8f1c851ee5ba2561bf4b912a7a7ebdcfa3288aa9e62fe5ba438188f94af7d33b

Analysis

max time kernel
22s
max time network
23s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 7KB
Sample261023-ncv7escf93
SHA256 8f1c851ee5ba2561bf4b912a7a7ebdcfa3288aa9e62fe5ba438188f94af7d33b
MD5 672f435a1de54fdf61cf10068bc36170
SHA1 2801d1843a3cdf8bcad1d2612fac790915e0ee39
SHA512 9323cb66cf15010ada699fcf0ef1b95d10fc9a56f05cedb6ec11f531a8bd86000ca09f3dd95a56cfa7a36f74bef2b6019eb438312a12305dbfd3fd8383faf21b
SSDEEP 192:2d/y4yPoUQ4DUewlEKQ4HyJbU7O14PMsfrT4:2da4yPHMEan4
TLSH
T19CF1CA269902E86A19BB132ACDE19450FF321077839A1DF4799C80D81FFD13E8375E95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3332	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3332	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	powershell.exe
3332	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3904	3332	powershell.exe	85
PID 3904 wrote to memory of 4568	3904	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h4pzxfwv\h4pzxfwv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E91.tmp" "c:\Users\Admin\AppData\Local\Temp\h4pzxfwv\CSC94FC91DAEE584BE2B518772A73D768FA.TMP"
    3⤵
    PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7E91.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7E91.tmp
Size 1KB
SHA256 ed65b7a112eecf1e36b6ea2a95082ee529c47e47668ee2549e83149ff9db39e6
MD5 bbd12ac7ca9bd5c9e3ead786036d4147
SHA1 8500d07dc575c6559fb39164cf19516730afa0ea
SHA512 e1cb2486e915cd49e7a861352f0c07d52d7e5e11e712d25d504b2277dddb0b34f7694a9506281cdf8439cbaabce702561abd8d8afa82586a76124e6f690e91d7
TLSH
T15E21890193ED471EF0775772A9F6132FA278FD94EFA2A75B8540422C2851604EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5xodkhqh.xc2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xodkhqh.xc2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

h4pzxfwv.dll

Path C:\Users\Admin\AppData\Local\Temp\h4pzxfwv\h4pzxfwv.dll
Size 5KB
SHA256 dc0255de688ee5704191347080407bd81d720acb3c49c8e8da76418eed22f276
MD5 7c83626b28fa1dfcb3764d38cfdc49ea
SHA1 d8c0b2e6d9319376a0dc9b7c488b3a58c56fdb4a
SHA512 f1e78985b8fddb8800f5850fadd929f08fe25bee7d843786c53f801985bf2cf153db3838045370e6089fde5510f599ebb82340f755724e071a596a110ec5b298
SSDEEP 48:64wpGh1HMzA7XnRq8UEDVJjl4JChfJaNgYJY4cwq8RuLtv7gmp65EwvHCkGoA1uZ:wTzAbRq8tnrNcJY4Iv8iSzKYKP
TLSH
T195B1400AB7EC4127F47B4376A8F2833263B7B4498E37D79E089C1E6C9C66B405960F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC94FC91DAEE584BE2B518772A73D768FA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\h4pzxfwv\CSC94FC91DAEE584BE2B518772A73D768FA.TMP
Size 652B
SHA256 ff42067caad3264aa90227f12b8d47cbbf6cf7808939f7f6c37cf3d315867ec9
MD5 d659c4960a0a5ae873e869b0a23ee2c2
SHA1 8cc52b0e53bd3ce0d222f8c0c3a9e45b5d592d41
SHA512 fc0d86cf73cc9ced10f8b8ae9b5cad727741122fa86cd3596f9c122f0d69661652b87c4c0684037e2993cd8d91b8303d98b80c3e63dcba749bb39cd3150642e5
TLSH
T1FDF05E0963F8020EF0F34B70BDF6836391A9BCA4DE3293ED5840032D28645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

h4pzxfwv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\h4pzxfwv\h4pzxfwv.0.cs
Size 2KB
SHA256 1c7b7b881c3791c42e85d8580d0bef18b7f1fd759ad1765ad7fa26c7e9442af5
MD5 b325dba5f36c1d611b48082fbe5c94c8
SHA1 f05ba217e38fd4b6114ca5621a56ec1d89f79692
SHA512 ec1701313534533a487fcdcc4eb32ace78220d2b065306782c98ae9549bce57f9e164410a96b73ce5ac4dcad582a5f15afe685c86ba2eea53694cf4dc3efd9d4
TLSH
T138410142D642E9656CB22515DFF08CB6EB3362A343F665B0BDAD84920F3D0394270DF5
MD5 SHA1 SHA512 TLSH

Submit Download

h4pzxfwv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\h4pzxfwv\h4pzxfwv.cmdline
Size 369B
SHA256 c2945cbf9bcf54b8c8d6c407086be7676d53dfdacc8fc5536aea2974a03ca4af
MD5 003c0f41d69d461d10b252ac6a9e5bba
SHA1 549c51a2827803afa3132d6dff0b3fd23693beaa
SHA512 7295b5c2c695e6bdf1118942f5fcdf53bc99fee0127e1af8de0cfdc7f383456033f5943ad20cb158513eb5f9cacd2db2ffa62341f1d1103ee33c0ca8f356e2a0
TLSH
T1E8E0C62A624EC27E01ED304B666AC6ACCA728B8329803F849078849DF0270002BD27E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3332-10-0x000001D7F36A0000-0x000001D7F36B0000-memory.dmp

Download

memory/3332-1-0x000001D7F36A0000-0x000001D7F36B0000-memory.dmp

Download

memory/3332-7-0x000001D7F5F00000-0x000001D7F5F22000-memory.dmp

Download

memory/3332-0-0x000001D7F36A0000-0x000001D7F36B0000-memory.dmp

Download

memory/3332-23-0x000001D7F6250000-0x000001D7F6258000-memory.dmp

Download

memory/3332-24-0x000001D7F6490000-0x000001D7F6652000-memory.dmp

Download

memory/3332-25-0x000001D7F6B90000-0x000001D7F70B8000-memory.dmp

Download

memory/3332-27-0x000001D7F36A0000-0x000001D7F36B0000-memory.dmp

Download

memory/3332-28-0x000001D7F36A0000-0x000001D7F36B0000-memory.dmp

Download

memory/3332-29-0x000001D7F36A0000-0x000001D7F36B0000-memory.dmp

Download