3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 8KB
Sample261101-2bs8bsdw4x
SHA256 3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e
MD5 68b370b7555a5453de2ee92b85954f3a
SHA1 973726570fc0ac35e881ff357797f883111e4d48
SHA512 74e141d711fabc660763330f98c37649ecb66eb1ef900af997ae58a3a6c035f67c6beabc720bde1bd9d42508aa42f54ee2885c605cbe2ebbf4d65b6768b83499
SSDEEP 96:9R19rtfRrcpMDQ9XZAT5/I7guG6qe3IEc4u9J9/k1cTHaFIDiSI1oR:99FNcpjF+ec6qe3D6PhkmTH7DC1m
TLSH
T16F025355260259E683B3DE468CF3E61CFBA09077225E594D306C92E6AF39B1BC35C41F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4188	PowerShell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\AI_Training_Home\logs\telemetry.jsonl	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4188	PowerShell.exe
4188	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4188	PowerShell.exe
Token: SeSecurityPrivilege	4188	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4188	PowerShell.exe
Token: SeLoadDriverPrivilege	4188	PowerShell.exe
Token: SeSystemProfilePrivilege	4188	PowerShell.exe
Token: SeSystemtimePrivilege	4188	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4188	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4188	PowerShell.exe
Token: SeCreatePagefilePrivilege	4188	PowerShell.exe
Token: SeBackupPrivilege	4188	PowerShell.exe
Token: SeRestorePrivilege	4188	PowerShell.exe
Token: SeShutdownPrivilege	4188	PowerShell.exe
Token: SeDebugPrivilege	4188	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4188	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4188	PowerShell.exe
Token: SeUndockPrivilege	4188	PowerShell.exe
Token: SeManageVolumePrivilege	4188	PowerShell.exe
Token: 33	4188	PowerShell.exe
Token: 34	4188	PowerShell.exe
Token: 35	4188	PowerShell.exe
Token: 36	4188	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4188	PowerShell.exe
Token: SeSecurityPrivilege	4188	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4188	PowerShell.exe
Token: SeLoadDriverPrivilege	4188	PowerShell.exe
Token: SeSystemProfilePrivilege	4188	PowerShell.exe
Token: SeSystemtimePrivilege	4188	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4188	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4188	PowerShell.exe
Token: SeCreatePagefilePrivilege	4188	PowerShell.exe
Token: SeBackupPrivilege	4188	PowerShell.exe
Token: SeRestorePrivilege	4188	PowerShell.exe
Token: SeShutdownPrivilege	4188	PowerShell.exe
Token: SeDebugPrivilege	4188	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4188	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4188	PowerShell.exe
Token: SeUndockPrivilege	4188	PowerShell.exe
Token: SeManageVolumePrivilege	4188	PowerShell.exe
Token: 33	4188	PowerShell.exe
Token: 34	4188	PowerShell.exe
Token: 35	4188	PowerShell.exe
Token: 36	4188	PowerShell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
748	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4508	4188	PowerShell.exe	90
PID 4508 wrote to memory of 1492	4508	csc.exe	91
PID 4188 wrote to memory of 5560	4188	PowerShell.exe	94
PID 5560 wrote to memory of 5588	5560	csc.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mye4xnhe\mye4xnhe.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCDE.tmp" "c:\Users\Admin\AppData\Local\Temp\mye4xnhe\CSCD72CAF8E21E34CA3AA4116883951241.TMP"
    3⤵
    PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\31kxfhgo\31kxfhgo.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1FC.tmp" "c:\Users\Admin\AppData\Local\Temp\31kxfhgo\CSCA8D6E21B4244310ABA4589D743A1FDA.TMP"
    3⤵
    PID:5588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31kxfhgo.dll

Path C:\Users\Admin\AppData\Local\Temp\31kxfhgo\31kxfhgo.dll
Size 3KB
SHA256 70e1cefb2243c229b7966653ffc27c62926dbcf2e828cb0b3f2b2c6e4d044450
MD5 d245724c37b4424801bde3766474c9a4
SHA1 3a66d02836f35220bf6b2f2366204fc088f0aa37
SHA512 4518954336fb0473fe6a454fdc27864b1b2e1efdd75a5b823b2501341534cbaeabc715fd2edc07e7873574feb8c97bfc1937cb6ce239585cf8dbdc21a471e345
TLSH
T154711302E3E84627F47B0B346AF743277774F8549F63976E169002586C913204A31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESDCDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDCDE.tmp
Size 1KB
SHA256 8ee6f76753cef7c7089fa416511697b22099654c8a010c9d9871eaeb8494868c
MD5 6eaf8d51190e4bb61dc8d2d76357912e
SHA1 2fb41271862191c5b7d9bcd3e012c8ea82a48a23
SHA512 91cb473fab41eaa08d1b5dc613cc8630759225073114aeb20825c2e0e690db089b661d4e9b6bc243dcada7fadbc2841af6e158579143741f24dfd82d4b5fb02a
TLSH
T1EF218C0593ED471FF07347326DF6172F96B4FD69DFB1A36A854002282C51504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESF1FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF1FC.tmp
Size 1KB
SHA256 0bda8b10068ae242854fd2d4ba55962d3a9f7afd9c9d6a53c0791ef9776718bd
MD5 5edb998aff6d2e3d8964a5e60ce518a0
SHA1 45b446167ee1a44757c8dd14e85237c471783643
SHA512 16bdbeb3ba197b149e0a505f1282709407b35e6327dc4c6941164309f386435ed87ab14b46f1955509bd0b02d15a4b35b5739524b9faeab6d85aa1e28617ec64
TLSH
T1C021EF0993F9472EF0B3073169F6472F9678FD68EFA2936A9540426C1C41100EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y3omjicn.mkn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3omjicn.mkn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mye4xnhe.dll

Path C:\Users\Admin\AppData\Local\Temp\mye4xnhe\mye4xnhe.dll
Size 3KB
SHA256 8bb3e1da816710c1ab78b6a4d43f2155ba8d221623d55b6cd6aed1c2913e1ffd
MD5 b53dd94365e5c5789524b309a3281dc7
SHA1 2326ac438bfa0182b52cc46dfcd4434e8520f488
SHA512 52369a6ad3938460469b863894aa80961ff2da63eeb275d136b28b4664c7acf00dee264d3493837d0919760e14dae232bfc10e9da0dc8a01195fcbc9dafe82c0
TLSH
T18851DD1657E9466BE4770730ADF307167BB8FC549B33572E4880421CAC657645E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

31kxfhgo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\31kxfhgo\31kxfhgo.0.cs
Size 616B
SHA256 dffb65c7f9467b927a5d08eacce3cbdd373c8d7e8fc48e9b38b555124d6c1c5d
MD5 d7675460728df6de8e54d9b09acec342
SHA1 be91a4122f76b6e94878dd43ca18f4d33da6241d
SHA512 ad984ae56a13dd8e600e951ebe1c3aa8ce187b2bae54423486b869d5e073fb47b6c3786a5f353794e8ef7dc9b11ed6e41745ae48509545537a2c41a07a03c162
TLSH
T1FDF0F95456428561C8F2D71D5578D9D6F136E1A923E9A707727D07E0DF6F008427053F
MD5 SHA1 SHA512 TLSH

Submit Download

31kxfhgo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\31kxfhgo\31kxfhgo.cmdline
Size 369B
SHA256 fdc665afaaac228d05d784e95ebd82dc717dd7c286d011755154e6385cdf4d4a
MD5 0ac09a7bc2b9a652f35f2a6b90175f02
SHA1 9b338caaa549610822b8026b3d529812bb7dc6cf
SHA512 34644dfc9780f5dd781c69b013c7d90a4541e4440fea6ad75bbe794b4bcc9dfa3d289660a54e125500a299b3865d1ba2c0fb97859b6d292e01bed6717c601130
TLSH
T199E0C02B6247C27DA1DD100B2169C4BCC2B6474B6D403F8472804C0DD01700027F1781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA8D6E21B4244310ABA4589D743A1FDA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\31kxfhgo\CSCA8D6E21B4244310ABA4589D743A1FDA.TMP
Size 652B
SHA256 db8da694dc1b69b0e851fa34278ad33c1b7afffb85c21228cf06c255f725c33d
MD5 c3c2100f6d86abc9bced9f76ef000daf
SHA1 e525eaa1b785440ad9728abe809e74993eec1a02
SHA512 45e8cbe0a48b3a5bf8143a4887c4f4f9df4612cb5c182d3ccce3ca7512135c02b921f80a29be5c548aa7cab9ed4b8512f5a9e74126ca1d8ddd61182732467de0
TLSH
T11EF05E0963F8420EF0F34B30BEF6836395B8BC69DF3293ED5540035928645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD72CAF8E21E34CA3AA4116883951241.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mye4xnhe\CSCD72CAF8E21E34CA3AA4116883951241.TMP
Size 652B
SHA256 97de627959b55785039386952e77c771effe21c48e198e3390389af71c4f9629
MD5 1760bd29af88eb848bde73f320cbf0f0
SHA1 e18ddacfb2b21fb80097fb9a68571d28028bc04b
SHA512 f1894039b8a52453513efb8177544c291aae7fc344d3711a7b7b59a828970ec9f30ef6f1b30b65671d33b7893279a1222c4ddc024f510ac73ec3742650f0ba21
TLSH
T188F05E0963FC120EF4F34B30BDF6436399A8BC69DE3293ED1440031928645108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mye4xnhe.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mye4xnhe\mye4xnhe.0.cs
Size 294B
SHA256 b5d0fcca86ff4449f03ef8624dacc40ad5f1e6b900c2ca519772f93dc3694181
MD5 748010e752204505825732ffcf45a986
SHA1 3eaa66dedc30d61218c5aa99a39dcb98c0d0a549
SHA512 d4ac75d73e0bb52c8b76909601cc61653049bfec7d2916a8324d2881677b5b60a4eb33d69d3945f9b02e8d37a15b8b91e868ce16fd173701f8452d188e12650b
TLSH
T1D3E0C2186AA39AF08423891A4C8BE5FDB61BA43622792900BAE50321EF5B00A5139A59
MD5 SHA1 SHA512 TLSH

Submit Download

mye4xnhe.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mye4xnhe\mye4xnhe.cmdline
Size 369B
SHA256 7bf9450113eaed1c7c8b0a542d9d25a6ef7e58cf08d4c45d0a42f964b2fac634
MD5 f82c2cdb62da88b10e6e74fb7d6b29ca
SHA1 92e5b7de1cb3a836db0e29cc5556b9818e2f3eb0
SHA512 0ad8e1304de830f136ae13091e03ec67d1f61cca0f7a80ffdeb9006f273d84fed82734c2420fec1292fed44fd2828343b940b73df05553eb46da728c7d6f9b11
TLSH
T163E0C02E6697C37D81DD102769A9C4ACC372078369447FCE5051840FD05704827D27C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-72-0x000001EF6C960000-0x000001EF6CBBF000-memory.dmp

Download

memory/748-83-0x000001EF6C960000-0x000001EF6CBBF000-memory.dmp

Download

memory/4188-38-0x000002C6732E0000-0x000002C673392000-memory.dmp

Download

memory/4188-52-0x000002C6732D0000-0x000002C6732DA000-memory.dmp

Download

memory/4188-18-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-29-0x000002C673280000-0x000002C673288000-memory.dmp

Download

memory/4188-14-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-30-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-37-0x000002C6732C0000-0x000002C6732DE000-memory.dmp

Download

memory/4188-0-0x00007FF95F5DF000-0x00007FF95F5E0000-memory.dmp

Download

memory/4188-39-0x000002C6733A0000-0x000002C6733AA000-memory.dmp

Download

memory/4188-41-0x000002C6733E0000-0x000002C673404000-memory.dmp

Download

memory/4188-40-0x000002C6733E0000-0x000002C67340A000-memory.dmp

Download

memory/4188-42-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-49-0x000002C6733A0000-0x000002C6733BE000-memory.dmp

Download

memory/4188-50-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-51-0x000002C6732C0000-0x000002C6732CA000-memory.dmp

Download

memory/4188-21-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-53-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-54-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-55-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-13-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-12-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-10-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-11-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-68-0x000002C6733A0000-0x000002C6733A8000-memory.dmp

Download

memory/4188-9-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-70-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-71-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download

memory/4188-6-0x000002C6729F0000-0x000002C672A12000-memory.dmp

Download

memory/4188-7-0x00007FF95F450000-0x00007FF95FDF4000-memory.dmp

Download