be2cfd3368b2ec500ed6244f1df7b9da4835486f38171dcd58c400af50f6ae30

Analysis

max time kernel
150s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/set-lnk-aumid.ps1
Size 5KB
Sample261029-zar8jaex2x
SHA256 be2cfd3368b2ec500ed6244f1df7b9da4835486f38171dcd58c400af50f6ae30
MD5 4e7cb7c787a4c0c7c343904c85f0015e
SHA1 b9b6645b92a4692afe6422286ad452d6bb00a3c7
SHA512 57c0d995c340789fe7ca4de453f9210835da6ce5dabbf204faededc604d9c8803b217d7a63dfbc2a81b690c1dcc3be46f25cb1d34a135c97b13a5a0486ea5cce
SSDEEP 96:M/B4zNbkmS9C7Kyb5jz665LJHDviYiVzL4uO4doiFRn4UNntxGaF4tvZDic0D:++N8C7Kyd1lWYiVzLROePRn4U7aDDics
TLSH
T108C109026301107DC1531229DB6E7D98EA07E0730AA7F804BC6DA3EC9F1A76D9134BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4332	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4332	PowerShell.exe
4332	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	PowerShell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4140	4332	PowerShell.exe	83

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\set-lnk-aumid.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\32ouajku\32ouajku.cmdline"
  2⤵
  PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_b2qujhnk.mx3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b2qujhnk.mx3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

32ouajku.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\32ouajku\32ouajku.0.cs
Size 2KB
SHA256 8c78545ed970a7b247ffc95f14052c8e56f7b1f06781be90e93178f2f672465f
MD5 140267fdfaa37a159136a5bdcdf391fb
SHA1 96d7c06495874352a996176ac57e6461f6984bcf
SHA512 d58075ccc6090093308ad85f9774ae0b9aa3342aa052f2bb739397357534650ce73022865cc01d69039b2786fa52d15703d47ce37fbf360c9ba4bdc6914dc90e
TLSH
T12D5175022306142DC867512DEF7E7C60A543F4731BF6E4447D5EA6F88FAA1ACE1707A8
MD5 SHA1 SHA512 TLSH

Submit Download

32ouajku.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\32ouajku\32ouajku.cmdline
Size 369B
SHA256 822087c97c96da4fe4c62627a39950cb95a0d1550b34e863e70cfcdf9b2fff2a
MD5 d0b927f23d3aca189b413795ee4a6b19
SHA1 3e7ff4f77da738406495accbde933b6e86c39b89
SHA512 bc5ab8d65d35abe55ae74031eb6ad5aa0be5bd7e04a823fe8ae645f0fa2e54e8f29821b6b4e8c913dd165583e48ec98f8a9429ea08b90387961d999e4afa4105
TLSH
T1C8E0C02F8647C37D02DD100B27A9E7ACC2BB0F4B29933F885540C40DD01780027D1759
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4140-16-0x00000258A3E60000-0x00000258A4922000-memory.dmp

Download

memory/4332-0-0x00000146DE83A000-0x00000146DE83B000-memory.dmp

Download

memory/4332-7-0x00000146F92D0000-0x00000146F92F2000-memory.dmp

Download

memory/4332-8-0x00000146DE070000-0x00000146DEB32000-memory.dmp

Download

memory/4332-9-0x00000146DE070000-0x00000146DEB32000-memory.dmp

Download

memory/4332-10-0x00000146DE070000-0x00000146DEB32000-memory.dmp

Download

memory/4332-21-0x00000146DE070000-0x00000146DEB32000-memory.dmp

Download