823acce6aef0e4b6e7f0ae85c2193daaff728d3de245a9a1dfe200acd22f86fe

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-wvvydaxtft
SHA256 823acce6aef0e4b6e7f0ae85c2193daaff728d3de245a9a1dfe200acd22f86fe
MD5 969f2419fd657eac64b0472c9909fbce
SHA1 6386f87d19f29ebbd740cb8a75e049adffeeb783
SHA512 24e9096b236c134cecf36dc7c4ebe79a0d1ef6f2c2399fd63dde71ea491bd11fed1fc3b64a3738c16e606a5772932c22928fff7e88426d82b9d1399a6cf74ed3
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5428	powershell.exe
6	5428	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5428	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5428	powershell.exe
5428	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 1724	5428	powershell.exe	88
PID 1724 wrote to memory of 1968	1724	csc.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3z2zoav2\3z2zoav2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D45.tmp" "c:\Users\Admin\AppData\Local\Temp\3z2zoav2\CSC9C497840CAAB45C98A562BE381EABDE3.TMP"
    3⤵
    PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3z2zoav2.dll

Path C:\Users\Admin\AppData\Local\Temp\3z2zoav2\3z2zoav2.dll
Size 3KB
SHA256 1bdf5c01780d327c5da48796b5fbce5fcae1eea2e8ddf9a7ae93b664e451bb5d
MD5 5a0e315b522ac2e9d504a63bf5a9a0f7
SHA1 575e99452cb38f30b8542ed4c8fa5dba0accc864
SHA512 972ba0ec9a17cbfb510319ab50795cc9d65dbc4e212d6fee6cbcc9584044c45ae463acc493b5b4d45b6d8eee4f48cab7456964845e9f3293a6e0a3b3301d0262
TLSH
T11251BB1BA7E8466BE4734731AEF3436637B4F8509F73535A1980025DAC643646E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES9D45.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9D45.tmp
Size 1KB
SHA256 5ed3073c5437b7b839923eaace337315d4cb9655ba503d8f23380a67b439037a
MD5 0ab450065db64356d58c2b671e911593
SHA1 ecf5435e17de861321543d4696b22cc14172229f
SHA512 941a53ea759ef5a375a90cec2f502b6ad5eabeee123e1ddf093c4c30f70c04e5152145ec6afbc572c9374c21591dfceef0b1581e0edb6f65aa737dba47deb181
TLSH
T14B21894583E94B1EF073873179F6072BA274FDA9EFA2A79B8540522C2851504EEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ldrktcxa.bag.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldrktcxa.bag.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3z2zoav2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3z2zoav2\3z2zoav2.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

3z2zoav2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3z2zoav2\3z2zoav2.cmdline
Size 369B
SHA256 8ad8bcff99ed7bc2b039ef8f32da1cad20f954056c41805af8329193635a4ade
MD5 991507b2ed2eb37256e6bf6616d15662
SHA1 b976c0e88297fb85cee46053dce3d423e9fca1a2
SHA512 53d30181e100380ff7e4196acf4e857769455e83c59c50b2c74cf57071f53f110bf705a364bc8567d381791bec4b76a6c37e14468db92816fb4c06a76f8e9eae
TLSH
T14AE0C0AB438BCBBD0BED30072169CCACC2B307476D423F847440440DD02701A27F2745
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9C497840CAAB45C98A562BE381EABDE3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3z2zoav2\CSC9C497840CAAB45C98A562BE381EABDE3.TMP
Size 652B
SHA256 88867aa1352433e74d6b5e0b596e06f56462ce39309533c9d6797204618cc9bd
MD5 f5a5c75a09b52562669f340df0d0fae5
SHA1 10b75ab72a14c17ea404fc5c13dc359045ae577b
SHA512 8b1d2db8b87065267fae7ef374f69e132d294246bcaadcd52b5a6840ab582dd9ec710ee0f3d1ac805d0873697f2db89566732f50c6b4145daddec8472cc49bfc
TLSH
T1F0F0544963F8020EF0F38B30BDF543639178BCA5DE3253ED1480531D5864510E961F72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5428-1-0x000002504BC90000-0x000002504BCA0000-memory.dmp

Download

memory/5428-10-0x000002504E460000-0x000002504E622000-memory.dmp

Download

memory/5428-9-0x00000250336E0000-0x0000025033702000-memory.dmp

Download

memory/5428-0-0x000002504BC90000-0x000002504BCA0000-memory.dmp

Download

memory/5428-23-0x00000250335A0000-0x00000250335A8000-memory.dmp

Download

memory/5428-24-0x000002504BC90000-0x000002504BCA0000-memory.dmp

Download

memory/5428-25-0x000002504BC90000-0x000002504BCA0000-memory.dmp

Download