7f6e711385a4ec779286c9e2f035fda3b86e75ce2d50725dcd8facb6c07b4116

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f6e711385a4ec77.ps1
Size 622KB
Sample261023-3htm4s1vgv
SHA256 7f6e711385a4ec779286c9e2f035fda3b86e75ce2d50725dcd8facb6c07b4116
MD5 b6638abd616a4553f434f75856d8b6ff
SHA1 fa714f7dfd48a93541d6b06fa48da3c907c7d11a
SHA512 7dce22a156ddbe9159712ba7f1e74e210e7d266dd0682b0ab0a6415cfcd2deee6b3759e300f5cc47038996a543c321a5231e69c942949d83db22a404d82a48b8
SSDEEP 12288:2emJTs4ul9pLNZOSV0qrgmkB8xAKGoN8G2U:27kZO/8xTj
TLSH
T193D46D347E412EFF5BB820C248D6811C563C3279DA686CF669CB0CA2394D77627B79B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3196	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3196 set thread context of 2132	3196	PowerShell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3196	PowerShell.exe
2568	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2724	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3196	PowerShell.exe
3196	PowerShell.exe
3196	PowerShell.exe
2568	powershell.exe
2568	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3196	PowerShell.exe
Token: SeSecurityPrivilege	3196	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3196	PowerShell.exe
Token: SeLoadDriverPrivilege	3196	PowerShell.exe
Token: SeSystemProfilePrivilege	3196	PowerShell.exe
Token: SeSystemtimePrivilege	3196	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3196	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3196	PowerShell.exe
Token: SeCreatePagefilePrivilege	3196	PowerShell.exe
Token: SeBackupPrivilege	3196	PowerShell.exe
Token: SeRestorePrivilege	3196	PowerShell.exe
Token: SeShutdownPrivilege	3196	PowerShell.exe
Token: SeDebugPrivilege	3196	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3196	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3196	PowerShell.exe
Token: SeUndockPrivilege	3196	PowerShell.exe
Token: SeManageVolumePrivilege	3196	PowerShell.exe
Token: 33	3196	PowerShell.exe
Token: 34	3196	PowerShell.exe
Token: 35	3196	PowerShell.exe
Token: 36	3196	PowerShell.exe
Token: SeDebugPrivilege	4560	whoami.exe
Token: SeIncreaseQuotaPrivilege	3196	PowerShell.exe
Token: SeSecurityPrivilege	3196	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3196	PowerShell.exe
Token: SeLoadDriverPrivilege	3196	PowerShell.exe
Token: SeSystemProfilePrivilege	3196	PowerShell.exe
Token: SeSystemtimePrivilege	3196	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3196	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3196	PowerShell.exe
Token: SeCreatePagefilePrivilege	3196	PowerShell.exe
Token: SeBackupPrivilege	3196	PowerShell.exe
Token: SeRestorePrivilege	3196	PowerShell.exe
Token: SeShutdownPrivilege	3196	PowerShell.exe
Token: SeDebugPrivilege	3196	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3196	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3196	PowerShell.exe
Token: SeUndockPrivilege	3196	PowerShell.exe
Token: SeManageVolumePrivilege	3196	PowerShell.exe
Token: 33	3196	PowerShell.exe
Token: 34	3196	PowerShell.exe
Token: 35	3196	PowerShell.exe
Token: 36	3196	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3196	PowerShell.exe
Token: SeSecurityPrivilege	3196	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3196	PowerShell.exe
Token: SeLoadDriverPrivilege	3196	PowerShell.exe
Token: SeSystemProfilePrivilege	3196	PowerShell.exe
Token: SeSystemtimePrivilege	3196	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3196	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3196	PowerShell.exe
Token: SeCreatePagefilePrivilege	3196	PowerShell.exe
Token: SeBackupPrivilege	3196	PowerShell.exe
Token: SeRestorePrivilege	3196	PowerShell.exe
Token: SeShutdownPrivilege	3196	PowerShell.exe
Token: SeDebugPrivilege	3196	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3196	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3196	PowerShell.exe
Token: SeUndockPrivilege	3196	PowerShell.exe
Token: SeManageVolumePrivilege	3196	PowerShell.exe
Token: 33	3196	PowerShell.exe
Token: 34	3196	PowerShell.exe
Token: 35	3196	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4560	3196	PowerShell.exe	91
PID 3196 wrote to memory of 2132	3196	PowerShell.exe	92
PID 3196 wrote to memory of 2132	3196	PowerShell.exe	92
PID 3196 wrote to memory of 2132	3196	PowerShell.exe	92
PID 3196 wrote to memory of 2132	3196	PowerShell.exe	92
PID 3196 wrote to memory of 2132	3196	PowerShell.exe	92
PID 2580 wrote to memory of 2724	2580	conhost.exe	97
PID 2724 wrote to memory of 2568	2724	cmd.exe	98
PID 2568 wrote to memory of 3092	2568	powershell.exe	99
PID 3092 wrote to memory of 4368	3092	csc.exe	100

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7f6e711385a4ec77.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1144

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lauzuy0h\lauzuy0h.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES201C.tmp" "c:\Users\Admin\AppData\Local\Temp\lauzuy0h\CSCF29113E5ED04E33AFED5B2F93B9FF7.TMP"
        5⤵
        
        PID:4368

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 408KB
SHA256 24873f8beef9faa9c5c8b3f4dd2264d6ead66cf7d982b873920a2db5e1205a7c
MD5 f4ad294e17a6f07b78315ee83ba58f49
SHA1 06b8909157638c47f414469ea577a307db987005
SHA512 5b9ebb1801bf2881003d48228537c77dec0726c50eff6739fdb8ec3fc3de30100006932f1f29c87fba13f1a140e0f81a9c0b5b9fdb5b789edd1e13fdbebe1a20
SSDEEP 6144:Ef+xBuU5vjjwGDbR4G8UihtmEh65AUqvGUgoMSD:I+bwG54G7ccEIugAD
TLSH
T17C945D307A026EFF5BA8608248D6C11C563C26B9C9282DF67ACF1C923B0D77517B79B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aae22b56af21c48acaee6fbc28d11696a0fd048b149272729e57070680950219
MD5 8bb84e62fc3dee54fe1edc4a2f49eaaa
SHA1 aa3cb07b7414c8973531f63e7e70f3dcb5065e48
SHA512 6857e191a95d4bd236f5d7da3f76d5479580254429cde471ee870ff386abeb4d5f80315f8eec5aab3a62c7442cc32cf677dfecf577bcd1eeab91b1e665ec58f2
TLSH
T1F8418837B3DC82D0C88961BADCDD6C107AB693D7809FCEDB6B80E115E56F798DA68050
MD5 SHA1 SHA512 TLSH

Submit Download

RES201C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES201C.tmp
Size 1KB
SHA256 efc075ba7f4926b2fae0887ca9533e6d0aace4f2aa2f71aa6a0dc793595f07de
MD5 d786119d5a49df79c459924f4e7bfa27
SHA1 d89e97f673e841ae2598572afe2c1e90fbfbb209
SHA512 cab59dcda5e52f0f5e1baa01f2ef533aaea005714dc15ca0317f1c81b8d7a69f2e1f482efbb486136810f777085b9d6d9f04f70faf1a7b6c266f97f4a93d1a1d
TLSH
T1D721AF0593F9471BF07747317DFA572BA269FD55EF61A39A854042283C51104DEB0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zpmkfqla.iub.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpmkfqla.iub.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lauzuy0h.dll

Path C:\Users\Admin\AppData\Local\Temp\lauzuy0h\lauzuy0h.dll
Size 3KB
SHA256 4f07c8842386187f9128b5639f860952416361b883ad430427b42511d26de20f
MD5 7e68f55d9f241872d61040809c7618b8
SHA1 8edc3b9afba89ee10d8d70e86432a44bc590874c
SHA512 203eef657f0cca83da4f23d95d328637ef1635c143a742a4fcb4cef0bd4a19c6fba37bd73470c13aa0beb1135f281dbb6b3412d838701fb5d58d72b86216fefb
TLSH
T1F2716306E7E44AA2E0B70378ADF343125378F8649F37576F19C46328BC657246E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF29113E5ED04E33AFED5B2F93B9FF7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lauzuy0h\CSCF29113E5ED04E33AFED5B2F93B9FF7.TMP
Size 652B
SHA256 7de2005f15855e0ba54d854318c06bab38cd53a4beda2939797ec4ec8ae68f64
MD5 b8f23b28995c0881ca000cdd7d18b9a8
SHA1 b6d9b4b92bd87831656a70267cd578ff7c61dedd
SHA512 4446df3089252960fe67cda10b71dd472002f2072c6a6d415249e3a40ec600616ecf3e96d66b7b4cdd07af611810046a7be16c69ce74d5a18bf62f6abbbc3518
TLSH
T1A9F05E0963F8420EF1F74B30BEF6436391AEBC65DE3693ED558053192C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lauzuy0h.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lauzuy0h\lauzuy0h.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

lauzuy0h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lauzuy0h\lauzuy0h.cmdline
Size 369B
SHA256 a3c0f4be73b7fe5f41525acc42b7b098c088ec5f521300006e3633bcf30939ee
MD5 441ac63b15ee0faa2107f92384a9a06e
SHA1 7028a9315cba24b5406fe8c8d0d8406955aa38f9
SHA512 b0cfea7bb4e226a196961c15f978f475946ca4d575e90fc89c32563b2bd37c36672fcaa8425fd87a4096401c67d00882995d77358d401df7b8ad5d81085b4d1c
TLSH
T176E0C02A635EC27E06DD1047697EE4BEC27207C339843F8458404C5DD02700177E1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2132-31-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/2568-74-0x0000016EFFA00000-0x0000016EFFA08000-memory.dmp

Download

memory/3196-13-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-12-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-15-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-16-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-17-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-18-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-20-0x0000019D58DB0000-0x0000019D58E00000-memory.dmp

Download

memory/3196-19-0x0000019D58980000-0x0000019D58992000-memory.dmp

Download

memory/3196-24-0x0000019D58E00000-0x0000019D58EB2000-memory.dmp

Download

memory/3196-25-0x0000019D58970000-0x0000019D5897A000-memory.dmp

Download

memory/3196-23-0x0000019D589A0000-0x0000019D589BE000-memory.dmp

Download

memory/3196-0-0x00007FFFBDB7F000-0x00007FFFBDB80000-memory.dmp

Download

memory/3196-26-0x0000019D58A10000-0x0000019D58A3A000-memory.dmp

Download

memory/3196-27-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-28-0x0000019D58A10000-0x0000019D58A34000-memory.dmp

Download

memory/3196-29-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-30-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-14-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-33-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-34-0x0000019D59740000-0x0000019D59902000-memory.dmp

Download

memory/3196-35-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-36-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-37-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-39-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-42-0x0000019D589E0000-0x0000019D589FE000-memory.dmp

Download

memory/3196-56-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-11-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-10-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-9-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-8-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-7-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-6-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-5-0x0000019D40370000-0x0000019D40392000-memory.dmp

Download

memory/3196-4-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download

memory/3196-1-0x00007FFFBD9F0000-0x00007FFFBE394000-memory.dmp

Download