77773e69cbcec1e3c889f90479e310e25a5ab2c331fd696f4d764cfb6730f33b

Analysis

user interaction
yes
max time kernel
59s
max time network
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.ps1
Size 7KB
Sample261011-tzdtjsdc73
SHA256 77773e69cbcec1e3c889f90479e310e25a5ab2c331fd696f4d764cfb6730f33b
MD5 a8f286afbc2837cc7fdc1e45a7ec749e
SHA1 44690bf58c13ae3cf642c133b015dbeb5c48762b
SHA512 cbe89e3eaef7d0f08b773880e5529dc45dc5de01bf0e78c754e90733e1e7e67e021d44a71711e95ffb709147267c1561c566b3ca4649a9382d5d0a675149e171
SSDEEP 96:vlU82jm/lQ17EQCPlBZwwTyaTmOf82GzYD9PQ5953oFNJn19t502w65zhyCryKgv:vC82j1K3GweaxGzYDCz3op19v0wz8
TLSH
T1F7F1B258AE11952451F2C3BBAE524508FFA5007F62465A46746C83C8AFF074FCB8DDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4560	PowerShell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4560	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	PowerShell.exe
4560	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4560	PowerShell.exe
Token: SeSecurityPrivilege	4560	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4560	PowerShell.exe
Token: SeLoadDriverPrivilege	4560	PowerShell.exe
Token: SeSystemProfilePrivilege	4560	PowerShell.exe
Token: SeSystemtimePrivilege	4560	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4560	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4560	PowerShell.exe
Token: SeCreatePagefilePrivilege	4560	PowerShell.exe
Token: SeBackupPrivilege	4560	PowerShell.exe
Token: SeRestorePrivilege	4560	PowerShell.exe
Token: SeShutdownPrivilege	4560	PowerShell.exe
Token: SeDebugPrivilege	4560	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4560	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4560	PowerShell.exe
Token: SeUndockPrivilege	4560	PowerShell.exe
Token: SeManageVolumePrivilege	4560	PowerShell.exe
Token: 33	4560	PowerShell.exe
Token: 34	4560	PowerShell.exe
Token: 35	4560	PowerShell.exe
Token: 36	4560	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4560	PowerShell.exe
Token: SeSecurityPrivilege	4560	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4560	PowerShell.exe
Token: SeLoadDriverPrivilege	4560	PowerShell.exe
Token: SeSystemProfilePrivilege	4560	PowerShell.exe
Token: SeSystemtimePrivilege	4560	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4560	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4560	PowerShell.exe
Token: SeCreatePagefilePrivilege	4560	PowerShell.exe
Token: SeBackupPrivilege	4560	PowerShell.exe
Token: SeRestorePrivilege	4560	PowerShell.exe
Token: SeShutdownPrivilege	4560	PowerShell.exe
Token: SeDebugPrivilege	4560	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4560	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4560	PowerShell.exe
Token: SeUndockPrivilege	4560	PowerShell.exe
Token: SeManageVolumePrivilege	4560	PowerShell.exe
Token: 33	4560	PowerShell.exe
Token: 34	4560	PowerShell.exe
Token: 35	4560	PowerShell.exe
Token: 36	4560	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4560	PowerShell.exe
Token: SeSecurityPrivilege	4560	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4560	PowerShell.exe
Token: SeLoadDriverPrivilege	4560	PowerShell.exe
Token: SeSystemProfilePrivilege	4560	PowerShell.exe
Token: SeSystemtimePrivilege	4560	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4560	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4560	PowerShell.exe
Token: SeCreatePagefilePrivilege	4560	PowerShell.exe
Token: SeBackupPrivilege	4560	PowerShell.exe
Token: SeRestorePrivilege	4560	PowerShell.exe
Token: SeShutdownPrivilege	4560	PowerShell.exe
Token: SeDebugPrivilege	4560	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4560	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4560	PowerShell.exe
Token: SeUndockPrivilege	4560	PowerShell.exe
Token: SeManageVolumePrivilege	4560	PowerShell.exe
Token: 33	4560	PowerShell.exe
Token: 34	4560	PowerShell.exe
Token: 35	4560	PowerShell.exe
Token: 36	4560	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 2696	4560	PowerShell.exe	91
PID 2696 wrote to memory of 2508	2696	Dism.exe	92
PID 4560 wrote to memory of 5600	4560	PowerShell.exe	94
PID 5600 wrote to memory of 4436	5600	Dism.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps1
1⤵
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Cleanup-Image /StartComponentCleanup
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {4DF4412A-517C-45CE-AAB5-DDAB53C6F3A3}
    3⤵
    - Drops file in Windows directory
    PID:2508
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Cleanup-Image /StartComponentCleanup
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {EBD3B678-C632-4868-A053-9A1EBE2777F2}
    3⤵
    - Drops file in Windows directory
    PID:4436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ehkjnziv.b1e.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ehkjnziv.b1e.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 285KB
SHA256 8a2b4c9bfd95ef682332fa2e87424dd3bccf7fc42054a9908960b78616e91062
MD5 3d65e396aefa346ac5e9eeaab218a789
SHA1 e27ab007d7b6cee40044513d1b360a52c2c2e047
SHA512 2f00880646f35fe1a1c306f1762d24417158a65367a919f1200891e2a24298292c7806f776db3e08270d69c5d9b1f565e289b20a587651aba7ade3c38cd78352
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbkc0:2eCqtI
TLSH
T19454CF1E67EB0D31A189844372719BFE229735A3B6C8F714BA3FD12AE7C198D4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 291KB
SHA256 d25dd1755fd5354a15143fa59f5bedf3da552072e2318fde01c995ac0c8f7b5f
MD5 477deb1678f70fcc0c1cda7bac2f9a82
SHA1 ee3b97d0f30d92ccfa7bf4bd9bcd2d1f415b59d6
SHA512 825e22b0d114fa68db9d7dc041479c53ad9ad46b22ddfe8cbff6e6c09e1885e776ed7a6105f08338254bb1b623e233ab113bf06cc842a4b243549661737a2b2e
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbkcx:2eCqtd
TLSH
T12954DF1E67EB0D31A189844372719BFD229735A3B6C8F714BA3FD12AE7C298D4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 295KB
SHA256 228a75208617a816c2ba1cbffb44609930ce392c15b869747d23530ed5f87de3
MD5 6ac1f011c739d01b5f28328181c43034
SHA1 6a2829a2cba8b6d246e11ce015a20f7c689d0a9b
SHA512 9c4231e756a01b5e6a5e28d035539c282a7b78de84ac7418bc162b047c204f07ebc3db368fdfcbd5db75d661cdf4e525441f1fb76435ea502b4ba91887c25681
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbkctz:2eCqtl
TLSH
T19E54D01E67EB0D31A189844372719BFD229735A3B6C8F714BA3FD12AE7C298D4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-72-0x0000018575080000-0x00000185750C8000-memory.dmp

Download

memory/4560-16-0x00000209CFAC0000-0x00000209CFACA000-memory.dmp

Download

memory/4560-20-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-10-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-11-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-14-0x00000209CFD20000-0x00000209CFD3E000-memory.dmp

Download

memory/4560-15-0x00000209CFD40000-0x00000209CFDF2000-memory.dmp

Download

memory/4560-0-0x00007FFDC307F000-0x00007FFDC3080000-memory.dmp

Download

memory/4560-18-0x00000209CFF80000-0x00000209CFFA4000-memory.dmp

Download

memory/4560-17-0x00000209CFF80000-0x00000209CFFAA000-memory.dmp

Download

memory/4560-8-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-19-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-9-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-21-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-22-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-7-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-39-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-41-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-6-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-5-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/4560-4-0x00000209CFA70000-0x00000209CFA92000-memory.dmp

Download

memory/4560-1-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download