7f6e711385a4ec779286c9e2f035fda3b86e75ce2d50725dcd8facb6c07b4116

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f6e711385a4ec77.ps1
Size 622KB
Sample261023-3htm4s1vgv
SHA256 7f6e711385a4ec779286c9e2f035fda3b86e75ce2d50725dcd8facb6c07b4116
MD5 b6638abd616a4553f434f75856d8b6ff
SHA1 fa714f7dfd48a93541d6b06fa48da3c907c7d11a
SHA512 7dce22a156ddbe9159712ba7f1e74e210e7d266dd0682b0ab0a6415cfcd2deee6b3759e300f5cc47038996a543c321a5231e69c942949d83db22a404d82a48b8
SSDEEP 12288:2emJTs4ul9pLNZOSV0qrgmkB8xAKGoN8G2U:27kZO/8xTj
TLSH
T193D46D347E412EFF5BB820C248D6811C563C3279DA686CF669CB0CA2394D77627B79B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	4076	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 456	4076	powershell.exe	90

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4076	powershell.exe
3612	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe
3612	powershell.exe
3612	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe
Token: 36	4076	powershell.exe
Token: SeDebugPrivilege	464	whoami.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe
Token: 36	4076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 464	4076	powershell.exe	87
PID 4076 wrote to memory of 456	4076	powershell.exe	90
PID 4076 wrote to memory of 456	4076	powershell.exe	90
PID 4076 wrote to memory of 456	4076	powershell.exe	90
PID 4076 wrote to memory of 456	4076	powershell.exe	90
PID 4076 wrote to memory of 456	4076	powershell.exe	90
PID 1632 wrote to memory of 3864	1632	conhost.exe	103
PID 3864 wrote to memory of 3612	3864	cmd.exe	104
PID 3612 wrote to memory of 2876	3612	powershell.exe	105
PID 2876 wrote to memory of 2288	2876	csc.exe	106

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7f6e711385a4ec77.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4812

C:\Windows\system32\conhost.exe
conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v5ahtpe1\v5ahtpe1.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA1F.tmp" "c:\Users\Admin\AppData\Local\Temp\v5ahtpe1\CSC596AFDFA61A2486CB4B7757D52A52F60.TMP"
        5⤵
        
        PID:2288

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 313KB
SHA256 091b3b602c487c7360a22b4156741d268c125b657dce9bce0c77371cad667806
MD5 f4f22592584bac16bdbd5fa25d1f0b41
SHA1 14b043b1c2f40ea9b8a5363c121e72b23ded0d31
SHA512 2832e6a5727103c80a14665fa153e2bcd9dfe2342493e53d745e29a98fe169f0ca02dac97bd479b4745e6f6dd546cc883accded3840159f0b5b31c60bd3782d5
SSDEEP 6144:gjgsFzuIUFgEtLEVnXKnA3c7maJTZWV6kDUKqGwme0A:gjgsFbUFgfX53c7m+tWBUvr
TLSH
T1FC646D607E422EFB4BBC20C248DA821C553C22B5D9682DF576CF5C922B0DB7527B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 ddccdb86bcf1a6a9f5e40d8b838cb38335ce102f03a7a2810328edb52753cba9
MD5 4d0a4e9a9f4b42ba8b64c79bd2098a46
SHA1 09c4feb9543a936e86502e026588de311927c916
SHA512 4e262f44635a2c54c44d8c384209b3dcc05829f7d9bee44e616edff4c451571d369aeb302b47acaec4c20e761994b039f334a93c526fa95febfb3de70b0a212d
SSDEEP 96:iq3NYqGeHo9xrLSwtznEQx4qKkq3qeYrhGaq6fm0RIzoZ7qg0WPfsNySxBPFX:iqdYqGAjwtznEQx4qKkq3qtZq6XIzo7q
TLSH
T19881DD313275B0D4C9567F072A2819D463BF4386EA98AF4CB25C621ED92751BDB221F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 69121944625ce8397951fe74ab886f3c6a86a499f75c8980c2b03ac26bafc477
MD5 29094bc450e91290f0decb853afc264e
SHA1 177d2d50ac14386ea1b2e9b7fe5c2c9772835de0
SHA512 65ac3f2e9920edaa3702cdb370c1a2368fa5239ac82bad2bae62bac691e61d883de610f4252d239687727e84c3fea70394db2e7392ccef9fe2eca00e75bd75c3
TLSH
T1D341C827B39C85D0C889257ADCEC5C117A7692C3C09F8FDB6AC0D214E1AF698CA68050
MD5 SHA1 SHA512 TLSH

Submit Download

RESBA1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBA1F.tmp
Size 1KB
SHA256 3088b6f369f0316fc96e27d01de14d66a5f330235596ca68774cc0195a22dc40
MD5 a0db48c07774e4119875e5e30c484d50
SHA1 ca62e1b8087a6b9105daf210daf00c37519f555c
SHA512 819794317b5aba95070ea0320c3bc7dbab6898dc6ebcbe6332f0bbf8e68589043aff5bc86ddf9f2c90ed93870d41dfdb37b1ab3db56b9346bdca3b047c6d9993
TLSH
T19E21AB0193EC472BF0B31731A9F6172FA228FE98EFA2875F844002292C45111DEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hxn5c1hu.h4v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxn5c1hu.h4v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

v5ahtpe1.dll

Path C:\Users\Admin\AppData\Local\Temp\v5ahtpe1\v5ahtpe1.dll
Size 3KB
SHA256 6076df857c9d82c25ad734c93b4b063365e021dd8ba5848bd950814d70d7261d
MD5 fa915155f579d176cb977fe723abef23
SHA1 cebcfdb8006b37a077735c76fb8c0dfc71c185d3
SHA512 a050aad6a0a7c7470edfc3e663a3f24d633bd79e1a83da596fdf49177c452e51e74d184fe74a41f0f610d204a24f1a55ca28161bcfec72a429089bc80267b7ec
TLSH
T1DC715516A7E84A62E0B7037459F343155378F8609E37575E19C41328BC6A7242E32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC596AFDFA61A2486CB4B7757D52A52F60.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\v5ahtpe1\CSC596AFDFA61A2486CB4B7757D52A52F60.TMP
Size 652B
SHA256 a4fe56655530c97e2ede00814333de351d5eb80d7e9a1ae49f2520e05cf68ce1
MD5 0ecc91dff35c6588f282ba2766820157
SHA1 25e130ff41b29242a6aad4061037eed20d4d5d20
SHA512 b9779accdf94e787465751b5e8a7055f611b6480972ca8bfe56be0393d9e3b0ccaa7161a69ecc517abaf5c4a0dbfbeb3dac0492bbd26deacbd13cd594b5337af
TLSH
T1BCF03A0973FC020AF0F34B30B9F6436791A8BC64DE7293ED1440032D28685218962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

v5ahtpe1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\v5ahtpe1\v5ahtpe1.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

v5ahtpe1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\v5ahtpe1\v5ahtpe1.cmdline
Size 369B
SHA256 493e97bd18b6899e8f81034d2a8f01689fa86cd12267ba856e44a838da786da8
MD5 e9e12d4f8ce120a19bd162b4acef1374
SHA1 1e4d49fcede9ab5ef9df5fa0d63da40b5a2ff810
SHA512 367942632226e6439ebdec53b3930e27b9331d59ff6996626a1bf69383144c293e175a15b5d5d6a63fa770321bbbe56e8ea0894368b25181f374e2b73af7a910
TLSH
T136E0C02A82C7CA7E03DD1147A269D4FCE27607432B40BF845840440FD01F00227D1F43
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-16-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/3612-57-0x000002D8804F0000-0x000002D8804F8000-memory.dmp

Download

memory/4076-13-0x00000215F6A80000-0x00000215F6AAA000-memory.dmp

Download

memory/4076-20-0x00000215DE0B0000-0x00000215DE0C0000-memory.dmp

Download

memory/4076-19-0x00000215DE0B0000-0x00000215DE0C0000-memory.dmp

Download

memory/4076-15-0x00000215DE0B0000-0x00000215DE0C0000-memory.dmp

Download

memory/4076-14-0x00000215F6A80000-0x00000215F6AA4000-memory.dmp

Download

memory/4076-1-0x00000215DE0B0000-0x00000215DE0C0000-memory.dmp

Download

memory/4076-12-0x00000215F6E00000-0x00000215F6E50000-memory.dmp

Download

memory/4076-11-0x00000215F6A30000-0x00000215F6A42000-memory.dmp

Download

memory/4076-10-0x00000215DE0B0000-0x00000215DE0C0000-memory.dmp

Download

memory/4076-9-0x00000215F69A0000-0x00000215F69C2000-memory.dmp

Download

memory/4076-0-0x00000215DE0B0000-0x00000215DE0C0000-memory.dmp

Download

memory/4076-17-0x00000215F7430000-0x00000215F75F2000-memory.dmp

Download