9433759585f8c9a31578f9f011271a671548e795031e24d0a0ea215f07e1db59

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-tk35wsdg78
SHA256 9433759585f8c9a31578f9f011271a671548e795031e24d0a0ea215f07e1db59
MD5 0a30c2e371b93f23b1b69d08860f2225
SHA1 5f496d4481ed38b5b5b294367b79634059f514ee
SHA512 33125d2e626eb0507c95752d0de35c42d0d5e559fa369dea64d7eafc10f90ddf70766e4b2b1e044fe953a3f56c8566544646c732403d8737ea7a13ac73437392
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4864	powershell.exe
7	4864	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4864	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	powershell.exe
4864	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4732	4864	powershell.exe	90
PID 4732 wrote to memory of 3740	4732	csc.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sfw3axii\sfw3axii.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9054.tmp" "c:\Users\Admin\AppData\Local\Temp\sfw3axii\CSC5772F50BBAC14CE3A7AB5B165A26F05A.TMP"
    3⤵
    PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9054.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9054.tmp
Size 1KB
SHA256 d77186cec19bd09b74e42d19c6ed6ce58f806891ba62ddbea60559495ee073e3
MD5 e70e9c261307813fd85a9468244bb5d8
SHA1 b87a91c845a25b8c05e17907684b3278a4b628c8
SHA512 6d1bdd89d0da33bade1f0cea79c8b8663e3481681db1529e09b304ba715d75d0e464c98d60f922b384aa96702cd92a38150333cf32196b6ea5cd635987cc01e9
TLSH
T1CF21CC0583E94B1BF0B3873169F6672BA168FC58EF62935BC400012C1C51104EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_l4chnic3.cti.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l4chnic3.cti.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sfw3axii.dll

Path C:\Users\Admin\AppData\Local\Temp\sfw3axii\sfw3axii.dll
Size 3KB
SHA256 b3845972cd584c42ee3836bd3e6296104a7a6afd3f241c13998b49492f123a1d
MD5 f96f22c85c4f7dc00da8a98f922efc1d
SHA1 87c33e8a1bdfe9bc1ce77ce9196a63adc419f796
SHA512 4277d1e87e33554d9e889f21e648e96da40c453fd261cd5c0cb55af035322826411185169429e2e47cd88c17c8f00da109e2f4112f8ab1151414fabf70412afb
TLSH
T1C551EC1B57E8466BE4B70730AEF3832737B4F8149FB3936A5980025CAC643A45E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5772F50BBAC14CE3A7AB5B165A26F05A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\sfw3axii\CSC5772F50BBAC14CE3A7AB5B165A26F05A.TMP
Size 652B
SHA256 60399fb28cadfe13aa9adc79247bb54687878179a414f4a1a65abfa78898939e
MD5 1fb1a992581650417c65c307d494b523
SHA1 bd9436b89f0360bfe4c8babfe145d3f267a9ad12
SHA512 7459240743aba0962e4ade43131c438a3e03e8b3eb8e8dd1a069775451ee59d950b6ac7f57c738c843b5cbb3cba098bd7d979fcd87e3714eb3e2effb3a596a6b
TLSH
T103F05E0A63F8520EF0F34B70BDF6936391A8BC65EE3393ED5440035928645108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

sfw3axii.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sfw3axii\sfw3axii.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

sfw3axii.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sfw3axii\sfw3axii.cmdline
Size 369B
SHA256 9764e914746a8e34d082ad9ae79ccd1f49aded18fcc0c5e5ac529e1f2657c1db
MD5 f0c8fd43fe79549a645fa051f9da6eb7
SHA1 443a2a6d55ce3ffd01d216e9ac2c39cb02c2ff3e
SHA512 470a51f9e88db0f3ea29a3eac12c96e14758093631f63520a03d962faf9e42dbe15b3a586930477793e6b20f863177a661fb0c403461021b8b48ddcec4902a77
TLSH
T18FE0DF2F5256CA7E16FD101B227AC9EC82724A8B3D82BF85E958845DE1270046BE27D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4864-2-0x000001D437940000-0x000001D437962000-memory.dmp

Download

memory/4864-10-0x000001D450B20000-0x000001D450CE2000-memory.dmp

Download

memory/4864-0-0x000001D435FB0000-0x000001D435FC0000-memory.dmp

Download

memory/4864-1-0x000001D435FB0000-0x000001D435FC0000-memory.dmp

Download

memory/4864-23-0x000001D437970000-0x000001D437978000-memory.dmp

Download

memory/4864-24-0x000001D435FB0000-0x000001D435FC0000-memory.dmp

Download

memory/4864-25-0x000001D435FB0000-0x000001D435FC0000-memory.dmp

Download