af1c299f1214c9373767c66a6cb5d236d71464ceed1b9942ab8c766140794457

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-tk3jcsdg75
SHA256 af1c299f1214c9373767c66a6cb5d236d71464ceed1b9942ab8c766140794457
MD5 f4631e89ae72bdc2a2b4440dea686ccc
SHA1 350374123b775a25f9d2c5d57e8ceca61570591f
SHA512 c993861c594b090a22ba9adf23bdc3cb2b7c468d8c0df542fb58228a98db3f891a6653d2c3815f1565b6c9350ba2b45105b40438f59a5efd6079777ab7914e1e
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4880	powershell.exe
7	4880	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4880	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	powershell.exe
4880	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1920	4880	powershell.exe	88
PID 1920 wrote to memory of 2452	1920	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aoimbfvc\aoimbfvc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEA8.tmp" "c:\Users\Admin\AppData\Local\Temp\aoimbfvc\CSC4A1F80768314469D84378FD7CFA7C052.TMP"
    3⤵
    PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESBEA8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBEA8.tmp
Size 1KB
SHA256 471cbd813f4bb2b0984a2a2e5715bf192439420217687be15c4a7d9f7bbc0d3a
MD5 076b91e532c03f1556b528cd965993c9
SHA1 822adb99189f8ef8d34656c0af457493ebcb0cb8
SHA512 e0f8be465d13fd20621f0a64642ec0949595ebd9919afc51f2ec8f69b04a8b8479f281b4bf2589aa8987bae048307d926d3261e56019a981e3d77e354f14aab8
TLSH
T12821AB0553E84B1EF0B3573279F6076FA274FDA4EFB2A36B8541522C1C51504EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mshfgjmn.dqx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mshfgjmn.dqx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aoimbfvc.dll

Path C:\Users\Admin\AppData\Local\Temp\aoimbfvc\aoimbfvc.dll
Size 3KB
SHA256 8af032d622087a06263e84d80deaab2729074d0628d277d961c9e74bb778f1a5
MD5 8b7c6d756d1426bdf5f74c6d8c688a99
SHA1 e2a5b8a0eb0e059b5bf82d98f0cb0f780591e4a3
SHA512 c027402b26339682bdecdfe5d42cf4e24ecb2b707114304873e81ca3e1fa181a7f223cb985ff4a8695e38a28a9a0b13a995ff12450b915e33c0963c964968af5
TLSH
T11D51EF0AA3E8462BE0B707316DF343663BB4F8109F73535E0980125CBC647645E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4A1F80768314469D84378FD7CFA7C052.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aoimbfvc\CSC4A1F80768314469D84378FD7CFA7C052.TMP
Size 652B
SHA256 eef60625258827988935e18ac6a418ee2be40bee6b407e2e470a2e1c01f38681
MD5 ab9b9e8733c9fb3f4df9f5a21fd98f3b
SHA1 646a73c5f986474874d35bf91cc2f2c9010e8d9e
SHA512 bb9f1d72425af63e869da1e7ae8ea8ecf38474bac78b91497265e7803d04a1d0a8771f31452bf602964f40cad994754477c29a612879cd3ad720c26f8031f2df
TLSH
T189F05E4963F8120EF0F34B31BDF643A795B8BC64DE72A3ED1451135968649208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aoimbfvc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aoimbfvc\aoimbfvc.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

aoimbfvc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aoimbfvc\aoimbfvc.cmdline
Size 369B
SHA256 7cd3218799c7299116bcade03a0d6aa01de65fd2466dc820810d9b918f4d01bd
MD5 24458654c609c4e875884c84f97316e5
SHA1 e0c7e5cecb0f1735d2b6f5268da71828ceffab4f
SHA512 bf7208b6be1273eb65e3fcc7c42fc98344dae4c21747582aa8cb5df5c4db5e808056c956ec0863e210a4ecb3aee41edbf213678f11e65fa3aa33cb290043624e
TLSH
T110E0682B6346C37E01F9210F2969C4ACA2F25E432D603F885040840DF02B000AFE1781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4880-1-0x00000241CCA90000-0x00000241CCAA0000-memory.dmp

Download

memory/4880-10-0x00000241CF840000-0x00000241CFA02000-memory.dmp

Download

memory/4880-9-0x00000241CED80000-0x00000241CEDA2000-memory.dmp

Download

memory/4880-0-0x00000241CCA90000-0x00000241CCAA0000-memory.dmp

Download

memory/4880-23-0x00000241CF260000-0x00000241CF268000-memory.dmp

Download

memory/4880-25-0x00000241CCA90000-0x00000241CCAA0000-memory.dmp

Download

memory/4880-24-0x00000241CCA90000-0x00000241CCAA0000-memory.dmp

Download