8f1c851ee5ba2561bf4b912a7a7ebdcfa3288aa9e62fe5ba438188f94af7d33b

Analysis

user interaction
yes
max time kernel
24s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 7KB
Sample261023-ncv7escf93
SHA256 8f1c851ee5ba2561bf4b912a7a7ebdcfa3288aa9e62fe5ba438188f94af7d33b
MD5 672f435a1de54fdf61cf10068bc36170
SHA1 2801d1843a3cdf8bcad1d2612fac790915e0ee39
SHA512 9323cb66cf15010ada699fcf0ef1b95d10fc9a56f05cedb6ec11f531a8bd86000ca09f3dd95a56cfa7a36f74bef2b6019eb438312a12305dbfd3fd8383faf21b
SSDEEP 192:2d/y4yPoUQ4DUewlEKQ4HyJbU7O14PMsfrT4:2da4yPHMEan4
TLSH
T19CF1CA269902E86A19BB132ACDE19450FF321077839A1DF4799C80D81FFD13E8375E95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2344	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2344	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2344	powershell.exe
2344	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4588	2344	powershell.exe	85
PID 4588 wrote to memory of 3708	4588	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nxqjwbtj\nxqjwbtj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7B0.tmp" "c:\Users\Admin\AppData\Local\Temp\nxqjwbtj\CSCF1C27AF8A9F247C3A01C3A706F7DBF65.TMP"
    3⤵
    PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC7B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC7B0.tmp
Size 1KB
SHA256 1b6230899a16678625f7d0416573798c7253673f1c0a59c35dabdfe302d9eb90
MD5 c630c3bf2f22c5fa784ae0421e3df0aa
SHA1 57da05a2d1097916c05c8be29c3160226d6e71c8
SHA512 3a0ba52eb13f171cb464c5e2fe0b4aad916621a0813b53b066f58eee7d2d6f9dc82b72932873ae870e4625cf4e9d47fe21be0003ea691758cc42d415f3a89f18
TLSH
T1F6218C0487E9471FF0739B31A9FA176FA124FD64EF61935A854052281C51504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f22k5rid.gtr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f22k5rid.gtr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nxqjwbtj.dll

Path C:\Users\Admin\AppData\Local\Temp\nxqjwbtj\nxqjwbtj.dll
Size 5KB
SHA256 00e35ed80db00ffad66be233d73d9f854af71ff55c17763658cfc6b1fd1474e1
MD5 fff87a2862642296cf4fb1718334153d
SHA1 ff4bf706921395b39ac2d29de50428de5362e161
SHA512 dac8a7e6cbe6a2984c4c20ae95cb6a44df5fe36729e1b7334e3f9e42074f8192f7bded4a3110971696f30f8047075d38a1f83f4b8cdecc60c8e5a54e7b669e5a
SSDEEP 48:6eGwpGh1HMzA7XnRq8UEDVJol4JHfhfJaNgYJY4cwq8RuLtv7gmp65EwvHbkGoA6:1dTzAbRq8tnLNcJY4Iv87SztiKe
TLSH
T18EB1430AB7E84127E47B433198F243336377B5199E37D79E089C1E6C9C62B405961E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCF1C27AF8A9F247C3A01C3A706F7DBF65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nxqjwbtj\CSCF1C27AF8A9F247C3A01C3A706F7DBF65.TMP
Size 652B
SHA256 f4748a1970e16de313645513affecd40fb896b1fec78829bd0868b17a58fb4ac
MD5 4f34079664beef6c8c079f4c669bf895
SHA1 eac22af26222b8bab7de96bcbae85ba2a17d7268
SHA512 050f55b825854eb5d6d6dfc11eb9a5d7d358ff7d78dd68c577cd41d65ab6674436b0b907cb81f26eea1c04a5a6f8b5130d25428ca1bebf9b8665499a19211929
TLSH
T14DF05E09A3F8420EF0F34F70BDF653A391A8BC64DE3293ED1440431D6C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nxqjwbtj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nxqjwbtj\nxqjwbtj.0.cs
Size 2KB
SHA256 1c7b7b881c3791c42e85d8580d0bef18b7f1fd759ad1765ad7fa26c7e9442af5
MD5 b325dba5f36c1d611b48082fbe5c94c8
SHA1 f05ba217e38fd4b6114ca5621a56ec1d89f79692
SHA512 ec1701313534533a487fcdcc4eb32ace78220d2b065306782c98ae9549bce57f9e164410a96b73ce5ac4dcad582a5f15afe685c86ba2eea53694cf4dc3efd9d4
TLSH
T138410142D642E9656CB22515DFF08CB6EB3362A343F665B0BDAD84920F3D0394270DF5
MD5 SHA1 SHA512 TLSH

Submit Download

nxqjwbtj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nxqjwbtj\nxqjwbtj.cmdline
Size 369B
SHA256 25da97f1f222ddfd0b4c0945965141fe384b3f698ae18c416804f3fc0f59fb3a
MD5 778521ccd3fe9f324b295c29d8420d27
SHA1 13b2c7c1cc4ad445d86770a9c8ed8ba49adf882e
SHA512 0c5ffff7832fab6f0a58121b8147c366aedfdd5e78315126fb8244593e69d737776f500ddad7b4393f8def247e2cbf0e6455e09b4a527fa1d9e65303b4ae331a
TLSH
T173E0683A4286C27D01F9280723AAC9ACA272164339403F84614048EDE09B0442BD3B51
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2344-1-0x00000265F4D50000-0x00000265F4D60000-memory.dmp

Download

memory/2344-7-0x00000265F5610000-0x00000265F5632000-memory.dmp

Download

memory/2344-0-0x00000265F4D50000-0x00000265F4D60000-memory.dmp

Download

memory/2344-22-0x00000265DC730000-0x00000265DC738000-memory.dmp

Download

memory/2344-23-0x00000265F6040000-0x00000265F6202000-memory.dmp

Download

memory/2344-24-0x00000265F6740000-0x00000265F6C68000-memory.dmp

Download

memory/2344-25-0x00000265F4D50000-0x00000265F4D60000-memory.dmp

Download

memory/2344-26-0x00000265F4D50000-0x00000265F4D60000-memory.dmp

Download