96115e6ba3746b9a1835a0f7b91c6da580f1dbfe5704f87ab3449f774b5704b6

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.ps1
Size 31KB
Sample261015-xewemsby3q
SHA256 96115e6ba3746b9a1835a0f7b91c6da580f1dbfe5704f87ab3449f774b5704b6
MD5 26d06b193670425ac48ffcb89686eff9
SHA1 7a5d0f293f28b21a5e1fc7e7589e9d8c270c3eee
SHA512 9265f26010fd59d049a9e03e43207f3fe8ce28b06474a473ae59443ff686ff668598c61d2d79dd1738bb7d12c09f7516d8d62938b350068c57448f44d2437a8a
SSDEEP 768:dxJ6StkZJw/kPgxBYuxhPnxZYcx1oW65Up1Fn9r1hlt9:dxxmAxPxZxbx1oJ5IF1hlr
TLSH
T1A2E2B2143E1AE63152F25267AEB7C894FA1510374258EB0475EE89D0AFBA714C378B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2896	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	PowerShell.exe
2896	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4416	2896	PowerShell.exe	90
PID 4416 wrote to memory of 5988	4416	csc.exe	91
PID 2896 wrote to memory of 4124	2896	PowerShell.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f2nm0a5j\f2nm0a5j.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80CA.tmp" "c:\Users\Admin\AppData\Local\Temp\f2nm0a5j\CSCFC713DD5A0E54318B69C470865B9B59.TMP"
    3⤵
    PID:5988
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2896" "2256" "2136" "2244" "0" "0" "2260" "0" "0" "0" "0" "0"
  2⤵
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES80CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES80CA.tmp
Size 1KB
SHA256 8960d596603017f26be306411d2d6ff516d5b2edaaa9f15ba2027594f16e5b13
MD5 1a1c0b177b1679c96caf79aaceff4347
SHA1 344a7299eb7897405ac9c88f9a7c8fe44602421e
SHA512 964230c05d5330ffb74448f95c796949592584d66443866039101e34fd6dc5e90c38c8d65bd8dc0aaf4b60b63c100af117d15cdd5b934a0f16f3b6649f9492d4
TLSH
T1E821890993E8471BF077473269FA5B2F9275FD64EFA2675A844142282C81204EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

f2nm0a5j.dll

Path C:\Users\Admin\AppData\Local\Temp\f2nm0a5j\f2nm0a5j.dll
Size 4KB
SHA256 3dedc5fb36f88a6f40376333b175091d7ad15803858dfc479ddc61130467dec9
MD5 170a70b3452c67a6ffb0125d913a67d2
SHA1 532a00628d020377b4e1524070c26f196f0cb69e
SHA512 2b371eeb2751bfdb4f2206ad8bb126b3440c0d4be395bff43d8e1065c094249f6e21fdf99dd675cb9aae2264bd427ae7790f1021de95f6f1bb6a6c1e243fc17a
SSDEEP 48:6ulFto23KXkphOqzGLlFlhPE3jdsWjuJZw4+s1ulza3vq:Xjto23K6htklFlsDBThK
TLSH
T10C9174066BD88562E4E31735ADB3CB4BA7B4F8045E729B1F15D21239ACE27502A71BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCFC713DD5A0E54318B69C470865B9B59.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\f2nm0a5j\CSCFC713DD5A0E54318B69C470865B9B59.TMP
Size 652B
SHA256 4e3ad6b9eed61fd0bf4d12e5825c7a99da423f7d76e3459554a413c2fab9f711
MD5 4a211035fb09dfa8cdd1d42b588911c8
SHA1 c9b01223e052f0e28057527d400a5cb3c0339655
SHA512 3e2a667596ff999d75ab2a9c79d3d5b5df585a7ac5c1944bc0f49f0878978bbf0de4640a17302eaad54fe66cf280757e61dd32cc9028ff670e0e400d413781e6
TLSH
T12DF0540963F8421EF0F38B30BDF547A39168BC64DE3253ED1885435928645149671FB1
MD5 SHA1 SHA512 TLSH

Submit Download

f2nm0a5j.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\f2nm0a5j\f2nm0a5j.0.cs
Size 1KB
SHA256 36ef198ade1b6570ca2f0da208776a3fa0534a416625aabf327d4f7207910590
MD5 235591a030365a86927b7ad6d1567a8c
SHA1 a30d8d57d2952937032f1d2a5b6b3b63753dd66c
SHA512 86c0627d5e029ddc4ea85246d22307a19f7c491beff910ab40d29ef07355a00e2abb744a86e950468c3c609e325c1cfa030a5cc3d745cedae52dfdba712abd03
TLSH
T124417F282A01FD7252A7792976ECC9DEE227912023F7F6202ECA0F710F071519134A5A
MD5 SHA1 SHA512 TLSH

Submit Download

f2nm0a5j.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\f2nm0a5j\f2nm0a5j.cmdline
Size 369B
SHA256 ff58b3605e9ca69ccfa344202ac6361f0e40cb01eb8cd7322f84c05d6f69dad0
MD5 b5b9c4618fa6e7c075c05012ba5a7ac9
SHA1 9feea19e586cc2992b10670151a8833616887108
SHA512 5e147421bf3d7ea3c8434a5ed508108bbaf77438c57e7f996197ccfd69586741b38f21401876f3f406164c5d1e0819dc99a82f018026a1c9e3371495f0fcb923
TLSH
T1E9E0D82E9356C6BE15F920072169C5AC82720B4B2B817F845150845DD02F8066BD1BE6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2896-18-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-8-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-9-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-0-0x00007FFF8BA6F000-0x00007FFF8BA70000-memory.dmp

Download

memory/2896-5-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-17-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-7-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-6-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-23-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-4-0x0000024647FA0000-0x0000024647FC2000-memory.dmp

Download

memory/2896-25-0x0000024660460000-0x0000024660468000-memory.dmp

Download

memory/2896-1-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download

memory/2896-29-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp

Download