20b58ed17ede1b1d679ded4b23400fb2468455ccf927b6fc88ae0955589e92b3

Resubmissions

01/11/2026, 21:39

261101-1hv5tsdt7t10

01/11/2026, 21:29

261101-1cekwsdc9610

Analysis

max time kernel
298s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Simple/Simple.Tests.ps1
Size 384B
Sample261101-1cekwsdc96
SHA256 20b58ed17ede1b1d679ded4b23400fb2468455ccf927b6fc88ae0955589e92b3
MD5 bd5f7018096ec0b8e4b92af92d98cbaf
SHA1 089db48ee781bd035f0bd6d59d0422c0d969eb8b
SHA512 66cb22fed91c0a674c6be826dbc61ef2fac41eafecc653e2b1734abf4bc96ce4b0f35639a5ee477fad9804ba1d64e25e96ad2d8cfd89aa025db5f466e1eaf33d
TLSH
T199E0C04729EA052C87D92316FC932844F43246F75094B404B7FC08484F38FE8C651F58
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4760	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	powershell.exe
4760	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 5080	4760	powershell.exe	85
PID 5080 wrote to memory of 4188	5080	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzkt5s4z\dzkt5s4z.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE579.tmp" "c:\Users\Admin\AppData\Local\Temp\dzkt5s4z\CSC1CF79E0E592B451F85FE9C8093C6DF15.TMP"
    3⤵
    PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESE579.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE579.tmp
Size 1KB
SHA256 3b5360d0227574a6deeea088ee0f0b21a9c5f9e7491815c1b421b485da5d50f1
MD5 2436f537eb90db40ba43dc6e32db97e3
SHA1 5da2d6c4e9622b2efae73a398baaa286dd931514
SHA512 7b542e15e036db9bf329ce9e0e60ac515fcc56f845d0fa93412f8933d9d5d03d2d5a212c13e7d2658842bcc29d2d9881e9bcd2eef133fc951e3a1d278aa4fe43
TLSH
T134219B0593E9471BF0776B31B9F6072BD175FE55AF6157678540022C2C01604EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0zh1t31p.1ry.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0zh1t31p.1ry.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dzkt5s4z.dll

Path C:\Users\Admin\AppData\Local\Temp\dzkt5s4z\dzkt5s4z.dll
Size 3KB
SHA256 be6e8e9c21de068992cb3a03c152b3278b2b8ec3881f54a32216098a38287198
MD5 9b0b39bd4fdaa3a6265da4a66cc52438
SHA1 4184f5928c1e7d110b8c3cd65135c3bdd0071b62
SHA512 a5b7daaf7b90e18271fd1f9219432a744e70cfb549491bcfaaa06c8a11a09fc1178cf88185783b549998d11c8023f9f5a5a27cf057c13ea97c428c5b50454413
TLSH
T16851E00793E40A6BE4B707316AF3071323B5F8109F72539D1D80426C5C54A545E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1CF79E0E592B451F85FE9C8093C6DF15.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dzkt5s4z\CSC1CF79E0E592B451F85FE9C8093C6DF15.TMP
Size 652B
SHA256 3f719a5a7579ca2cfbc0919576ff9a500abae9f1bf783696f8d2f17b1108036c
MD5 0b8ce1a3c33051436abd00c796543a7c
SHA1 696eb2b2d17fa15ab4c471b785400c92e27b84a4
SHA512 66137428ac161807d0313a4ddac5bd040b32903141c2b7cac101d3ae46a7c79aed68f01a7e9c42615666e723c6468c72aa7ed2860412aa6988b11316e2f4402d
TLSH
T14CF03A4963F8020AF0F34B30B9F6836391A9BC64DE3293ED1480031D2C64A14C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dzkt5s4z.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dzkt5s4z\dzkt5s4z.0.cs
Size 907B
SHA256 6d21e15bcaebe4b6461790fbe39381ef6dc736eec19a66e80ee15caf4680fe00
MD5 d98b32865e5bd9376502ce614141b7fa
SHA1 673d622933fbdb9aaafaf847c3cb8f1ce4b18cbc
SHA512 28f4ec12ba6b47af36e288a81de46ce017144416626c50c4266207f92ac5d4b532691e1ee5a3cf54abc0c567e5cd60fb3d3180e8829cdbfab98013d45377ddb0
TLSH
T160118B503083560718B33BB69F43CA48FB3AA03382D81758B94C04A00F70C1BA676F9A
MD5 SHA1 SHA512 TLSH

Submit Download

dzkt5s4z.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dzkt5s4z\dzkt5s4z.cmdline
Size 369B
SHA256 4a8326a8bd8a94ed2454558e1bd3907ea0408946df96b4d6a36c015677b2c7ef
MD5 990934ea01b19f774789c12f7b0d7c07
SHA1 c85b20796f675eaa739f07a698d4ded43c0c0a1e
SHA512 d502fe3697b529a8da368c0c3989f62afe0b74ba252c61e71b9be0c70b995f2dfba2d8b5df2d2193ebfe259be26d0fe5b9b486aa9f1875776357aaa9c1ac199b
TLSH
T1F2E0C03BD347C2FD11DDA00B256BC8ACF272274329403FC45040442DD01F04927D1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4760-11-0x0000017DF3240000-0x0000017DF3264000-memory.dmp

Download

memory/4760-0-0x0000017DD8880000-0x0000017DD8890000-memory.dmp

Download

memory/4760-10-0x0000017DF3240000-0x0000017DF326A000-memory.dmp

Download

memory/4760-2-0x0000017DF2E60000-0x0000017DF2E82000-memory.dmp

Download

memory/4760-1-0x0000017DD8880000-0x0000017DD8890000-memory.dmp

Download

memory/4760-24-0x0000017DF2E50000-0x0000017DF2E58000-memory.dmp

Download

memory/4760-25-0x0000017DD8880000-0x0000017DD8890000-memory.dmp

Download

memory/4760-26-0x0000017DD8880000-0x0000017DD8890000-memory.dmp

Download