7dada31505b2775029885e25aa55d0cb2db6e08acd8e1ac8ecb1b6d431164b9b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-wvs4savaqa
SHA256 7dada31505b2775029885e25aa55d0cb2db6e08acd8e1ac8ecb1b6d431164b9b
MD5 a59129ce2e0da49171f84962539b8a82
SHA1 2fa644ec47523fe6ad844a4616bf4cb035f91a50
SHA512 26caa0a3b562d125e83270d5bb53b9a64e490fffa24382c60f566cda32b3b2faff057b03ed07cf26b2a5f4586201bf0b98f5170b2580ddf7d351bbabc43cb075
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4880	powershell.exe
7	4880	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4880	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	powershell.exe
4880	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2616	4880	powershell.exe	91
PID 2616 wrote to memory of 2800	2616	csc.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ghjfybr\3ghjfybr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA350.tmp" "c:\Users\Admin\AppData\Local\Temp\3ghjfybr\CSC954075AB9353431A80D1E25C4D1B501B.TMP"
    3⤵
    PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ghjfybr.dll

Path C:\Users\Admin\AppData\Local\Temp\3ghjfybr\3ghjfybr.dll
Size 3KB
SHA256 a19b57e21493c8d8878a001976f5f08044c9656fe680f3a3ca21c7f14b6795e3
MD5 fc2c53e7250ddc3ff601941f57bb55c6
SHA1 761150b5ebe88639267345f7d2a3fe3f48059b45
SHA512 e8ae324b6907ce39e4d053c4bc693dae82dbfc66958ca74aa1fa651e1b45e068f52d64d0462434fd6209c26b877e13a78b3921251172a62b63a496906d4c55cf
TLSH
T16A51DE1A97E8466BF4730731AEF3436637B4F810AFB3571E19800259BC643A45E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESA350.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA350.tmp
Size 1KB
SHA256 4d1ddc83ed99b0caf8521691b1485e79349532b8c0557e1c4d2672a97d6f0fce
MD5 41fc9d7eeb0bc2a8aefb4ed1860f37dd
SHA1 f6c6f1dd53d43b2b5a6bf047938eabe8fd2a8987
SHA512 2a52eaf8f3b2bd7974f6e454005df30a47c4c34868981612b50a051b7438da022a9ccd86892d928361b61be0889a6d0a1456adc1ec669ca52ac372ce32fdc19d
TLSH
T11A21894183E94B1EF073573169FA076BA268FD68EFA2575B8540422C2C51104EEA1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3pc0fkzv.xmc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3pc0fkzv.xmc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3ghjfybr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3ghjfybr\3ghjfybr.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

3ghjfybr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3ghjfybr\3ghjfybr.cmdline
Size 369B
SHA256 51d901009d27e2ac4f880bdb0135a1c7e01764dfebde5e146aa43b8cd0dd989e
MD5 fb87c8cf44290be5f48241fb46eb730c
SHA1 0acbf090feb5438ef8f47fe989951ed7c3819539
SHA512 966ceef411da99b3ce9238afca89e759badf6f55b490e9e20863a159974ebb6e2d78335a3fe4251faf73e03e820dae27f6d32ca1cbb392efd96dd720a127f5d6
TLSH
T12DE0D82A5297C67DD6D9110721A9CDACC2F216472EC17F84D152485FE0170046BE1B56
MD5 SHA1 SHA512 TLSH

Submit Download

CSC954075AB9353431A80D1E25C4D1B501B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3ghjfybr\CSC954075AB9353431A80D1E25C4D1B501B.TMP
Size 652B
SHA256 a947b590d570b56f2f0afa6822df375d1a45e0847b67eda26fe59cd0c07dee09
MD5 de4a345d089eb5615d4a11786b684f20
SHA1 0730197385eb8b08fb484e376d3ec1888feaec76
SHA512 642db1ca7a86a9d56db1fb31db7484d917ad5d6429e2a3683775e0633bb9277d8c029dbee81df3d0ff1bed0f35a294fc0dc0de7c404cf3c29b3505e3211e1c96
TLSH
T150F05E0963F8020EF4F34B70BDF643A391A8BC65EE7293ED144003192864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4880-10-0x000001CC3D840000-0x000001CC3DA02000-memory.dmp

Download

memory/4880-0-0x000001CC3D0C0000-0x000001CC3D0D0000-memory.dmp

Download

memory/4880-9-0x000001CC3D240000-0x000001CC3D262000-memory.dmp

Download

memory/4880-1-0x000001CC3D0C0000-0x000001CC3D0D0000-memory.dmp

Download

memory/4880-23-0x000001CC3D0B0000-0x000001CC3D0B8000-memory.dmp

Download

memory/4880-25-0x000001CC3D0C0000-0x000001CC3D0D0000-memory.dmp

Download

memory/4880-24-0x000001CC3D0C0000-0x000001CC3D0D0000-memory.dmp

Download