8a67f2bc78d859d328a491b68ab53f3f2680b183df0f2773ad511802007c8fbb

Analysis

max time kernel
149s
max time network
90s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a67f2bc78d859d3.ps1
Size 591KB
Sample261024-xgff7sdv4m
SHA256 8a67f2bc78d859d328a491b68ab53f3f2680b183df0f2773ad511802007c8fbb
MD5 b154681f0d800edb2627917d9734bf5c
SHA1 2566cbd57a4d94a8432b478d54a773eaa512f864
SHA512 22e143d45e521fd85b4e2885eb7691dbf9cd12a20aa016981382a0485d4d8de1a7e79592d202e5841b6c097bda004cdbeda7fb57f02ca8b01bb5853e01a6edb3
SSDEEP 6144:O0wDgYUfC4F+NRrN7KxjCbBSVYqW7TdQgYeKCxdjIkotZd+fAPpP0yQn2VESiS1U:OjDSfmGgYWzj3khxP0NSiAPYQY
TLSH
T155D46D34BA022EFF5BB820C248C5811C563C36B4CA686DF569CB4CA3391D77627B79B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4664	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4664 set thread context of 1360	4664	PowerShell.exe	93

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4664	PowerShell.exe
720	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1952	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4664	PowerShell.exe
4664	PowerShell.exe
4664	PowerShell.exe
4664	PowerShell.exe
720	powershell.exe
720	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4664	PowerShell.exe
Token: SeSecurityPrivilege	4664	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4664	PowerShell.exe
Token: SeLoadDriverPrivilege	4664	PowerShell.exe
Token: SeSystemProfilePrivilege	4664	PowerShell.exe
Token: SeSystemtimePrivilege	4664	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4664	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4664	PowerShell.exe
Token: SeCreatePagefilePrivilege	4664	PowerShell.exe
Token: SeBackupPrivilege	4664	PowerShell.exe
Token: SeRestorePrivilege	4664	PowerShell.exe
Token: SeShutdownPrivilege	4664	PowerShell.exe
Token: SeDebugPrivilege	4664	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4664	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4664	PowerShell.exe
Token: SeUndockPrivilege	4664	PowerShell.exe
Token: SeManageVolumePrivilege	4664	PowerShell.exe
Token: 33	4664	PowerShell.exe
Token: 34	4664	PowerShell.exe
Token: 35	4664	PowerShell.exe
Token: 36	4664	PowerShell.exe
Token: SeDebugPrivilege	3184	whoami.exe
Token: SeIncreaseQuotaPrivilege	4664	PowerShell.exe
Token: SeSecurityPrivilege	4664	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4664	PowerShell.exe
Token: SeLoadDriverPrivilege	4664	PowerShell.exe
Token: SeSystemProfilePrivilege	4664	PowerShell.exe
Token: SeSystemtimePrivilege	4664	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4664	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4664	PowerShell.exe
Token: SeCreatePagefilePrivilege	4664	PowerShell.exe
Token: SeBackupPrivilege	4664	PowerShell.exe
Token: SeRestorePrivilege	4664	PowerShell.exe
Token: SeShutdownPrivilege	4664	PowerShell.exe
Token: SeDebugPrivilege	4664	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4664	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4664	PowerShell.exe
Token: SeUndockPrivilege	4664	PowerShell.exe
Token: SeManageVolumePrivilege	4664	PowerShell.exe
Token: 33	4664	PowerShell.exe
Token: 34	4664	PowerShell.exe
Token: 35	4664	PowerShell.exe
Token: 36	4664	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4664	PowerShell.exe
Token: SeSecurityPrivilege	4664	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4664	PowerShell.exe
Token: SeLoadDriverPrivilege	4664	PowerShell.exe
Token: SeSystemProfilePrivilege	4664	PowerShell.exe
Token: SeSystemtimePrivilege	4664	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4664	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4664	PowerShell.exe
Token: SeCreatePagefilePrivilege	4664	PowerShell.exe
Token: SeBackupPrivilege	4664	PowerShell.exe
Token: SeRestorePrivilege	4664	PowerShell.exe
Token: SeShutdownPrivilege	4664	PowerShell.exe
Token: SeDebugPrivilege	4664	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4664	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4664	PowerShell.exe
Token: SeUndockPrivilege	4664	PowerShell.exe
Token: SeManageVolumePrivilege	4664	PowerShell.exe
Token: 33	4664	PowerShell.exe
Token: 34	4664	PowerShell.exe
Token: 35	4664	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3184	4664	PowerShell.exe	92
PID 4664 wrote to memory of 1360	4664	PowerShell.exe	93
PID 4664 wrote to memory of 1360	4664	PowerShell.exe	93
PID 4664 wrote to memory of 1360	4664	PowerShell.exe	93
PID 4664 wrote to memory of 1360	4664	PowerShell.exe	93
PID 4664 wrote to memory of 1360	4664	PowerShell.exe	93
PID 3060 wrote to memory of 1952	3060	conhost.exe	99
PID 1952 wrote to memory of 720	1952	cmd.exe	100
PID 720 wrote to memory of 3460	720	powershell.exe	101
PID 3460 wrote to memory of 3548	3460	csc.exe	102

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8a67f2bc78d859d3.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5596

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3znacbcl\3znacbcl.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF77.tmp" "c:\Users\Admin\AppData\Local\Temp\3znacbcl\CSC58393F52B0F44F9487B0E1FD275B725A.TMP"
        5⤵
        
        PID:3548

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 339KB
SHA256 89d635ad9a543900bb7bc1f7e59a44e4e974cd4fa5c1e2697ae5d4bf5da87109
MD5 461d0083cedca0ccd06da4a57207c26a
SHA1 0fd429435686c247ddf677a614d4637d9cc4e93d
SHA512 d4de0c8ba79cee1b909cdd6ae064a0d526f8558d1249cee9051cfb33d6542887d0d574d0d3a5a78d0de4566d7dea0d3037150203fa120a4043fae8b398b1199f
SSDEEP 3072:AJwrMaqcYIv9VzOhzTeD9TzU52FPU9Y8vSRbwOPMd+1ewFtZeQvexyBkVMJCE1m7:l1vVIsUGQ6AI19tQQveUMNOHBUGb2Jl
TLSH
T150745D307A421DFB5BB8208248C6810C662C36B9C9682DF57ACF5CA23F5D77527B79B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 35dcd758e56e8b77b28f69a006d708fef51b7667923df47c2c18646b9191fe29
MD5 82b783b5c334e9303b5dc4350b5aeb3f
SHA1 75efb9e8f2e2984bcf2d7ef2430eb92a705d4405
SHA512 69b2daf59f95e57cdd8d4680b1403d2d275d6cbc1f6d5e5f4bd7525ae786caafc383ec40368d566319d31d142869da869e34d4b25b7e88ab59ae1d35b6822c96
TLSH
T197419937B3DC42D0C8896076CCDD6C117AB693D7809FCEDB6A80D115E56F298DA64050
MD5 SHA1 SHA512 TLSH

Submit Download

3znacbcl.dll

Path C:\Users\Admin\AppData\Local\Temp\3znacbcl\3znacbcl.dll
Size 3KB
SHA256 8af3c1aa9e334c46a08869a788afeaccbf0fcc1c32e31603f5e4b722be25e24b
MD5 beb423185d85f7b35d6f509e720171a4
SHA1 c6aedfe2d791ba8dd402401677332148edc21c62
SHA512 70ecf3abb30065f948e7aba0285dcd03b0eddbcecca2560f52cbcc17f87c6d94b74f0af0787dcacdc84ba786fd6f7930deb2ba424b91ef768db4b3011e99bc94
TLSH
T1BE716306A7E44AA2F0B343386DF343515378FC609F37975F18842328BC657646E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESCF77.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCF77.tmp
Size 1KB
SHA256 8a6bf49155ed59756430a142f8e1366cb41ed0748ac7825f5b302ebb12236b34
MD5 a9b3d6d368d1d33107b8b9767dcfcb41
SHA1 f348eddd5aa94276e4ebceef574588576b63aa46
SHA512 dcb30cb081740f7e85bc908e6710eb9249b655c9c9dcb79c33dd2a59002f3324f634001ae35f5b11a26526298cf064376c94a5aa342a6c37bf1f137201a33eb9
TLSH
T11421AB0553E9471FF0735B316DFA172F9674FD64EFB297AA884002282C01504EEA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lpuf2sax.qbb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpuf2sax.qbb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3znacbcl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3znacbcl\3znacbcl.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

3znacbcl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3znacbcl\3znacbcl.cmdline
Size 369B
SHA256 94af1cada593e4fe7def40fa181604259bd6de7dc6f6420748495067da27445b
MD5 9d6307a26e75334488735e1df6d05b8c
SHA1 01fb9ccc948aa35c8acf7274c4108e2786aa7501
SHA512 e44d9083565d45db7855293efa2fb79fb1dffb9ff99d9919ca596714897d0f8771c2b99bc1319943391085bc88a8658aed335f2e65eb8795b967147412ce7933
TLSH
T1C4E0D83B5257C67D25D919172969CDBC82B2064B2AC17FD851D2C45ED01B008AFD1755
MD5 SHA1 SHA512 TLSH

Submit Download

CSC58393F52B0F44F9487B0E1FD275B725A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3znacbcl\CSC58393F52B0F44F9487B0E1FD275B725A.TMP
Size 652B
SHA256 ef777b9a4653f0ed4ae2b44fc033e39b8c5c2a66bdb5a696704594779166cb2b
MD5 8453743724efe672d62a3822c88f2000
SHA1 1087510cf27f2131d80b0ce1c9215a501ae30b1e
SHA512 8456b78203cec25ba0597852d8950c498f87df4f5d0a4cfc012cac2f333be1b7302cc3dd1bbf413f5b5e3eeeba20837c40ec8aac4754bf2caf75e0631888863c
TLSH
T1A1F0820963F8420EF0F35B30BEF683A395A9BC65DE3293ED5440131D2C64910DA62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-67-0x0000021571680000-0x0000021571688000-memory.dmp

Download

memory/1360-26-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4664-23-0x0000018C2D170000-0x0000018C2D194000-memory.dmp

Download

memory/4664-28-0x0000018C2DAA0000-0x0000018C2DC62000-memory.dmp

Download

memory/4664-14-0x0000018C2CB80000-0x0000018C2CB92000-memory.dmp

Download

memory/4664-15-0x0000018C2CF60000-0x0000018C2CFB0000-memory.dmp

Download

memory/4664-11-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-18-0x0000018C2CF10000-0x0000018C2CF2E000-memory.dmp

Download

memory/4664-19-0x0000018C2CFB0000-0x0000018C2D062000-memory.dmp

Download

memory/4664-20-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-21-0x0000018C2CBA0000-0x0000018C2CBAA000-memory.dmp

Download

memory/4664-22-0x0000018C2D170000-0x0000018C2D19A000-memory.dmp

Download

memory/4664-0-0x00007FFC48A8F000-0x00007FFC48A90000-memory.dmp

Download

memory/4664-24-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-25-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-12-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-27-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-13-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-29-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-30-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-34-0x0000018C2D270000-0x0000018C2D28E000-memory.dmp

Download

memory/4664-35-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-49-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-50-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-10-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-9-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-8-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-7-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-6-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-5-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-3-0x00007FFC48900000-0x00007FFC492A4000-memory.dmp

Download

memory/4664-4-0x0000018C2CB50000-0x0000018C2CB72000-memory.dmp

Download