3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e

Analysis

max time kernel
30s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/11/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 8KB
Sample261101-2bs8bsdw4x
SHA256 3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e
MD5 68b370b7555a5453de2ee92b85954f3a
SHA1 973726570fc0ac35e881ff357797f883111e4d48
SHA512 74e141d711fabc660763330f98c37649ecb66eb1ef900af997ae58a3a6c035f67c6beabc720bde1bd9d42508aa42f54ee2885c605cbe2ebbf4d65b6768b83499
SSDEEP 96:9R19rtfRrcpMDQ9XZAT5/I7guG6qe3IEc4u9J9/k1cTHaFIDiSI1oR:99FNcpjF+ec6qe3D6PhkmTH7DC1m
TLSH
T16F025355260259E683B3DE468CF3E61CFBA09077225E594D306C92E6AF39B1BC35C41F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5148	PowerShell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\AI_Training_Home\logs\telemetry.jsonl	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5148	PowerShell.exe
5148	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5148	PowerShell.exe
Token: SeSecurityPrivilege	5148	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5148	PowerShell.exe
Token: SeLoadDriverPrivilege	5148	PowerShell.exe
Token: SeSystemProfilePrivilege	5148	PowerShell.exe
Token: SeSystemtimePrivilege	5148	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5148	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5148	PowerShell.exe
Token: SeCreatePagefilePrivilege	5148	PowerShell.exe
Token: SeBackupPrivilege	5148	PowerShell.exe
Token: SeRestorePrivilege	5148	PowerShell.exe
Token: SeShutdownPrivilege	5148	PowerShell.exe
Token: SeDebugPrivilege	5148	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5148	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5148	PowerShell.exe
Token: SeUndockPrivilege	5148	PowerShell.exe
Token: SeManageVolumePrivilege	5148	PowerShell.exe
Token: 33	5148	PowerShell.exe
Token: 34	5148	PowerShell.exe
Token: 35	5148	PowerShell.exe
Token: 36	5148	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5148	PowerShell.exe
Token: SeSecurityPrivilege	5148	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5148	PowerShell.exe
Token: SeLoadDriverPrivilege	5148	PowerShell.exe
Token: SeSystemProfilePrivilege	5148	PowerShell.exe
Token: SeSystemtimePrivilege	5148	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5148	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5148	PowerShell.exe
Token: SeCreatePagefilePrivilege	5148	PowerShell.exe
Token: SeBackupPrivilege	5148	PowerShell.exe
Token: SeRestorePrivilege	5148	PowerShell.exe
Token: SeShutdownPrivilege	5148	PowerShell.exe
Token: SeDebugPrivilege	5148	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5148	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5148	PowerShell.exe
Token: SeUndockPrivilege	5148	PowerShell.exe
Token: SeManageVolumePrivilege	5148	PowerShell.exe
Token: 33	5148	PowerShell.exe
Token: 34	5148	PowerShell.exe
Token: 35	5148	PowerShell.exe
Token: 36	5148	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 4868	5148	PowerShell.exe	81
PID 4868 wrote to memory of 4908	4868	csc.exe	82
PID 5148 wrote to memory of 5688	5148	PowerShell.exe	85
PID 5688 wrote to memory of 5032	5688	csc.exe	86

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dngoxxrg\dngoxxrg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77CB.tmp" "c:\Users\Admin\AppData\Local\Temp\dngoxxrg\CSCE514993297145E8A086FA27F4E23FA.TMP"
    3⤵
    PID:4908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zsgxekxv\zsgxekxv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80D3.tmp" "c:\Users\Admin\AppData\Local\Temp\zsgxekxv\CSC60647849393142099DE72650FBD3D555.TMP"
    3⤵
    PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES77CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES77CB.tmp
Size 1KB
SHA256 96b97f520563b2030dcc79486009ac36c0c0c16204fb69751f59ef855eacb2a9
MD5 57f640a6a34694cdd181c0116a12af99
SHA1 408d3c1ebb0998b10d31dddd2d057352bafa1ae7
SHA512 01648962e5546ea273c52d656ed12a406c47279fb05eae5c5915e90aff36703b12667bd1fdc2d868e69710818c41527b68fca887fe0e75d3847f3015089a30e4
TLSH
T16021AB0583E9470FF077573269F6172BA274FD58EFA2975B854052282C62504EFA1F73
MD5 SHA1 SHA512 TLSH

Submit Download

RES80D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES80D3.tmp
Size 1KB
SHA256 0de4ed61217f0d91eaf9c46fd9d78922ea0c8c5d5c6656e00dd1b311bd710754
MD5 a12cb77bdda01630b4f7d22b5abb9444
SHA1 258fe5dc609b4b92942189feb0269245c747cc76
SHA512 3cf084aff7dccc48d09c66575d3d4e0a64d6524f0f3c0f7bd3ee0fb44208d71d0c4fcb0351140b726ba009180a482518eec0fddee5ccbf6b32e39175dddfd554
TLSH
T1F521C20497E9471EF0B3573269F9072F9278FD94EF61635F858052281C92544EEF1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_svikyh5s.zsy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_svikyh5s.zsy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dngoxxrg.dll

Path C:\Users\Admin\AppData\Local\Temp\dngoxxrg\dngoxxrg.dll
Size 3KB
SHA256 139716147e5fc9a777dc70d0b873590078b9a39b4133f811b0043f93b347a278
MD5 b6b800cc3af9fffc40cf399de336e2c3
SHA1 382b8086492ef5dbc4017e87d177e3ce8783295c
SHA512 e6cd641a3c5fe5952a0dfe9a28d7fd1c571fb3918fef60926c060205862370f616f2e8a4a117fdb06205482f12ed95ff9e027a3f022426ac07959793b89e90c6
TLSH
T1D951DD0A57E84A6BF4770735ADF3072637B8FC509B73571D48804219ACA63645E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

zsgxekxv.dll

Path C:\Users\Admin\AppData\Local\Temp\zsgxekxv\zsgxekxv.dll
Size 3KB
SHA256 6465dc91997eec392e317a16cc9a759de35e07978c9c1a12e9945fe1e95a8ffb
MD5 3a8d94ff95a587c671ac87d90d0afd3f
SHA1 c1b7acc8daffffbff2490a843894276615cb5efe
SHA512 f76befa6bcefd584dca6725e0fc3d08a3f48c22516e34e84ce3620d62acd00330e4d9dc47cca3c2511bca358f07ec17d50a2adad52ede295709f88a78e2dce36
TLSH
T12B711102E7E84667F47B4B386EF743573770F9549A67932E1AA00218BCA23604E71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE514993297145E8A086FA27F4E23FA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dngoxxrg\CSCE514993297145E8A086FA27F4E23FA.TMP
Size 652B
SHA256 1281cc120ae37dbff94e662196d64cdaf712d5aeece3cfa99013c0cc40f7c3cd
MD5 92c62ea201f1abdfbcea2856bd750826
SHA1 2f29e1d294a65dcf8366cf8cac46fb7fce6c6b5c
SHA512 124d942b8851da7f075e61d085b7b34538e4bc2e3adc5c3e263f865c4cd67b337c8d2abcd487fdf10bea0a4e87deeeae739d466019f05f7c217c169ad1854471
TLSH
T1CAF05E0967F8020EF0F74B31BDF64363A1A9FC64DE7293ED144013192C656148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dngoxxrg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dngoxxrg\dngoxxrg.0.cs
Size 294B
SHA256 b5d0fcca86ff4449f03ef8624dacc40ad5f1e6b900c2ca519772f93dc3694181
MD5 748010e752204505825732ffcf45a986
SHA1 3eaa66dedc30d61218c5aa99a39dcb98c0d0a549
SHA512 d4ac75d73e0bb52c8b76909601cc61653049bfec7d2916a8324d2881677b5b60a4eb33d69d3945f9b02e8d37a15b8b91e868ce16fd173701f8452d188e12650b
TLSH
T1D3E0C2186AA39AF08423891A4C8BE5FDB61BA43622792900BAE50321EF5B00A5139A59
MD5 SHA1 SHA512 TLSH

Submit Download

dngoxxrg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dngoxxrg\dngoxxrg.cmdline
Size 369B
SHA256 b7798b42b1f63d3d9a4f2429d9cf8cd2b0982c98bd789ba40abb9f05a8d84b6a
MD5 6403320e3e6ba261c2026cfc56d8c405
SHA1 1dcdade0673e9e3ad0dd5c133b0bf87a3ead66a9
SHA512 434a393dfd213af8257c8735141db5b61798b9fb81bb7fb7d600c5412b9f067a04b0e4979cf61c4ac95e56a5c08534f845b7270639d404793a799d209fe4e166
TLSH
T1B6E06F2F4286C67D02F9100B236ECAAC8F720B8329803F849044845DE13B0402BD3F8A
MD5 SHA1 SHA512 TLSH

Submit Download

CSC60647849393142099DE72650FBD3D555.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zsgxekxv\CSC60647849393142099DE72650FBD3D555.TMP
Size 652B
SHA256 1fa68d241c9277036f67fea3ffe0fe9e5c6d10ac2a41fa9b924a58fdb7087b86
MD5 49cb4304bca8c4cdbc775697403544a4
SHA1 7380f2f09da469c24084fc7421cf0f376e00a9e5
SHA512 aa09323b044a3a1d6d1afaebcd0288e4242affb4a39f977fb58365770eb0b6ec321f2fe913e17aaf96414f60d9682c58274d060053be280fd1a6b3bb592b0d70
TLSH
T184F05E0967F8020EF0F34B34BEF6836795A8BCA4DE32A3ED148003292865510D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zsgxekxv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zsgxekxv\zsgxekxv.0.cs
Size 616B
SHA256 dffb65c7f9467b927a5d08eacce3cbdd373c8d7e8fc48e9b38b555124d6c1c5d
MD5 d7675460728df6de8e54d9b09acec342
SHA1 be91a4122f76b6e94878dd43ca18f4d33da6241d
SHA512 ad984ae56a13dd8e600e951ebe1c3aa8ce187b2bae54423486b869d5e073fb47b6c3786a5f353794e8ef7dc9b11ed6e41745ae48509545537a2c41a07a03c162
TLSH
T1FDF0F95456428561C8F2D71D5578D9D6F136E1A923E9A707727D07E0DF6F008427053F
MD5 SHA1 SHA512 TLSH

Submit Download

zsgxekxv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zsgxekxv\zsgxekxv.cmdline
Size 369B
SHA256 901f5fc232c0f05d1d2ff22f3afd308f68dc76f9f34a49424534f49cec42ff31
MD5 63750c9d79db64c4d6ed0e24cdb2ffbe
SHA1 5dd32bbc18739c6adee8591f4b681332c10ed179
SHA512 23d3a27ca65cff6ce69dbe47c122ac09ed908cc2d2fa0d73f62f6fe390e4e1cc495f691177a8304490e6dc3e13f5133af3260ffb1206aa8d6e8fc1859306c881
TLSH
T171E068BA4246C3BD06D9100722BDC8BCC2B2064729C43F88A840440ED91710037E1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5148-45-0x000001D97DDB0000-0x000001D97DDBA000-memory.dmp

Download

memory/5148-43-0x000001D97DDC0000-0x000001D97DDDC000-memory.dmp

Download

memory/5148-31-0x000001D97DBE0000-0x000001D97DC93000-memory.dmp

Download

memory/5148-32-0x000001D97DCA0000-0x000001D97DCAA000-memory.dmp

Download

memory/5148-33-0x000001D97DCE0000-0x000001D97DD0A000-memory.dmp

Download

memory/5148-34-0x000001D97DCE0000-0x000001D97DD04000-memory.dmp

Download

memory/5148-35-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-22-0x000001D97D970000-0x000001D97D978000-memory.dmp

Download

memory/5148-23-0x00007FF418E80000-0x00007FF418E90000-memory.dmp

Download

memory/5148-44-0x000001D97DDA0000-0x000001D97DDAA000-memory.dmp

Download

memory/5148-30-0x000001D97DBC0000-0x000001D97DBDC000-memory.dmp

Download

memory/5148-9-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-36-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-1-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-8-0x000001D97B6C0000-0x000001D97B6E2000-memory.dmp

Download

memory/5148-0-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-58-0x000001D97DB90000-0x000001D97DB98000-memory.dmp

Download

memory/5148-60-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-59-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-61-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-62-0x00007FF418E80000-0x00007FF418E90000-memory.dmp

Download

memory/5148-63-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download

memory/5148-64-0x000001D97B700000-0x000001D97B710000-memory.dmp

Download