b8d6f60bd08712b0573c64ccd65469d89ec625d865c2aecebb74808b2079b3c7

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-tk3t5adg76
SHA256 b8d6f60bd08712b0573c64ccd65469d89ec625d865c2aecebb74808b2079b3c7
MD5 e1f1420ae1cee0b6fcf733e43b4969e0
SHA1 50f276eb8b3b8c57372caa359606c92bf131a7a3
SHA512 fafe4a95661e8c147ce5610822614a69aa80411ed2f854e779568383f29f4f8f93c8002dec17cc13c01b619b6a1f7820df8d6dfdebb24821fa35a604b1370d71
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3972	powershell.exe
7	3972	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3972	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	powershell.exe
3972	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4912	3972	powershell.exe	89
PID 4912 wrote to memory of 2824	4912	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3p3nfiwa\3p3nfiwa.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D9E.tmp" "c:\Users\Admin\AppData\Local\Temp\3p3nfiwa\CSC85955EBEA8F94E41ADF4D28752C771DA.TMP"
    3⤵
    PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3p3nfiwa.dll

Path C:\Users\Admin\AppData\Local\Temp\3p3nfiwa\3p3nfiwa.dll
Size 3KB
SHA256 a7d4fb8e73afbf14aed4dbd1c9cab0163825d5cd5faf22c42df967ac88e6c0a7
MD5 249cd577fdb617527bf8aa1c3401dacc
SHA1 066fac34cc1c3c5369654ab1ea607c6d79d4d7ae
SHA512 527aef734ee024dddbc33b5a4b79639d593d8b15581b978b5d83da10f3e83c1263755119477b0420cc52a6956ae8c0a73553b835b84eee2f75988da25ad50073
TLSH
T1FC51EC1A67E8062BE4B70B31AEF3436A37B4F8109F73576A19C0021CBC647649E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES2D9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2D9E.tmp
Size 1KB
SHA256 d9542bcaa1d8cf5c567539ead4e2aacc0a901bf7134281851f64415a61726d25
MD5 8888894dda5d442d0b1cb6280f775bf7
SHA1 8a782542571f7a22a8ec858f4ae34084cc0d989d
SHA512 219043a85b483b7a28460a72f04c62483589275214c83f917ec552dd67be7e70d9555a3107320859266acef671e3f0238dfb5a6c71ff2dfb5b363b26db394f8e
TLSH
T12F21CC0093E84B1AF0B757316DF6172FA238FD64EF62979B8680412C1C40504EEE0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jhs05had.apg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhs05had.apg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3p3nfiwa.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3p3nfiwa\3p3nfiwa.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

3p3nfiwa.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3p3nfiwa\3p3nfiwa.cmdline
Size 369B
SHA256 ea81bb86fbcbecc81cc3499a9e04e456d6a91bf51f6dcd98030f3644ee53b36b
MD5 7c35353e15ca04f4f2e35a60eb91c283
SHA1 40581d46f2a3bc1d1b1561a63e1bf553a17e2ec7
SHA512 573497a607096c85264e1519b8190d20c26bdf7f2b8ffe7694803c6db203aae6ad145258b3f349a44e920551a43f89615d265fc918dd8a7e43c4c1e5b1977682
TLSH
T15AE0203A6267C67F15DD31072169C9FCC2B2079739CA7F945155845DE037004E7D17D5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC85955EBEA8F94E41ADF4D28752C771DA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3p3nfiwa\CSC85955EBEA8F94E41ADF4D28752C771DA.TMP
Size 652B
SHA256 d1735f0bfd6fca66c6919ddc867def17bcd56a097e56e4a870f5f9a740344a82
MD5 67ffb7f995ecace5963c7b86cd671efc
SHA1 697731119494eba7a7cda8526d157913258c059b
SHA512 994a82b4bff08ea5229b98351599763890cab8ba2c3d0a5d74a0e0c4b9754ba9e79a87ed980df1ad592112fc10fd03ab850a59aa2c0a09a0fd5c5f23311b206f
TLSH
T156F03A1973F8020AF0F74B70B9F6536791A9BC65DE32A7ED1580031D6864914D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3972-1-0x000001CD1CF00000-0x000001CD1CF10000-memory.dmp

Download

memory/3972-0-0x000001CD1CF00000-0x000001CD1CF10000-memory.dmp

Download

memory/3972-7-0x000001CD37500000-0x000001CD37522000-memory.dmp

Download

memory/3972-10-0x000001CD37C00000-0x000001CD37DC2000-memory.dmp

Download

memory/3972-23-0x000001CD37770000-0x000001CD37778000-memory.dmp

Download

memory/3972-24-0x000001CD1CF00000-0x000001CD1CF10000-memory.dmp

Download