e6acb3a0932a2b6094b3cda153670844757657a7b12c6937fe635e19ee9da5f1

Analysis

user interaction
yes
max time kernel
150s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123.ps1
Size 17KB
Sample261014-t9pc2avy9k
SHA256 e6acb3a0932a2b6094b3cda153670844757657a7b12c6937fe635e19ee9da5f1
MD5 cfc0cf872dca203bac8aed7bbe10b82b
SHA1 db9bad169c5f7295199ed8c671a2bccf3a735665
SHA512 b546964bd1db331d7f946a703036c3be920bb9566661fe2183824e5631a5bdcad77f7a7fddcadcf2b19188dbdeb44e8e20124ea53d5c125c8b400f12d9ba26e7
SSDEEP 384:ddgngWZPcKxrkNQKfAbIUV8lH12XwugSenKPNj90HkSHCP6fwu+kUeHh:Hggu5phIagijinHAlzSHh
TLSH
T1C282371652664F9F3260322850750B0A0DE7A765A460E4F3EBB7729EFD1CCC5B8F9923
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	3332	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3332	PowerShell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3624	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	PowerShell.exe
3332	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3188	3332	PowerShell.exe	90
PID 3188 wrote to memory of 3244	3188	csc.exe	91
PID 3332 wrote to memory of 3624	3332	PowerShell.exe	92
PID 3624 wrote to memory of 5452	3624	cmd.exe	94
PID 5452 wrote to memory of 5948	5452	calc.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\123.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qoaa0eoh\qoaa0eoh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4387.tmp" "c:\Users\Admin\AppData\Local\Temp\qoaa0eoh\CSCA12DE87A3FA743E0898E792E47EAD99.TMP"
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3c3d3a58f70d49489db4d334b6c26676_calculator.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3c3d3a58f70d49489db4d334b6c26676_calculator.bat

Path C:\Users\Admin\AppData\Local\Temp\3c3d3a58f70d49489db4d334b6c26676_calculator.bat
Size 27B
SHA256 5ec10d33b272b08b95a7bbf42f95f58244793312ff3051ad1af09d1af456c03a
MD5 6e418cb1c9a4f4904a55b9b8cf4d392e
SHA1 77b32be0ba87a42771251718685081e5e7a7b43f
SHA512 8882c61ce490f9290594b5d1f7881f344c41c77aff74376208399e74b0fdd3fc5c3135da62566305480eff6ada7e94df44bbec3ad20c3df4b661962a1366e74c
MD5 SHA1 SHA512

Submit Download

RES4387.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4387.tmp
Size 1KB
SHA256 5f1a707a2c68bab9605865abcec5a56f216bfde3023ef8026226740bb3a70e7a
MD5 d39e5e490c0cd392a34f091136fbdbda
SHA1 b5de9bb95b356da80efcaf94475e5d323694ee08
SHA512 266a42aba5a028330dc82cc8f69116c565d39be5314d319a9bf6744be288baa2a45a774c016d66f85e2083d798b74e4865dc5b7bad5f55baf1790938f3e6347b
TLSH
T1F6216A0593F9871EF0735B31A9F6531F9278FD94AFA2935A854142182C41508DEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

qoaa0eoh.dll

Path C:\Users\Admin\AppData\Local\Temp\qoaa0eoh\qoaa0eoh.dll
Size 3KB
SHA256 0fb9586b888327e369c26dd01de331c7ea04e9383ba1987b687cb5cf7e336a6b
MD5 9a3b0a5bd7f776663d0b4556fc9565aa
SHA1 df445f0aa3ef689a80743cbcee34a154e8531c2d
SHA512 07fb9296ca45f7a318b993641ace842d23d8295c99602c390430532a75e69cb875866c7fff48726b8fb907a801272efe65e15adaf3f43cf462efe31ec308d8a2
TLSH
T19A51B90A93E8462BE4B74B30AFF3036737B9FC508B72975D19800269ACA07144D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA12DE87A3FA743E0898E792E47EAD99.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qoaa0eoh\CSCA12DE87A3FA743E0898E792E47EAD99.TMP
Size 652B
SHA256 74373510053109f63bae786e9d5b8a9674b5d40655da2c2ca75f9efff755bed5
MD5 ee56872d9f4ef89f4aa934dde650f463
SHA1 55de20550e7804e5e5b3c393fcebf7fd143af185
SHA512 636b76cbdc7c7ecaadcf2b2cc2c6eb8d9308104f5e49fb6ee7350116062c4db0afdceb88692d59c559a45cd3d3563ce8e26deb0a039175daad2d0d4abe5e963a
TLSH
T17DF05E4963F8420EF0F34F30BEF6436791B9BCA5DE3293ED1440031928645148A62FB3
MD5 SHA1 SHA512 TLSH

Submit Download

qoaa0eoh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qoaa0eoh\qoaa0eoh.0.cs
Size 193B
SHA256 33a417065d0cbb1bb8c844b7960d029c5db11d91ca06b76e7996d08cdb5a9c4e
MD5 256e88eebecef79bdd8c0610df8ce6dd
SHA1 e81dafb0d3a7653896021c58d0b81e58114d099f
SHA512 cc959e728454a8c485debda1f0b744bd585aad0d8263568daab85f7822b02c847eaae70facaee4db5cd760e049f894be8fe33430b0d96f07f4ecddb118ed04a6
TLSH
T177C0C9182EE7AB24440248261D6AD0A87A275507166E9A00BAE80211CF870445331A29
MD5 SHA1 SHA512 TLSH

Submit Download

qoaa0eoh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qoaa0eoh\qoaa0eoh.cmdline
Size 369B
SHA256 8f09f31fb40b9a6bccae5c387e42788d3907c64b86b885f9ca49613589434e7c
MD5 ca24a71f8418aac6e1771ad3502dd327
SHA1 4cd6de3ca840003c3665c7763d1c2e97344239a2
SHA512 0b26f41f8dc8f8c4f085edffa37bad62fe45a620c31e31b20f2471ddecb014ea1ab314684ba9f9be1ecb86afcf5447d7327a34f190b24ecbd783aa4bdabecc1d
TLSH
T1B9E0C02A5287C27E06DF140B2169C4FCC2F687C329523F8472814C0DD0174002BF17C9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3188-24-0x0000023DFD3E0000-0x0000023DFDD84000-memory.dmp

Download

memory/3332-3-0x00000240C2FD0000-0x00000240C2FF2000-memory.dmp

Download

memory/3332-4-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-8-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-0-0x00000240C2C1C000-0x00000240C2C1D000-memory.dmp

Download

memory/3332-18-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-9-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-5-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-26-0x00000240C2FC0000-0x00000240C2FC8000-memory.dmp

Download

memory/3332-10-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-7-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-19-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-31-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-6-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download

memory/3332-33-0x00000240C2480000-0x00000240C2E24000-memory.dmp

Download