cfff54659b7f5d1fd3cd59c160cdcaf4e59c2345f7879606d89fc17682b0d580

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EndfieldModRepair-v1.3.1-rc2/src/Build.ps1
Size 1KB
Sample261017-natktaev6v
SHA256 cfff54659b7f5d1fd3cd59c160cdcaf4e59c2345f7879606d89fc17682b0d580
MD5 26ca01680d82b60c880178d82793ef68
SHA1 a1d1fd39ccdc09a9e506b9deb53ff5d4533ddf70
SHA512 d0aa4336f64f883f68f127d2cdf0651dcad61f120a8297d44c2879cd475918b31748359870a0f9295fa7fd1a51f35d2b737dae8538a0ad46b13ea65aca8a952e
TLSH
T165219B0F590E6C5191F4AB48766A01A7412B415DA816272CC02C3D4EF9777FD8F3ABA5
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	powershell.exe
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 636	2744	powershell.exe	88
PID 636 wrote to memory of 4472	636	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\Build.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:winexe /platform:anycpu /optimize+ /reference:System.Windows.Forms.dll /reference:System.Drawing.dll /win32manifest:C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\app.manifest /resource:C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\CurrentMaterial.pattern,EFMIRepair.CurrentMaterial.pattern /out:C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\EndfieldModRepair.exe C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\Engine.cs C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\RabbitAdapter.cs C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\Program.cs C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\Profiles.cs /resource:C:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\src\Profiles.xml,EFMIRepair.Profiles.xml
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA311.tmp" "c:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\CSCCB0F21C8EDD34B9B8823B738ACAF7AEF.TMP"
    3⤵
    PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA311.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA311.tmp
Size 2KB
SHA256 0c4fc139f73f41eeb8df6d6a1a86a2b022fa817364ece87f8935a01baeefd739
MD5 cca5b48cb0ff37cad85c4111a2dbcd9d
SHA1 f5c7f34dbb9b6fe84ba247e4cc36195e54d9f2c6
SHA512 bbb8dd9f4663732d694cbc3ca28866ad7fc8614c0dbb21b6e1166df8c9954ea15b81e7c31f483785fce0377c01eb8c686458c97323bbe0f4f04d1f954c510481
TLSH
T1EE418581E3F4069FE162577219B29315A135BF9EADDA932DC180493D2802786CFC22F2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y0idt3gb.n0m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y0idt3gb.n0m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCB0F21C8EDD34B9B8823B738ACAF7AEF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\EndfieldModRepair-v1.3.1-rc2\CSCCB0F21C8EDD34B9B8823B738ACAF7AEF.TMP
Size 1KB
SHA256 af2c775b1ba4482696a3b623056a8b2bcad7e6604370b9fe9fb59117059235c9
MD5 0c6a43de98c39884c7afce227afc5558
SHA1 38ed35232df3e8ba7f0c8b6a26681df2281d72b5
SHA512 f7d44afb7cb2517761158b5dd8f539d8a4f80402f85c3a43acb87e930361380997aadd81d9e158fa92d808356dae8a9b4d78734337d70d4828986c5ae57f4128
TLSH
T1DC312285F2F41189F2E347712970D35250767F7E9CA992BC80C04F6E2801B82C7826F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2744-1-0x00000184A6820000-0x00000184A6830000-memory.dmp

Download

memory/2744-0-0x00000184A6820000-0x00000184A6830000-memory.dmp

Download

memory/2744-9-0x00000184A6960000-0x00000184A6982000-memory.dmp

Download