d671f434bb06a8dd102b996173d1f95fe4c3fac4ebe437ba5c771d97540368e2

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-wvpflaxtdw
SHA256 d671f434bb06a8dd102b996173d1f95fe4c3fac4ebe437ba5c771d97540368e2
MD5 7418e9707969ed4edb3e9da2a89f1009
SHA1 b75a63d6674c16a56e4afbe9d88a1f3ec92d3f51
SHA512 4a4cbbf587bd1709c27ccee675adb383bd525f92f5bc56184bd55ea72ebe380860d587d7d0aa863b7c296f44a4c80ebe1056164a08b1418cf04c6ae0ff8bd84a
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4768	powershell.exe
7	4768	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4768	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	powershell.exe
4768	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4128	4768	powershell.exe	90
PID 4128 wrote to memory of 4952	4128	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1f4fkx30\1f4fkx30.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC138.tmp" "c:\Users\Admin\AppData\Local\Temp\1f4fkx30\CSCE80EB470CE5D44CAB412B1455C13208F.TMP"
    3⤵
    PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f4fkx30.dll

Path C:\Users\Admin\AppData\Local\Temp\1f4fkx30\1f4fkx30.dll
Size 3KB
SHA256 ead62db72c0313423753c8d982b218eedd0d886bbfdd0630e5023eeda74a2aba
MD5 53affbaaecad66158b4cd4ce46bdc00c
SHA1 7d97b18b93db1f3f60fac6a9dab74d2eadb5d3a3
SHA512 a01b219211a765d6281c2c04d2c9cc52cecb4787bbd05f4a2f569af9f17b44e480e85dddc5a1d6e66d8152457c4044466e51412a2c9a9649b6b2a0dc8802bece
TLSH
T12451EC1A97E84A6BE4770731AEF3836737B4F8218B73931A59800219AC603A45E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESC138.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC138.tmp
Size 1KB
SHA256 4db5cce991874b5da99c14b79255f8d6fd3c6acf399fbb706441d108ad01f0ed
MD5 07d5e8149e82d139fd1af45611426ee1
SHA1 851c5e6ab60f6e762254cfc30d7c016c6da136e2
SHA512 f5979ae515e16250bd10cc7906e65ffe4bf1fcc4075b66ac8e75014e8abebb2ef9e5644df9bc586b18a4ba7974050a7a8029c79dbe471d5aacb20a49de1a71e2
TLSH
T16721EB0183E84B0FF0775B3169FA136BA238FC65EF62975B944042282C92244EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i1nhya1x.sar.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1nhya1x.sar.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1f4fkx30.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1f4fkx30\1f4fkx30.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

1f4fkx30.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1f4fkx30\1f4fkx30.cmdline
Size 369B
SHA256 037936db32245c03e3a959c0812e10aed7ccbfeded518ce32df0fb926e6866f0
MD5 5834a60dfeb86b92d56ba6262ebe4118
SHA1 042b82260c3c817b56bfa5b653347bfbcb92f9d8
SHA512 6e715286b568a59611ee55d3453c669aade8d2ed8f35dcf574b28c79a45513f5cc214e595676e58a5a157cc9bcf0a7ac2e8e4ce1be4a7b8b2b5f01ba677f2c74
TLSH
T1DFE0683B8346CBBD01ED244721B9E4ACC3B60A4369407F84D050448ED037024E7E2B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE80EB470CE5D44CAB412B1455C13208F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1f4fkx30\CSCE80EB470CE5D44CAB412B1455C13208F.TMP
Size 652B
SHA256 a12a735a5c28c373b12bc1ffbca82ee1ae869e36baab56816a79efbb88243388
MD5 14eea42b1bf5675a11f019bf9583787b
SHA1 1c10332a647deabfc7949d455c6ad30b884cb858
SHA512 499069caf07c37b4f3263a2dbefe862758c6d712ff713bd79794ec66c26ccbe76f29a974e3bfdbbf6c0b8def6f0457770415de72a4f272de87417623fd17a3b3
TLSH
T197F0820963F8020EF0F74B30BEF643A391A8BC65DE3293ED6440431D2C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4768-1-0x0000029630080000-0x0000029630090000-memory.dmp

Download

memory/4768-10-0x0000029632C20000-0x0000029632DE2000-memory.dmp

Download

memory/4768-7-0x000002962FF90000-0x000002962FFB2000-memory.dmp

Download

memory/4768-0-0x0000029630080000-0x0000029630090000-memory.dmp

Download

memory/4768-23-0x000002962FFC0000-0x000002962FFC8000-memory.dmp

Download

memory/4768-25-0x0000029630080000-0x0000029630090000-memory.dmp

Download

memory/4768-24-0x0000029630080000-0x0000029630090000-memory.dmp

Download