0c3f107985b4f908e2a76e0c80a556ba7d46d3d0cb7bcd5374f437feaad94f22

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-wvvmlsxtfs
SHA256 0c3f107985b4f908e2a76e0c80a556ba7d46d3d0cb7bcd5374f437feaad94f22
MD5 2fdd3ce825e0fb357e293aa2b0bab510
SHA1 00d21abeb55c0adc9b691abd99f813ca9e740aa8
SHA512 922080a711e6f95efa6a587f462ffd073003188e83833866cd0a1b644284f8959d39d5f8cfcfed22425d3edf53367268920ccbc534569f689bcbf1eece6d48d7
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1756	powershell.exe
7	1756	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1756	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1756	powershell.exe
1756	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4528	1756	powershell.exe	91
PID 4528 wrote to memory of 2376	4528	csc.exe	92

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aayu5pvg\aayu5pvg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC5BC.tmp" "c:\Users\Admin\AppData\Local\Temp\aayu5pvg\CSC7B2505789DCB435D90C5AEC92F658B64.TMP"
    3⤵
    PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC5BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC5BC.tmp
Size 1KB
SHA256 755dcf6278e5452950576f2e5231cd9936c56c6d69dd94c34c7d5def7f6f619d
MD5 26c931e2b326293b8c28a2b5f1328769
SHA1 616974c305f9ae2fd4e8ab393c4509f0ccb673f7
SHA512 8e0d19e76b13e3a4db80963e02c96677737ae66f590bea5400fca3e2e66a5082f5445d51f0d58e07fe09915785c7e29720245a37aeb32323ab996426042f195a
TLSH
T13821AB0587E84B1FF073473279FA572FA22AFD95EFA2975B854052282C50504EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b5dp5hin.hj4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5dp5hin.hj4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aayu5pvg.dll

Path C:\Users\Admin\AppData\Local\Temp\aayu5pvg\aayu5pvg.dll
Size 3KB
SHA256 5fccd808dbf3b3a1a95a5d358650c75e9daed5876773db3c3102626fa0351e9e
MD5 e8574f54fd03b82f636a6a599b5556db
SHA1 274f69846951a3f2965909f3c2e739bec5aeee48
SHA512 a3d94612859085e6b6f1b1dedf4bc73729c817112e6828ee8c2687117487ebdd4049d1cb688763e47730fc4a93dda2ec1c9c8c43a4428d9a47d121a747ce563b
TLSH
T14951EC1BA7E8462BF4770B31AEF3436637B8F8119F73531E19804258AC603A46E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7B2505789DCB435D90C5AEC92F658B64.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aayu5pvg\CSC7B2505789DCB435D90C5AEC92F658B64.TMP
Size 652B
SHA256 971fcc3fbe64c5263062f367f2e8e1e1837b84d9bf9c8095e0f96f5f92343d0e
MD5 450082421be3c017d48bc67aa362ff79
SHA1 35e9c001fdda172bb7d136e4fa913fef00d138e7
SHA512 7412a28cca5359bc5d114a1e864d43cdd4135d357439fa5eb5db756150b5759290fa4a6469723ff3132392943b706d7d6842873eec04f7ea2c345aa7d82ce0d6
TLSH
T164F05E4A63F8120EF1F34B31BDF643A791A9BC66DE3293ED1440531968645209A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aayu5pvg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aayu5pvg\aayu5pvg.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

aayu5pvg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aayu5pvg\aayu5pvg.cmdline
Size 369B
SHA256 a51a2588d92565b5ee7f68573b267603635da0feb00886cff3d52de728e77b52
MD5 f614832cf505688fdbb69f2350dba64d
SHA1 f3a5a9ebe43cd23934e4ea6940c4cb8b6fa68529
SHA512 2c712ec7ab75d535d2233a6372cf662f2cda85c2d29320acda7617dc4e140b6d51866986013cbf3cfa6da14fc21a3db70918e8cbdd95d889f86eb913c26f3dd9
TLSH
T1E5E0682B4246C67D01EA1C07316DCCACA27A0A4339807F88584CC51DD0370012FE1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1756-1-0x00000296D52A0000-0x00000296D52B0000-memory.dmp

Download

memory/1756-10-0x00000296F08B0000-0x00000296F0A72000-memory.dmp

Download

memory/1756-9-0x00000296EFA00000-0x00000296EFA22000-memory.dmp

Download

memory/1756-0-0x00000296D52A0000-0x00000296D52B0000-memory.dmp

Download

memory/1756-23-0x00000296D52D0000-0x00000296D52D8000-memory.dmp

Download

memory/1756-24-0x00000296D52A0000-0x00000296D52B0000-memory.dmp

Download

memory/1756-25-0x00000296D52A0000-0x00000296D52B0000-memory.dmp

Download