1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18

Resubmissions

01/11/2026, 21:39

261101-1hv5tsdt7t10

01/11/2026, 21:29

261101-1cekwsdc9610

Analysis

max time kernel
298s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
Size 759B
Sample261101-1cekwsdc96
SHA256 1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18
MD5 37037611b8d8035a889ff01694e0b5fe
SHA1 36266741b98e8efc5d68761d722bbad75824dc1a
SHA512 a05c8b47429cb7ecc7f79a9ac11474d2b182e9a53fd49d49509a657acb959e7770e877eef3873f2a6dd33ae732bf0ada27e0d2eb16f1233a2b255f47ef3d0477
TLSH
T11F01F21C65E8551E647F6BB7F40B904CFDB749736451A408368D96CC4F32C5D8693EC4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1640	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	powershell.exe
1640	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4588	1640	powershell.exe	86
PID 4588 wrote to memory of 1644	4588	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Comprehensive.Tests.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\scuumrmh\scuumrmh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES991E.tmp" "c:\Users\Admin\AppData\Local\Temp\scuumrmh\CSCF13C696C863B4FFCBC1E12668794C72.TMP"
    3⤵
    PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES991E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES991E.tmp
Size 1KB
SHA256 4c22500806ff4629862f57cd6936e7d96731a4d00d9a64f19158f8a1ba6e2c47
MD5 0b34d330d5097dfa9dfbada66b08d45d
SHA1 3665db6239b5c0c1bb45c0f179f3dd84c43402ef
SHA512 1bd48caadd3d02ae26cbd5450ce1415d07da2b6f99e2df30fb3f994a2e2dc31d263e0e5a37384df6ef0af1b0598432e5d276e976dd7a1f35cb09beb7b386200b
TLSH
T1FD21EE1043FD470BF4735B32BEF61B2BD276FD55EF62535A850002392C42504DEA1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wsayqkc0.1ih.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wsayqkc0.1ih.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

scuumrmh.dll

Path C:\Users\Admin\AppData\Local\Temp\scuumrmh\scuumrmh.dll
Size 3KB
SHA256 20bd53d671e01ab4d5ef1eab4cfc61632c7acc127f9dd51db986dff9b525247e
MD5 bce18aac994eb48d679a63e054ea40ad
SHA1 e8edea127fe57b985ee3146a3c685ad3fd2a4bf6
SHA512 c84d37039476223633fdd2e2d89cb7e65c307542580083a1a46cfa2b25933a828595b27b288a6ab4aec8e8071acc9e33336a6b6cf1ecb34d1ecd4c18b8106537
TLSH
T1C251E01793E8092BE9B70B316EF3072363B6B8109FB253AD1D4042795C646505E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF13C696C863B4FFCBC1E12668794C72.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\scuumrmh\CSCF13C696C863B4FFCBC1E12668794C72.TMP
Size 652B
SHA256 67df4c0f4d7a43b57517f3e1be5de1b6ad2476b19f203df42a3986190543da14
MD5 5564c2c146a75cdd07ed972f955a9b6a
SHA1 9edd25f166d86dcf8c6d4e28a47a179448eaec89
SHA512 15fa9cefc5c61a0a734a5170a996c1e54e7581f51dd243a2fb2df0d7ea87b79ce99399b7af70b13485452db5bdc1e83860616bab992ba73e60b1e25c60003865
TLSH
T161F0540963FC020EF1F34F30BEF543A395AABC66DE7253ED5840031A28645108971F71
MD5 SHA1 SHA512 TLSH

Submit Download

scuumrmh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\scuumrmh\scuumrmh.0.cs
Size 907B
SHA256 6d21e15bcaebe4b6461790fbe39381ef6dc736eec19a66e80ee15caf4680fe00
MD5 d98b32865e5bd9376502ce614141b7fa
SHA1 673d622933fbdb9aaafaf847c3cb8f1ce4b18cbc
SHA512 28f4ec12ba6b47af36e288a81de46ce017144416626c50c4266207f92ac5d4b532691e1ee5a3cf54abc0c567e5cd60fb3d3180e8829cdbfab98013d45377ddb0
TLSH
T160118B503083560718B33BB69F43CA48FB3AA03382D81758B94C04A00F70C1BA676F9A
MD5 SHA1 SHA512 TLSH

Submit Download

scuumrmh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\scuumrmh\scuumrmh.cmdline
Size 369B
SHA256 19af26f0d457d5789b195a3de95f07f6343c22e5c4a2c7627f0e91e03f89a976
MD5 03b037166ba7f1aa9d9ce63025b3b466
SHA1 c07b3ef67fb22aaef7fbb895e4877e5456ea1b46
SHA512 aa9bcb171783dafa6078b26635dbb499ede0615a0207b82b73e404e162da5456f0df0b759c5d5c273e4a7a9079c9b7025ca1d8aa5bb2c984a48984893e4dd2a6
TLSH
T150E0C63A434EC27D09EF100B3AAAC6BCC2B207832D823FC89840840DE03B0032BD3781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1640-1-0x0000015832E50000-0x0000015832E60000-memory.dmp

Download

memory/1640-11-0x000001584B600000-0x000001584B624000-memory.dmp

Download

memory/1640-10-0x000001584B600000-0x000001584B62A000-memory.dmp

Download

memory/1640-7-0x0000015832E20000-0x0000015832E42000-memory.dmp

Download

memory/1640-0-0x0000015832E50000-0x0000015832E60000-memory.dmp

Download

memory/1640-24-0x000001584B5D0000-0x000001584B5D8000-memory.dmp

Download

memory/1640-25-0x0000015832E50000-0x0000015832E60000-memory.dmp

Download

memory/1640-26-0x0000015832E50000-0x0000015832E60000-memory.dmp

Download

memory/1640-29-0x000001584B2B0000-0x000001584B4CC000-memory.dmp

Download