a1dd8e2d3320f4524722ba32ae7e6841705a4792dbc69f6f3474ad2563f678b8

Analysis

max time kernel
149s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1dd8e2d3320f452.ps1
Size 563KB
Sample261022-skpf3aaf35
SHA256 a1dd8e2d3320f4524722ba32ae7e6841705a4792dbc69f6f3474ad2563f678b8
MD5 22afb79da7c7056e705cc9d8b237b902
SHA1 d7e52fb288496bfed23b257c81240b5636617042
SHA512 5546973f8494ff4310bd7a73e6867feb858e3aa4b0e3afbef7d5bb49e5cb56a422c24bb4c93cb4c5b158cd27cd6e2fcb119db6468b2fdbf63df932aeddcab54f
SSDEEP 12288:g2S9RkkGkHlcik3JbFfsc1x3YZCHw1pjXc:96ZZhkZh1yjXc
TLSH
T1D3C45D307A012EFF5BB820C248C6811C563826B8DE686DF56ACB4C933E1D77527B79B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2664	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2444	2664	PowerShell.exe	93

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2664	PowerShell.exe
1376	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2596	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2664	PowerShell.exe
2664	PowerShell.exe
2664	PowerShell.exe
2664	PowerShell.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2664	PowerShell.exe
Token: SeSecurityPrivilege	2664	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2664	PowerShell.exe
Token: SeLoadDriverPrivilege	2664	PowerShell.exe
Token: SeSystemProfilePrivilege	2664	PowerShell.exe
Token: SeSystemtimePrivilege	2664	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2664	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2664	PowerShell.exe
Token: SeCreatePagefilePrivilege	2664	PowerShell.exe
Token: SeBackupPrivilege	2664	PowerShell.exe
Token: SeRestorePrivilege	2664	PowerShell.exe
Token: SeShutdownPrivilege	2664	PowerShell.exe
Token: SeDebugPrivilege	2664	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2664	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2664	PowerShell.exe
Token: SeUndockPrivilege	2664	PowerShell.exe
Token: SeManageVolumePrivilege	2664	PowerShell.exe
Token: 33	2664	PowerShell.exe
Token: 34	2664	PowerShell.exe
Token: 35	2664	PowerShell.exe
Token: 36	2664	PowerShell.exe
Token: SeDebugPrivilege	1928	whoami.exe
Token: SeIncreaseQuotaPrivilege	2664	PowerShell.exe
Token: SeSecurityPrivilege	2664	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2664	PowerShell.exe
Token: SeLoadDriverPrivilege	2664	PowerShell.exe
Token: SeSystemProfilePrivilege	2664	PowerShell.exe
Token: SeSystemtimePrivilege	2664	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2664	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2664	PowerShell.exe
Token: SeCreatePagefilePrivilege	2664	PowerShell.exe
Token: SeBackupPrivilege	2664	PowerShell.exe
Token: SeRestorePrivilege	2664	PowerShell.exe
Token: SeShutdownPrivilege	2664	PowerShell.exe
Token: SeDebugPrivilege	2664	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2664	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2664	PowerShell.exe
Token: SeUndockPrivilege	2664	PowerShell.exe
Token: SeManageVolumePrivilege	2664	PowerShell.exe
Token: 33	2664	PowerShell.exe
Token: 34	2664	PowerShell.exe
Token: 35	2664	PowerShell.exe
Token: 36	2664	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2664	PowerShell.exe
Token: SeSecurityPrivilege	2664	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2664	PowerShell.exe
Token: SeLoadDriverPrivilege	2664	PowerShell.exe
Token: SeSystemProfilePrivilege	2664	PowerShell.exe
Token: SeSystemtimePrivilege	2664	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2664	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2664	PowerShell.exe
Token: SeCreatePagefilePrivilege	2664	PowerShell.exe
Token: SeBackupPrivilege	2664	PowerShell.exe
Token: SeRestorePrivilege	2664	PowerShell.exe
Token: SeShutdownPrivilege	2664	PowerShell.exe
Token: SeDebugPrivilege	2664	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2664	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2664	PowerShell.exe
Token: SeUndockPrivilege	2664	PowerShell.exe
Token: SeManageVolumePrivilege	2664	PowerShell.exe
Token: 33	2664	PowerShell.exe
Token: 34	2664	PowerShell.exe
Token: 35	2664	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1928	2664	PowerShell.exe	92
PID 2664 wrote to memory of 2444	2664	PowerShell.exe	93
PID 2664 wrote to memory of 2444	2664	PowerShell.exe	93
PID 2664 wrote to memory of 2444	2664	PowerShell.exe	93
PID 2664 wrote to memory of 2444	2664	PowerShell.exe	93
PID 2664 wrote to memory of 2444	2664	PowerShell.exe	93
PID 3712 wrote to memory of 2596	3712	conhost.exe	98
PID 2596 wrote to memory of 1376	2596	cmd.exe	99
PID 1376 wrote to memory of 1068	1376	powershell.exe	100
PID 1068 wrote to memory of 1652	1068	csc.exe	101

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a1dd8e2d3320f452.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1096

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\acq24hkr\acq24hkr.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D5B.tmp" "c:\Users\Admin\AppData\Local\Temp\acq24hkr\CSCF5EDDF6689934AEBA678E54EAB24F1A.TMP"
        5⤵
        
        PID:1652

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 352KB
SHA256 612f357fcdaca3493fbb743dee984fbcd7d088a54f45705647268d96dcb58529
MD5 5029fbcd62266be11351b2d09542d409
SHA1 492b3f83c4ec72d24a4ed0e6deca742b63549886
SHA512 2dc1a6a7c4b14835b22a1fc020c473901079c2ecdb6557113bcb082295b1ff3a4c664f5de408d7702322099b2d2ced9cb229455d49763987e7f4f3d776a1b295
SSDEEP 6144:7FKis3r+0WKZh5VmWKOxRqEpCucOQ0+kkKCase9UvTArdc:7FKiF0WCVnxqEpRX1A0re
TLSH
T16A745C7079422EFB5BB820C248CAC11C656C32B9C9682CF57ACF1C962F4D77916B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 27f82f7e7c9783ef95e6aa1ef0819b292521bf396ae8513c1ffefa5cce08f55a
MD5 2684da869df8dba30a5d5de959c4e17f
SHA1 507ca030b46683a34dd1a29f761dcd9bd6253e9a
SHA512 7571a73f07b40b1304802cd8436bb8067b4c59efc5edc7ee0af3bfd6654a56dec4d3981e20a8a593d141c12a71c3c88909ec428a687e061025e9945e6a672f02
TLSH
T160419937B3DC82D0C8896076DCDD6C117A7693D7809FCEDB6A80D115E56F698DA64050
MD5 SHA1 SHA512 TLSH

Submit Download

RES2D5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2D5B.tmp
Size 1KB
SHA256 22bca177bc7bf7a3950c967205895868790710ea3b4386a01524140bfebdcd45
MD5 3ee47557d1d6f8965f26bd811b9dadb9
SHA1 32e0e59b67dcc35cc0fe7acbb34b608b7e061cb5
SHA512 c5aef79b94f45b0916946dcf4fc177ec397836fc9f9cc9650412935ffa15fe3565a02156ef4cbc73e627b599e798708df857711c3dbd2bd0c7c81fcce378f459
TLSH
T1CE218C0553E9471FF0738B31A9FA172FAA28FD64DFB2935E4480422C2C11640DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t2na3unb.goo.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t2na3unb.goo.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

acq24hkr.dll

Path C:\Users\Admin\AppData\Local\Temp\acq24hkr\acq24hkr.dll
Size 3KB
SHA256 c917e61d5a70470a9be770badd6dcbe4e394b2ae1b614ae8a39ff3e15219c5d1
MD5 ee662525070195db378bd82b6f8274b6
SHA1 33662cf4baf257a68bccc650d41e6c26c731b16d
SHA512 5894d7c42fcfbd1cd4e32c88d008df4b9aec649eeca9f9467de2888b044a0e426586cb691ad7c4e75a99b04b65f0493f4adbd1cccd5900696fa1072d474782a0
TLSH
T1A8715207A7E44AA2E0B74338A9E343125378F8609E37575E18C42328BC657646E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF5EDDF6689934AEBA678E54EAB24F1A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\acq24hkr\CSCF5EDDF6689934AEBA678E54EAB24F1A.TMP
Size 652B
SHA256 e6d9d8db2d929fabd619409a96787ddf851dcf9df213de08309bae866aa6b932
MD5 6bd621b0610db86d854ecbed7d71ce7d
SHA1 e06453633c0d30a12371aabe83cef88c0ceb560a
SHA512 33732f92f625d153d1a6c07f6b4f3d694486fbe9b79dac0894ec9908848302cd143fcf937d2d04dd0a116e90916aa8da6a71ffe96ca3283a51631f78c8a18f2f
TLSH
T196F05E4963F8520EF0F78B30BDF6836395A8BC64DE3293ED1480131D2C64A20D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

acq24hkr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\acq24hkr\acq24hkr.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

acq24hkr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\acq24hkr\acq24hkr.cmdline
Size 369B
SHA256 e455ee11dd1ccfaf3d8aeb67b324f4ceef8d01376c0950bf81a8ffeaf7d301a6
MD5 de96b465172d93f5df16f3bd98f648af
SHA1 4acce150b82b4970c560f7d04c7ce84ff0bbcbca
SHA512 f209727da302c0a4df4f47795808641949294ae5e1e495926f42867f5b44fe89a56dc11f8257bb4ae865583fde9149ab9554b75d05cc79583af800b73dec2dcb
TLSH
T17BE0682B629AC3BD01EA10072169C6EDAA72064369403F8CF880440DE2170013BD1752
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1376-72-0x0000021B2C730000-0x0000021B2C738000-memory.dmp

Download

memory/2444-30-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/2664-18-0x00000255655D0000-0x00000255655E2000-memory.dmp

Download

memory/2664-31-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-16-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-17-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-14-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-19-0x00000255659E0000-0x0000025565A30000-memory.dmp

Download

memory/2664-22-0x0000025565610000-0x000002556562E000-memory.dmp

Download

memory/2664-23-0x0000025565A30000-0x0000025565AE2000-memory.dmp

Download

memory/2664-25-0x0000025565600000-0x000002556560A000-memory.dmp

Download

memory/2664-24-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-13-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-0-0x00007FFDC3B8F000-0x00007FFDC3B90000-memory.dmp

Download

memory/2664-26-0x0000025565B80000-0x0000025565BAA000-memory.dmp

Download

memory/2664-27-0x0000025565B80000-0x0000025565BA4000-memory.dmp

Download

memory/2664-28-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-29-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-12-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-15-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-32-0x0000025566540000-0x0000025566702000-memory.dmp

Download

memory/2664-34-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-35-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-39-0x0000025565660000-0x000002556567E000-memory.dmp

Download

memory/2664-40-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-54-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-11-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-10-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-9-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-8-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-7-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-6-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-5-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-3-0x00007FFDC3A00000-0x00007FFDC43A4000-memory.dmp

Download

memory/2664-4-0x00000255655A0000-0x00000255655C2000-memory.dmp

Download