ef01f88dfe3cd2fc37afe7b7235153c968b021217fe57355aa79bcb82a9e8133

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-wvprcsxtdx
SHA256 ef01f88dfe3cd2fc37afe7b7235153c968b021217fe57355aa79bcb82a9e8133
MD5 962d9022469ead5c1d6b65798d8e374a
SHA1 287af366c7830c3f21acae49be9e377b0b61cca0
SHA512 3c4ae6b292ab344eeaaa67b8123f9560ecc393642f865b4c0082abc381f685dee38bed44ec03d687697591d5d64e4de6003b57ecc9272e7448d681d3728c8ffc
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5024	powershell.exe
7	5024	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5024	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	powershell.exe
5024	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4884	5024	powershell.exe	88
PID 4884 wrote to memory of 4312	4884	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eegu040o\eegu040o.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES594.tmp" "c:\Users\Admin\AppData\Local\Temp\eegu040o\CSC344827A4328443538EDF87A381C2B88.TMP"
    3⤵
    PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES594.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES594.tmp
Size 1KB
SHA256 1e234fa1285af39dc4f01da840803d143b01fb5f0f8a4d4cac7cac8cb822031f
MD5 f73e3faf8a5ca7347fa3d0df94a9622e
SHA1 5fff9dcb0cca38ce3433abf381c06d18e9935f2a
SHA512 9fe1bf9463d1e2dfb24ef0b71ee4404139b6c5962ca13701b9d8af6f97fd819a10ee0ae64a3d75e560b7f6ccfecaf8235807d39a77d63925d0849795651e3b33
TLSH
T18A21A30583E88B0FF077073179FA132FA238FD99EF62939E850052282850104EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xpj5p11d.lyl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpj5p11d.lyl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eegu040o.dll

Path C:\Users\Admin\AppData\Local\Temp\eegu040o\eegu040o.dll
Size 3KB
SHA256 f3ca3fedc9a0de96b4a8265f5fde1e56b0cb60a815bd215f4d2f6b5fadf56d84
MD5 35b6b4d7f98262956ff918883653ea50
SHA1 a17322b8abed0d65fe4af7dca564f3bb78c1c9dd
SHA512 2408d3f26e3df859af308d95d78e97ab79385c3be1a8abb2eb7f1df2cacb378376912f038d9af68d026d363d672f25eba170c7d97efbceb21ee5b6fdd59c2978
TLSH
T10451DD1A97E8462BE47707316EF3836737B4F8118B73535E1980031CAC643645D36BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC344827A4328443538EDF87A381C2B88.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\eegu040o\CSC344827A4328443538EDF87A381C2B88.TMP
Size 652B
SHA256 ef867f463fe033cac951f9e1a05738d9988d395a39a5d112c3dc2af62e74a047
MD5 93c630846ca3c64c31953b6ee5d7090f
SHA1 17b25b6ece6e4ef523fac60ae8adcb458fa684d6
SHA512 203da0f1c0cdb3d7ec696945ccad2fb430da8667f9df5693e898800a220fb500c81c1e8ec26e653dc5b891b71c92acf4b39ad2444fd76ef25e8241ae7e1f71c6
TLSH
T101F05E09A3F8020EF0F35B30BEF6436395B9BC65DE3293ED1444131928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

eegu040o.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\eegu040o\eegu040o.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

eegu040o.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\eegu040o\eegu040o.cmdline
Size 369B
SHA256 d5060d27bcd432daeae44112f335f9ae1d73ed2ec0433882ce5df511ac79e14e
MD5 3c08c914b5c52923d183900e9369a3a8
SHA1 5d3210f9cbb606e54ff9f921618d0053673529c4
SHA512 3f80375ae9a02170f0963dc69eb8b1d6b709ed3beb98e11933382f95e58d0f723c507ab95ab994434654f21854fc1bf81ff4e8fd3cd4081e95a3c2847617d142
TLSH
T10DE0C03B434ECE7D21DD110739EAC5ACC2F2074329503F847240465DD01700237D1F82
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5024-1-0x00000216EA1F0000-0x00000216EA200000-memory.dmp

Download

memory/5024-0-0x00000216EA1F0000-0x00000216EA200000-memory.dmp

Download

memory/5024-7-0x00000216EC9F0000-0x00000216ECA12000-memory.dmp

Download

memory/5024-10-0x00000216ED280000-0x00000216ED442000-memory.dmp

Download

memory/5024-23-0x00000216EA490000-0x00000216EA498000-memory.dmp

Download

memory/5024-24-0x00000216EA1F0000-0x00000216EA200000-memory.dmp

Download