TLSH
T1D9F0820963FC420EF0F35B30BDF6536791A8BC65DE3293ED6880035D6C645109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

lw2jq513.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lw2jq513\lw2jq513.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

lw2jq513.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lw2jq513\lw2jq513.cmdline
Size 369B
SHA256 841e1b261570a461fa19eb5b0bb49aec75af8b613a2553d5c3e7e89fe034cfc0
MD5 c7219a9842dccb7eaae2d94a005803a5
SHA1 2f64fcafdf317fccf1e8e37cc7e639c23d8640d6
SHA512 be0d9adface3dafcc9c2c95103d89f68f8e158c78d2dd8fb2d2e8e12370ec0b9ef964aadd88a11760bd4b482a91f57355f3903d5d9ecc9e762c9646819eb9cda
TLSH
T1ACE0DF2B5257C7FF15EA280B22BAC5FCC3720AC72981FF89A150D45DE12B0056BE2799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4880-0-0x00000197C2A40000-0x00000197C2A50000-memory.dmp

Download

memory/4880-10-0x00000197C5380000-0x00000197C5542000-memory.dmp

Download

memory/4880-9-0x00000197C4D30000-0x00000197C4D52000-memory.dmp

Download

memory/4880-1-0x00000197C2A40000-0x00000197C2A50000-memory.dmp

Download

memory/4880-23-0x00000197C4BE0000-0x00000197C4BE8000-memory.dmp

Download

memory/4880-25-0x00000197C2A40000-0x00000197C2A50000-memory.dmp

Download

memory/4880-24-0x00000197C2A40000-0x00000197C2A50000-memory.dmp

Download

memory/4880-28-0x00000197C4F60000-0x00000197C5062000-memory.dmp

Download