Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
sanbox.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
sanbox.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target sanbox.ps1
- Size 7KB
- Sample261102-af5clsdf68
- SHA256 2ce7bcf598eb6c6e114a14dfb77d4df4ec12350c9e0c015f0fd270ec5c1ab386
- MD5 a377e5c98891e5fb640a2b90620f5617
- SHA1 92307b1279c1d5e0f3fa9e8b822fba0f4f919c7e
- SHA512 b11b5c61b63ce22f38cd7013af9e6683f55b4591d5bcc3eb8686aa028b8a3fdbf9d7e075b46cb4ba8c7a7cfdc17044c4dd1b4a31f7bc7e4f3017abf49def69d5
- SSDEEP 96:aHactY1jV2xyUHX8P4cpC9WJaEbriNb0rNUQAerxR5N1ocyhTPN83:a6xmyU3YpC4IWQ0pUQAerxR5N1ocATa
- TLSH T1B0F1B6753689419FA073637AA983E14BF796506347C71608B48CC1A26FB2708E714EAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 4560 powershell.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings calc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4560 powershell.exe 4560 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4560 powershell.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemProfilePrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeProfSingleProcessPrivilege 4560 powershell.exe Token: SeIncBasePriorityPrivilege 4560 powershell.exe Token: SeCreatePagefilePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe Token: SeRestorePrivilege 4560 powershell.exe Token: SeShutdownPrivilege 4560 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeSystemEnvironmentPrivilege 4560 powershell.exe Token: SeRemoteShutdownPrivilege 4560 powershell.exe Token: SeUndockPrivilege 4560 powershell.exe Token: SeManageVolumePrivilege 4560 powershell.exe Token: 33 4560 powershell.exe Token: 34 4560 powershell.exe Token: 35 4560 powershell.exe Token: 36 4560 powershell.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemProfilePrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeProfSingleProcessPrivilege 4560 powershell.exe Token: SeIncBasePriorityPrivilege 4560 powershell.exe Token: SeCreatePagefilePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe Token: SeRestorePrivilege 4560 powershell.exe Token: SeShutdownPrivilege 4560 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeSystemEnvironmentPrivilege 4560 powershell.exe Token: SeRemoteShutdownPrivilege 4560 powershell.exe Token: SeUndockPrivilege 4560 powershell.exe Token: SeManageVolumePrivilege 4560 powershell.exe Token: 33 4560 powershell.exe Token: 34 4560 powershell.exe Token: 35 4560 powershell.exe Token: 36 4560 powershell.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemProfilePrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeProfSingleProcessPrivilege 4560 powershell.exe Token: SeIncBasePriorityPrivilege 4560 powershell.exe Token: SeCreatePagefilePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe Token: SeRestorePrivilege 4560 powershell.exe Token: SeShutdownPrivilege 4560 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeSystemEnvironmentPrivilege 4560 powershell.exe Token: SeRemoteShutdownPrivilege 4560 powershell.exe Token: SeUndockPrivilege 4560 powershell.exe Token: SeManageVolumePrivilege 4560 powershell.exe Token: 33 4560 powershell.exe Token: 34 4560 powershell.exe Token: 35 4560 powershell.exe Token: 36 4560 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 216 OpenWith.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4560 wrote to memory of 732 4560 powershell.exe 87 PID 732 wrote to memory of 3104 732 csc.exe 88 PID 4560 wrote to memory of 3680 4560 powershell.exe 95
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sanbox.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0sbv5wvk\0sbv5wvk.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC84C.tmp" "c:\Users\Admin\AppData\Local\Temp\0sbv5wvk\CSC9F0777D1A8AB46B586D2CD9E7392FE0.TMP"3⤵PID:3104
-
-
-
C:\Windows\system32\calc.exe"C:\Windows\system32\calc.exe"2⤵
- Modifies registry class
PID:3680
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0sbv5wvk\0sbv5wvk.dll
- Size 3KB
- SHA256 64d3319c9e0c752b215b3f87f13992a67a0c53f25c423f7e25e490039a8ec03e
- MD5 c0fd8c47ae2c371e86962632a44fc989
- SHA1 819c999922dc11fc35dd6d894c839c70f67792db
- SHA512 1cd67f6c4bb8f7632d41066d74c33d52fab861deb191bddcb8ec1a16ff59eaa7e65d2022eaec5188ed23424bc69b61947d58b2337aec62863fd4c062f18b4909
- TLSH T14071365AE3E4856FE0BB47705DE313167274F890DB63935F19C002697C603A42D27BB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RESC84C.tmp
- Size 1KB
- SHA256 e9d65682142c864650e8978e9ce24464cba6c5094bb0d774a0fb971fb9c3df0b
- MD5 b77468363976e9340654d4ed50195749
- SHA1 1965646728d5ab4d450897e5ab89952884e139ce
- SHA512 93698cbced6b8b21a948ef77947def9ca4b6293daf2721afdcb086f39f854f7dbb8d2cf4d8068c0b60540a16d26e43705b5740acb6d11b8f63f1f34cab02fa6d
- TLSH T13821AB4593F9470AF0730731A9FA172FE278FD94EFA2639B8440522C2C51544EEE1B72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ej2nbcb.ta5.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\0sbv5wvk\0sbv5wvk.0.cs
- Size 1KB
- SHA256 5adeef0e9262b17df93b89444e523d1321ecda1f92643d7f47a94d457c7c7950
- MD5 0b0ef2b33d470abefd24ab7f1f13e1cc
- SHA1 377fb0a2132a993fdf15c9a5e67630d0b7dc6b22
- SHA512 44e83ec57edcb3924b7a653b631020f9e3bfb0fa0bf51ad15054eb19e964858d10db92493620fa7835fafe3fd7b9f8300c65834aeb89f1e69c0c5e83f83e4277
- TLSH T1EA31F32C7551AB261473A2699B43D057E727502312ADEB08B4CE0312AF33804E668EFF
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\0sbv5wvk\0sbv5wvk.cmdline
- Size 369B
- SHA256 9dab8fbc2ce9502f67cea26a817210a19480d7f9c8b030ef2f5ef947547228ab
- MD5 bdad8ffda879562182bf0c49b07d8508
- SHA1 9a5fe11dc34af01314313c7b8ca635756b7164f0
- SHA512 f0af4a0e74c6d595907e787a82444352f1a199a957a0f4a29a0b71a09eea25f8bc3bc0e3d857f80d725b0da1357421cbe230dc0882d38babbf7c657e3fa7afe2
- TLSH T12FE0C62E9386C27D01ED104F226AC6BCC3FA078379883F889040A40DE037880ABE2782
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\0sbv5wvk\CSC9F0777D1A8AB46B586D2CD9E7392FE0.TMP
- Size 652B
- SHA256 aabf6a70f4afd6fd018e426b96250bcbb8eefa0c4ef0bbe298e2389d7b492067
- MD5 fc9b35f1259ee96ba4d89d508b437eb8
- SHA1 f2bc6157088cbb6ba9b7d4a507359b8554aaf8b5
- SHA512 d88c134ff48a99035805e55a8e7105d6edbb2555959f25c8aedbda894f790f783ec85d41b32045b0d023e02df6c4c85a6b8304d3e9000aeeb3426519cb46be1b
- TLSH T169F0544A63F8420EF0F34B30BDF543A391A8BCA4DE3253ED144003195864510D5B2F75
- MD5 SHA1 SHA512 TLSH