8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
Size 12KB
Sample261005-psv22agh35
SHA256 8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef
MD5 58360eb1e4a6564a371004455f5fb6cd
SHA1 f7b40e83c240d6abdb05c281e1739cb2c6348afc
SHA512 8f166861ea2dd485b54623840ecbc004d6ae2c20cb73b05e53e5965bac1ede54fe58672bb64118ee4731a00258d8cf805d0d6f36706624efe03647fce53cc508
SSDEEP 192:wpHsyZ3dPpvGd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJt2:wpHpZtPpGd1JNsvYlGwAXJk
TLSH
T12E4271E56725922A8872611DCECEA04DF60355331EBB1B15BEBC87312F3A064F27A74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3320	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2056	svchost.exe
4604	svchost.exe
4196	svchost.exe
4988	svchost.exe
4764	svchost.exe
3308	svchost.exe
1812	svchost.exe
1696	svchost.exe
1796	svchost.exe
1876	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3320 set thread context of 2056	3320	powershell.exe	93
PID 3320 set thread context of 4604	3320	powershell.exe	103
PID 3320 set thread context of 4196	3320	powershell.exe	105
PID 3320 set thread context of 4988	3320	powershell.exe	114
PID 3320 set thread context of 4764	3320	powershell.exe	115
PID 3320 set thread context of 3308	3320	powershell.exe	116
PID 3320 set thread context of 1812	3320	powershell.exe	119
PID 3320 set thread context of 1696	3320	powershell.exe	120
PID 3320 set thread context of 1796	3320	powershell.exe	122
PID 3320 set thread context of 1876	3320	powershell.exe	123

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3320	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4124	3320	powershell.exe	86
PID 4124 wrote to memory of 2516	4124	csc.exe	87
PID 3320 wrote to memory of 1596	3320	powershell.exe	91
PID 1596 wrote to memory of 5108	1596	csc.exe	92
PID 3320 wrote to memory of 2056	3320	powershell.exe	93
PID 3320 wrote to memory of 4604	3320	powershell.exe	103
PID 3320 wrote to memory of 4196	3320	powershell.exe	105
PID 3320 wrote to memory of 4988	3320	powershell.exe	114
PID 3320 wrote to memory of 4764	3320	powershell.exe	115
PID 3320 wrote to memory of 3308	3320	powershell.exe	116
PID 3320 wrote to memory of 1812	3320	powershell.exe	119
PID 3320 wrote to memory of 1696	3320	powershell.exe	120
PID 3320 wrote to memory of 1796	3320	powershell.exe	122
PID 3320 wrote to memory of 1876	3320	powershell.exe	123

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n5fud0aa\n5fud0aa.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES947B.tmp" "c:\Users\Admin\AppData\Local\Temp\n5fud0aa\CSCD3E9CAE0115A4E138C1EBC4C2E304F6F.TMP"
    3⤵
    PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m1i30mui\m1i30mui.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A09.tmp" "c:\Users\Admin\AppData\Local\Temp\m1i30mui\CSCB69F30128777482AAE15703FE81E4BD5.TMP"
    3⤵
    PID:5108
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES947B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES947B.tmp
Size 1KB
SHA256 ded108629d392f57b0ac1c07195f4078f28ac81e4a8682cc840737b69db130b7
MD5 1b53c556de40b32c83c0d20fe5a9df85
SHA1 dfd6823851f2bf46348f491acab6b5eb8c02f4c1
SHA512 9de28f45a0e06a52c4b4dd65a72c72c511e9ec830099f07080bd4605523f878c64ed8c24f9fe6631f04e3a357a5f15af6f4060231acfbd5b370b93c950e60772
TLSH
T18F21AB0457E98B0EF077473179FA172FA238FD95EFA5935B8540422C2C41604EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES9A09.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9A09.tmp
Size 1KB
SHA256 fa0825fc77f60250b879a986e039d7fb61de1bd37c68bf76aa37f0147e46d178
MD5 22e1ef7ed1bbed63c32787e322f3ac19
SHA1 4b7c4152874c7c1e8e4b9a6a7ba31dcddcc7c707
SHA512 741d1f4d85e816c2e986282e06a90563d61afe638c764140e3d8e7bf03eb970cadfd6ca6e3303d517aa5deeea25a86b84e1e21851c7153c726ae2e50555e24b1
TLSH
T17421EB0583ED4B1EF0B71731A9F6172F9674FD69EF62A75BC90042281C81644EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jm0iipiv.fv3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jm0iipiv.fv3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

m1i30mui.dll

Path C:\Users\Admin\AppData\Local\Temp\m1i30mui\m1i30mui.dll
Size 7KB
SHA256 3bfb0f944b155e85cf2fb41ba831e5225d9e7ee3255eb405d9793831498c8712
MD5 9429ee70dfa76be2f2d3480399ddfdb5
SHA1 82c0bf4713ed693b8519c8d182fe69e9c3e67924
SHA512 75ecf4cb6748d56b74ddd9940c759dfd54766c302a260d8fa3c07204e8abea48513c06e84512473e8c14f651578e37da76e2698d3916fc897a53bc96e2626a90
SSDEEP 96:yguYgZxIVIkaxN3rISmCUJYCaMNdlXlLaQJxKS:yguYgEda/3y+CrvraZ
TLSH
T163F1F95ECBCC8275E9AE0B39A4F306056BB484458F338A5B09EC91473E67B991B633D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n5fud0aa.dll

Path C:\Users\Admin\AppData\Local\Temp\n5fud0aa\n5fud0aa.dll
Size 3KB
SHA256 094c1bdd289418fcec2038c0a9dca34319846337a87b097becd827c83116fe68
MD5 3be4527851a04861b02e7e32676159cc
SHA1 e7a786efe4a01413a66ec901ccb9fbbfaffa7c51
SHA512 ffac28251d730f240b827ca5cfb564f66297c81292d1794d4a1ccd3cf39d503437f8c970648b37c9fa846d5048b1a3420097ef314b4189a77bb1639192f2c905
TLSH
T15A51CB1A57E8862BE4770B34AEF3472637B8FC109B73535E08904218BC647645A31BF1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB69F30128777482AAE15703FE81E4BD5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m1i30mui\CSCB69F30128777482AAE15703FE81E4BD5.TMP
Size 652B
SHA256 0e6b7dc635607a8ac7494ef1cd44ab0bba4842d0b175eb4ebb5e02ba9a10fcdf
MD5 c5456f553979baf31e4a9f49a1b50e9c
SHA1 f72588d73d7e8b102d3fc4bb35a0f9bedd3a6ddd
SHA512 f5da7ad7a2f966e027785f4b0fa57e94c8f5153187011523b3d16aaccf3675ff3206bfa9ad450665838802631e91d42feec14c88fab5baf0704743a39b7ab7ec
TLSH
T101F0820A63FC020EF4F34B30BDF6836795A9BC65DE3297ED5840131D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m1i30mui.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m1i30mui\m1i30mui.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m1i30mui.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m1i30mui\m1i30mui.cmdline
Size 369B
SHA256 c580a8897a57bc7ebf63754312e18c013cc1ba42d918e67c9406498350b1b6d3
MD5 2d665db684a2b0cbef647b81a85872ca
SHA1 90995e28c3783ead16b38937d5089e2768578342
SHA512 bd763ca883a08b5315dcdaa7ead05180a1a3b7b9022895e8c047a75c2076ed427c7bee38ae6ce7a74c93c35f6b378936a1d1ec801d9c5a16b8abbefe9baed411
TLSH
T1A6E0C03A5246C27D11ED140B61A9C5ACC2F20F43E9C8BFC45040440DF81BC4237F1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD3E9CAE0115A4E138C1EBC4C2E304F6F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\n5fud0aa\CSCD3E9CAE0115A4E138C1EBC4C2E304F6F.TMP
Size 652B
SHA256 a800e140a54e7fc7d95ec6c7f8741109698bd0a33fd4207ad0e9f6c0a6147897
MD5 2776289b260ab8e14d16826f39eae3f4
SHA1 3a0d81993db88526fc9c3cd35b649ec6a194e1c3
SHA512 d5f8a1df1c2dc02bdb91e42ec649851c7744fac89183083e849c347f56e7e4f99d155fc3d4ba22eeef522bf5e6f5869d1554ce94f93e4515a5c418a91d069101
TLSH
T10DF05E0963F8520EF0F34F30BDF64367A1A9BC65DE3293ED144003192C646208A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

n5fud0aa.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\n5fud0aa\n5fud0aa.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

n5fud0aa.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\n5fud0aa\n5fud0aa.cmdline
Size 369B
SHA256 5f26aaf8f0895645f316e1ca127e005da107b5173a9e59379c8a021214f45209
MD5 e4f0f0944267bffbef65813b01b0413a
SHA1 375e19a16ab31c6ad39039efdc52fdabedcb198f
SHA512 4516368c7e24f48f025c3a0fb603e4dbc97c8260c87b373a5abcf8f98953f133a916dfc81d14d75a7737b7de21d64c1e43b8052e3eab4dd7f0d6df7a08ea29ee
TLSH
T15DE0DF2A5297D6BE16ED200B326BD9BC82B20A8729C17F84D160849EE5278086BD2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1696-53-0x00007FF604A40000-0x00007FF604A88000-memory.dmp

Download

memory/1796-55-0x00007FF691B30000-0x00007FF691B78000-memory.dmp

Download

memory/1812-51-0x00007FF792FD0000-0x00007FF793018000-memory.dmp

Download

memory/1876-57-0x00007FF6492A0000-0x00007FF6492E8000-memory.dmp

Download

memory/2056-37-0x00007FF6213F0000-0x00007FF621438000-memory.dmp

Download

memory/3308-49-0x00007FF7D2730000-0x00007FF7D2778000-memory.dmp

Download

memory/3320-35-0x0000024E73660000-0x0000024E73668000-memory.dmp

Download

memory/3320-39-0x0000024E71250000-0x0000024E71260000-memory.dmp

Download

memory/3320-38-0x0000024E71250000-0x0000024E71260000-memory.dmp

Download

memory/3320-1-0x0000024E71250000-0x0000024E71260000-memory.dmp

Download

memory/3320-22-0x0000024E73610000-0x0000024E73618000-memory.dmp

Download

memory/3320-7-0x0000024E739A0000-0x0000024E739C2000-memory.dmp

Download

memory/3320-0-0x0000024E71250000-0x0000024E71260000-memory.dmp

Download

memory/4196-43-0x00007FF7106C0000-0x00007FF710708000-memory.dmp

Download

memory/4604-41-0x00007FF617D30000-0x00007FF617D78000-memory.dmp

Download

memory/4764-47-0x00007FF60AF40000-0x00007FF60AF88000-memory.dmp

Download

memory/4988-45-0x00007FF6FE690000-0x00007FF6FE6D8000-memory.dmp

Download