8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
Size 12KB
Sample261002-w2ppyavdkc
SHA256 8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef
MD5 58360eb1e4a6564a371004455f5fb6cd
SHA1 f7b40e83c240d6abdb05c281e1739cb2c6348afc
SHA512 8f166861ea2dd485b54623840ecbc004d6ae2c20cb73b05e53e5965bac1ede54fe58672bb64118ee4731a00258d8cf805d0d6f36706624efe03647fce53cc508
SSDEEP 192:wpHsyZ3dPpvGd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJt2:wpHpZtPpGd1JNsvYlGwAXJk
TLSH
T12E4271E56725922A8872611DCECEA04DF60355331EBB1B15BEBC87312F3A064F27A74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3480	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2064	svchost.exe
620	svchost.exe
4120	svchost.exe
1076	svchost.exe
4776	svchost.exe
3296	svchost.exe
2232	svchost.exe
4848	svchost.exe
3348	svchost.exe
3452	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 2064	3480	powershell.exe	93
PID 3480 set thread context of 620	3480	powershell.exe	102
PID 3480 set thread context of 4120	3480	powershell.exe	104
PID 3480 set thread context of 1076	3480	powershell.exe	112
PID 3480 set thread context of 4776	3480	powershell.exe	113
PID 3480 set thread context of 3296	3480	powershell.exe	114
PID 3480 set thread context of 2232	3480	powershell.exe	117
PID 3480 set thread context of 4848	3480	powershell.exe	118
PID 3480 set thread context of 3348	3480	powershell.exe	120
PID 3480 set thread context of 3452	3480	powershell.exe	121

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1460	3480	powershell.exe	86
PID 1460 wrote to memory of 3004	1460	csc.exe	88
PID 3480 wrote to memory of 5080	3480	powershell.exe	91
PID 5080 wrote to memory of 1652	5080	csc.exe	92
PID 3480 wrote to memory of 2064	3480	powershell.exe	93
PID 3480 wrote to memory of 620	3480	powershell.exe	102
PID 3480 wrote to memory of 4120	3480	powershell.exe	104
PID 3480 wrote to memory of 1076	3480	powershell.exe	112
PID 3480 wrote to memory of 4776	3480	powershell.exe	113
PID 3480 wrote to memory of 3296	3480	powershell.exe	114
PID 3480 wrote to memory of 2232	3480	powershell.exe	117
PID 3480 wrote to memory of 4848	3480	powershell.exe	118
PID 3480 wrote to memory of 3348	3480	powershell.exe	120
PID 3480 wrote to memory of 3452	3480	powershell.exe	121

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5tq2iwf5\5tq2iwf5.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCCE.tmp" "c:\Users\Admin\AppData\Local\Temp\5tq2iwf5\CSC106CFC03A16941F787558E763BA1BD9.TMP"
    3⤵
    PID:3004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mtajzwia\mtajzwia.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE460.tmp" "c:\Users\Admin\AppData\Local\Temp\mtajzwia\CSC8BA3DB07D2C54E8E97E67336994EBFB.TMP"
    3⤵
    PID:1652
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5tq2iwf5.dll

Path C:\Users\Admin\AppData\Local\Temp\5tq2iwf5\5tq2iwf5.dll
Size 3KB
SHA256 b82f41554bbeff060444438123e86ee738686f336609bfbc0faf8e1bdd658776
MD5 f6dca0a7329483fe4a53f1686144ceb2
SHA1 d03c9b78f3c6a02922bc008b37639ecaf442f919
SHA512 ec8c26f27dd3c05b0624a0d7de3947a96c01b0a53d6792a6a9f06b7090c8c050401f9422739b3e37a7d449002918dd0470741054c5df73d4dc85112e61fb3bc5
TLSH
T1C151C90AA3E8866BF4B70730AEF3472637B8F8149BB3535D09904218BC643545D22BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESDCCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDCCE.tmp
Size 1KB
SHA256 c707fff052618375cb0dd30fe37c522acaab634d22227c5a4a6e8800de6d29b6
MD5 9c65c82beb04e46afac6f327c87a8a66
SHA1 252bd5759de32cfee95335a389f4364517f6a082
SHA512 e8937815275cfcd33c07ef4c421293d42739c165fae385a947cc948315faf4694a22a0655b5adc82b06ed5678b8c51528d64a87900995b7c0dd42b990b19be59
TLSH
T184218C0593E88B1AF07747316AF6132FA274FD54AFA2935B8582412C2851504EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESE460.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE460.tmp
Size 1KB
SHA256 9db1e10fd542f29b8b06b57508bcabb0f4f21552bbfb9ad660195a1304cff03d
MD5 b292f567bbf4365a5b610c28cfb464e9
SHA1 79846c4ee17bba309f65a8d64363bec699da4678
SHA512 3d75d07062ac877d09fd964686cbc050f6fede863f31403a9154e775d1a5f3d6bddc355b3397e35e482677ab88c7a7c32a8708c605d06e2af7bbed98151919b5
TLSH
T16E21AB4487EC4B1EF0B74B3169F6172FA264FDA4EF62939B8440412C1C51504EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_22uqnihq.4vl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_22uqnihq.4vl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mtajzwia.dll

Path C:\Users\Admin\AppData\Local\Temp\mtajzwia\mtajzwia.dll
Size 7KB
SHA256 e1293c0939b45fd224f5dd7569b807b878042d4fc9fbc1b95e92e7fa615522a8
MD5 b9bd05508e8328542b9d8819b02d5714
SHA1 b2aea3df4f910f2b1c1683d981d9a064fab9ae69
SHA512 f3832ff9685d672b047236798dacf7c7936df900f9c694119154f38643258d9a9c725187aeb809b2f07b67f2dd90542f6f3c68aced2645234219366c3ce272b2
SSDEEP 96:FguYgZxIVIkaxN3rISmCUNYCaMNdVX/LaQ/K:FguYgEda/3yqCrvRaJ
TLSH
T156F1195EDBCC8275E9AE0B39A4F3060167B484448F339A5B09EC90073E67B991B633E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5tq2iwf5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5tq2iwf5\5tq2iwf5.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

5tq2iwf5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5tq2iwf5\5tq2iwf5.cmdline
Size 369B
SHA256 809b6d0bf2a519a9139e5172cd8327150f01ab1113428858e3fac6f571fa0abd
MD5 43aaf475517b8da0a6e4542d5890c7ed
SHA1 707181d829d94c563ec1afe08ae8b6750c7b54f9
SHA512 809382f9973ade01b8c747797db0b4d97ab7f8a0665e2ed1241b52f75abf66d40aec506d9b0b3faaacf29347d474a65bafff7435a3f74a9f21ed37a06d9ad1a8
TLSH
T13FE0262A5356C77D25FD100B237AC6ACD2B207872EE17F849A58846EE2378046BD2F95
MD5 SHA1 SHA512 TLSH

Submit Download

CSC106CFC03A16941F787558E763BA1BD9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5tq2iwf5\CSC106CFC03A16941F787558E763BA1BD9.TMP
Size 652B
SHA256 64b4f54816e6049bca28557932759cbe72074882c35cd6eee3a5d3100551bb2d
MD5 e1e5e2afe07713bac48fff03bfd32510
SHA1 66f5eabdc52b214d429ab5cb4c073df443eba740
SHA512 2c6e771ff2c213871b3088867dafb72eae7d22141147f7e924ed14ea4b4f49c58521c9287ce3cfb37f53940fba42e580e23d6b4b3f689f25007ca09a6e4cc614
TLSH
T182F05E0AA3F8420EF0F35B30BEF65367D1A8BD64DE7293ED5481031D28646109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8BA3DB07D2C54E8E97E67336994EBFB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mtajzwia\CSC8BA3DB07D2C54E8E97E67336994EBFB.TMP
Size 652B
SHA256 f2ed3f3aacfede4399a15c1d26404982c02d6791d5615ea1ebc6cd812f86e617
MD5 36abcf2a2fc04b4dd026a53e55364949
SHA1 c8b0115dac3e1bcd749d6b1fb991280e4ca88a9f
SHA512 49e8fbcdd28278553db9a1edd578ef5c57d44b462f744f477a36dd0b19e2ab376de8effe0096624401141f041df30e08252e2910f3a390cecf84077e2b791961
TLSH
T115F05E09A3F8020EF0F34B30BEF6436391A8BC64DE3293ED6440032D28649108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mtajzwia.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mtajzwia\mtajzwia.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mtajzwia.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mtajzwia\mtajzwia.cmdline
Size 369B
SHA256 26cd034ab14ea883311de67ab8455c200e6a39f8e6cdef5c1b8247ee4457c921
MD5 516a7c6cff9b978fd65c6a56c0dcbaec
SHA1 5581daedb689394413ea6325938e91bf248dec01
SHA512 f0cd5b3ce218ac34562369c7392738f53db4bad2ba449dc9e9fd2b6f292eba036bd4e8006462f5f9fbf9a4b625d020ebf5ed1c1146ffb49923b79adf39504e37
TLSH
T1B3E0C66A42D6CB7D8AED200F22AAC4BCC3F207937B807FC49840840EE02F0096BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-42-0x00007FF7330A0000-0x00007FF7330E8000-memory.dmp

Download

memory/1076-49-0x00007FF7586C0000-0x00007FF758708000-memory.dmp

Download

memory/2064-37-0x00007FF7C6560000-0x00007FF7C65A8000-memory.dmp

Download

memory/2232-60-0x00007FF7960F0000-0x00007FF796138000-memory.dmp

Download

memory/3296-56-0x00007FF702510000-0x00007FF702558000-memory.dmp

Download

memory/3348-67-0x00007FF7B7190000-0x00007FF7B71D8000-memory.dmp

Download

memory/3452-70-0x00007FF684E50000-0x00007FF684E98000-memory.dmp

Download

memory/3480-4-0x0000016B36E50000-0x0000016B36E72000-memory.dmp

Download

memory/3480-39-0x0000016B516D0000-0x0000016B517D2000-memory.dmp

Download

memory/3480-0-0x0000016B36F00000-0x0000016B36F10000-memory.dmp

Download

memory/3480-1-0x0000016B36F00000-0x0000016B36F10000-memory.dmp

Download

memory/3480-22-0x0000016B36E40000-0x0000016B36E48000-memory.dmp

Download

memory/3480-35-0x0000016B36EE0000-0x0000016B36EE8000-memory.dmp

Download

memory/3480-40-0x0000016B36F00000-0x0000016B36F10000-memory.dmp

Download

memory/3480-38-0x0000016B36F00000-0x0000016B36F10000-memory.dmp

Download

memory/4120-46-0x00007FF7F6E90000-0x00007FF7F6ED8000-memory.dmp

Download

memory/4776-53-0x00007FF785090000-0x00007FF7850D8000-memory.dmp

Download

memory/4848-63-0x00007FF77D160000-0x00007FF77D1A8000-memory.dmp

Download