Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
AutoDivert/daemon.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
AutoDivert/daemon.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
AutoDivert/run_hidden.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
AutoDivert/run_hidden.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
autodivert.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
autodivert.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target AutoDivert/daemon.ps1
- Size 14KB
- Sample261029-wfpg2sey2m
- SHA256 b4a05ab3abcc1cd92c6b4f79bf89e0a4a77e69101faaa8b527132b3d7c98cf7c
- MD5 bffd5fc63da3776b607c9586abcb0ef7
- SHA1 30d0ad936f0e509db5477adfade6df193872c1c9
- SHA512 efcb6eb1384bcc9291a9ae7081dc8def9fba71fa222e007593aab57249622ec0ffb61f92e0c1b694e436bd09e10111702532b9f175a74b1e928e0f10898a7983
- SSDEEP 192:tDUpa4/GNACRM/E5gdWNyw897PFzLbuFTAMybQl1rO/KQq8GKJdiR+8yiQYcmf8Z:tgpaiG1R7xyZxLmkz4ZKJJideiVbWAUR
- TLSH T1BA6287157D95846061C7617EFCDAF0487A356077010CAB4479EC82C8AFAABB8CFF4E99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 1616 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1616 powershell.exe 1616 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1616 powershell.exe Token: SeIncreaseQuotaPrivilege 1616 powershell.exe Token: SeSecurityPrivilege 1616 powershell.exe Token: SeTakeOwnershipPrivilege 1616 powershell.exe Token: SeLoadDriverPrivilege 1616 powershell.exe Token: SeSystemProfilePrivilege 1616 powershell.exe Token: SeSystemtimePrivilege 1616 powershell.exe Token: SeProfSingleProcessPrivilege 1616 powershell.exe Token: SeIncBasePriorityPrivilege 1616 powershell.exe Token: SeCreatePagefilePrivilege 1616 powershell.exe Token: SeBackupPrivilege 1616 powershell.exe Token: SeRestorePrivilege 1616 powershell.exe Token: SeShutdownPrivilege 1616 powershell.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeSystemEnvironmentPrivilege 1616 powershell.exe Token: SeRemoteShutdownPrivilege 1616 powershell.exe Token: SeUndockPrivilege 1616 powershell.exe Token: SeManageVolumePrivilege 1616 powershell.exe Token: 33 1616 powershell.exe Token: 34 1616 powershell.exe Token: 35 1616 powershell.exe Token: 36 1616 powershell.exe Token: SeIncreaseQuotaPrivilege 1616 powershell.exe Token: SeSecurityPrivilege 1616 powershell.exe Token: SeTakeOwnershipPrivilege 1616 powershell.exe Token: SeLoadDriverPrivilege 1616 powershell.exe Token: SeSystemProfilePrivilege 1616 powershell.exe Token: SeSystemtimePrivilege 1616 powershell.exe Token: SeProfSingleProcessPrivilege 1616 powershell.exe Token: SeIncBasePriorityPrivilege 1616 powershell.exe Token: SeCreatePagefilePrivilege 1616 powershell.exe Token: SeBackupPrivilege 1616 powershell.exe Token: SeRestorePrivilege 1616 powershell.exe Token: SeShutdownPrivilege 1616 powershell.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeSystemEnvironmentPrivilege 1616 powershell.exe Token: SeRemoteShutdownPrivilege 1616 powershell.exe Token: SeUndockPrivilege 1616 powershell.exe Token: SeManageVolumePrivilege 1616 powershell.exe Token: 33 1616 powershell.exe Token: 34 1616 powershell.exe Token: 35 1616 powershell.exe Token: 36 1616 powershell.exe Token: SeIncreaseQuotaPrivilege 1616 powershell.exe Token: SeSecurityPrivilege 1616 powershell.exe Token: SeTakeOwnershipPrivilege 1616 powershell.exe Token: SeLoadDriverPrivilege 1616 powershell.exe Token: SeSystemProfilePrivilege 1616 powershell.exe Token: SeSystemtimePrivilege 1616 powershell.exe Token: SeProfSingleProcessPrivilege 1616 powershell.exe Token: SeIncBasePriorityPrivilege 1616 powershell.exe Token: SeCreatePagefilePrivilege 1616 powershell.exe Token: SeBackupPrivilege 1616 powershell.exe Token: SeRestorePrivilege 1616 powershell.exe Token: SeShutdownPrivilege 1616 powershell.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeSystemEnvironmentPrivilege 1616 powershell.exe Token: SeRemoteShutdownPrivilege 1616 powershell.exe Token: SeUndockPrivilege 1616 powershell.exe Token: SeManageVolumePrivilege 1616 powershell.exe Token: 33 1616 powershell.exe Token: 34 1616 powershell.exe Token: 35 1616 powershell.exe Token: 36 1616 powershell.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AutoDivert\blocklist-ips.txt
- Size 305B
- SHA256 deb5cc215380d5d920cc4a2d78e660a6bead9f320151c278db90fc3171e0e82d
- MD5 ea98d4bf50d0b7867008bcbbdcda1aa4
- SHA1 f42072cb5937f7db89c0ab2a5f9e7027396d53b3
- SHA512 3b1c144b8739c419eb19717e1b44f2384240d448d332c4de8e0bf3c132adf1a84af6dd8e48576b9bdf7d766ad0e6b4e389683a3b94db13f1ac63ad3c124536f4
- TLSH T180E0C2381E668EAA30BBE1E3250B31D4F5E03303591209D878AC83845BAEB4B3D80097
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AutoDivert\collector.log
- Size 181B
- SHA256 fed7435df177575670ca218f2a7b68d2beee50540e7e782652ae2b10f96d4b67
- MD5 702fa6030cce81bf942aaa4f09a7620f
- SHA1 0fc70c3c9a6efb794754818ed11b1631beb13af1
- SHA512 9b4bb7a156d8d0ee32521c18d1fd3fac163999af4beb4e00d7ae77b133823e3181bd3b46ec5df1e7f57ccafe4eddd3cee79297685b6c2a4d00a2cd92ba2f2770
- TLSH T1D7C022814AF28828954342CAE314A6021221B026E083A1BC3B14472D1286820F8BA38C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AutoDivert\hosts-history.txt
- Size 146B
- SHA256 a5c28ee34f4af6f6d5fae015a8a7b6da194b00d8a02c4be78efd240571f4a347
- MD5 1cfc21d45136189a738a5216f5553b4b
- SHA1 e922b534fb8e757740c19c5f0dd435230f78a37a
- SHA512 b133b02421c37bdcf39607caa4272177489532ec095bbee944dc6639a03fc6698d35c478ab83d74dd70016a11839d3abae40039be3ad6f13d7e76d348239c74c
- TLSH T18AC02B348C600C0448B4D62C028E930C102870F64AD3C5E18AEDC072BE41349F7D00F8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AutoDivert\hosts-history.txt
- Size 453B
- SHA256 8b87586e272422caf46db90738f50634e71240350de50d8bc0b4b8d9249b559e
- MD5 22c45305723851bd27ae34233f8da2b6
- SHA1 55a2d804b89ae190b8e458af3f0abf454e92347b
- SHA512 4b2803bd019c6bde65c15e4c83b844851484278935c35d03cf22c6cc4c39ce843de04426d49e4697e773b4d088573aada54c3adde4188563cc42dccac27ce356
- TLSH T152F027204418D8124614E06D4266E50D399831B798A3E394EEFEC074AE813BCE5F40B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3glnln0.jyl.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH