2ce7bcf598eb6c6e114a14dfb77d4df4ec12350c9e0c015f0fd270ec5c1ab386

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sanbox.ps1
Size 7KB
Sample261102-af5clsdf68
SHA256 2ce7bcf598eb6c6e114a14dfb77d4df4ec12350c9e0c015f0fd270ec5c1ab386
MD5 a377e5c98891e5fb640a2b90620f5617
SHA1 92307b1279c1d5e0f3fa9e8b822fba0f4f919c7e
SHA512 b11b5c61b63ce22f38cd7013af9e6683f55b4591d5bcc3eb8686aa028b8a3fdbf9d7e075b46cb4ba8c7a7cfdc17044c4dd1b4a31f7bc7e4f3017abf49def69d5
SSDEEP 96:aHactY1jV2xyUHX8P4cpC9WJaEbriNb0rNUQAerxR5N1ocyhTPN83:a6xmyU3YpC4IWQ0pUQAerxR5N1ocATa
TLSH
T1B0F1B6753689419FA073637AA983E14BF796506347C71608B48CC1A26FB2708E714EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4656	PowerShell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	PowerShell.exe
4656	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4656	PowerShell.exe
Token: SeSecurityPrivilege	4656	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4656	PowerShell.exe
Token: SeLoadDriverPrivilege	4656	PowerShell.exe
Token: SeSystemProfilePrivilege	4656	PowerShell.exe
Token: SeSystemtimePrivilege	4656	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4656	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4656	PowerShell.exe
Token: SeCreatePagefilePrivilege	4656	PowerShell.exe
Token: SeBackupPrivilege	4656	PowerShell.exe
Token: SeRestorePrivilege	4656	PowerShell.exe
Token: SeShutdownPrivilege	4656	PowerShell.exe
Token: SeDebugPrivilege	4656	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4656	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4656	PowerShell.exe
Token: SeUndockPrivilege	4656	PowerShell.exe
Token: SeManageVolumePrivilege	4656	PowerShell.exe
Token: 33	4656	PowerShell.exe
Token: 34	4656	PowerShell.exe
Token: 35	4656	PowerShell.exe
Token: 36	4656	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4656	PowerShell.exe
Token: SeSecurityPrivilege	4656	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4656	PowerShell.exe
Token: SeLoadDriverPrivilege	4656	PowerShell.exe
Token: SeSystemProfilePrivilege	4656	PowerShell.exe
Token: SeSystemtimePrivilege	4656	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4656	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4656	PowerShell.exe
Token: SeCreatePagefilePrivilege	4656	PowerShell.exe
Token: SeBackupPrivilege	4656	PowerShell.exe
Token: SeRestorePrivilege	4656	PowerShell.exe
Token: SeShutdownPrivilege	4656	PowerShell.exe
Token: SeDebugPrivilege	4656	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4656	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4656	PowerShell.exe
Token: SeUndockPrivilege	4656	PowerShell.exe
Token: SeManageVolumePrivilege	4656	PowerShell.exe
Token: 33	4656	PowerShell.exe
Token: 34	4656	PowerShell.exe
Token: 35	4656	PowerShell.exe
Token: 36	4656	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4656	PowerShell.exe
Token: SeSecurityPrivilege	4656	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4656	PowerShell.exe
Token: SeLoadDriverPrivilege	4656	PowerShell.exe
Token: SeSystemProfilePrivilege	4656	PowerShell.exe
Token: SeSystemtimePrivilege	4656	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4656	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4656	PowerShell.exe
Token: SeCreatePagefilePrivilege	4656	PowerShell.exe
Token: SeBackupPrivilege	4656	PowerShell.exe
Token: SeRestorePrivilege	4656	PowerShell.exe
Token: SeShutdownPrivilege	4656	PowerShell.exe
Token: SeDebugPrivilege	4656	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4656	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4656	PowerShell.exe
Token: SeUndockPrivilege	4656	PowerShell.exe
Token: SeManageVolumePrivilege	4656	PowerShell.exe
Token: 33	4656	PowerShell.exe
Token: 34	4656	PowerShell.exe
Token: 35	4656	PowerShell.exe
Token: 36	4656	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5716	4656	PowerShell.exe	90
PID 5716 wrote to memory of 4868	5716	csc.exe	91
PID 4656 wrote to memory of 1644	4656	PowerShell.exe	94
PID 1644 wrote to memory of 428	1644	calc.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sanbox.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvyyh1hd\yvyyh1hd.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA956.tmp" "c:\Users\Admin\AppData\Local\Temp\yvyyh1hd\CSCA42656834D0541E5AD4B44AFBE69077.TMP"
    3⤵
    PID:4868
- C:\Windows\system32\calc.exe
  "C:\Windows\system32\calc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA956.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA956.tmp
Size 1KB
SHA256 427629d730fe10f13fc829724a3d3c1e583cedd7ebaa4dc8afee6d1fffce06b2
MD5 7ad2989adff029304d3cd795412794d6
SHA1 e23bdbb565351b28966daf0f26d464298e3cc5b0
SHA512 3543d5b2e68e2aa199626637db4afee132b83be15e7a8b5e139203a46840d8d7ce7ed8d0fc87df7d20dcdcf7ffa4615009d939b85db0308c54196565b62fae3b
TLSH
T151218C0553EC871EF0734731A9F6071F9274FD94DF62675A9541422C2C52544DEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_s2wh4ka1.ybf.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s2wh4ka1.ybf.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

yvyyh1hd.dll

Path C:\Users\Admin\AppData\Local\Temp\yvyyh1hd\yvyyh1hd.dll
Size 3KB
SHA256 e493e603c916b38e310185dc2cfd99b268ae4d57c417f262783e1b3d298f5f4b
MD5 3e2e9bf12062a7edc3d5f95eb91bf393
SHA1 8ba4ba80dc3124ef9ea214596f37c4abfdb55406
SHA512 73dc35f9597bcfdce446edc807dcb48e5df9dc4629ddffceb83e9c2eac515b29d5f7e05bfbca907abe596d1ebac87b66b8c391de3225effcd86b6896005ed96a
TLSH
T16071160BA7E8856FE0BB47316DE343167270F8909B63975F19C4026D7C513642E22BB4
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA42656834D0541E5AD4B44AFBE69077.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yvyyh1hd\CSCA42656834D0541E5AD4B44AFBE69077.TMP
Size 652B
SHA256 3cdd5842615413542b4ef28b3dab62bb13e2f598ac0768e2f85e0bd337f99151
MD5 6ae05d360d56338db45ed2cd2984c526
SHA1 68bb1e484836bc3bf9fcfc82fe72db4088e3e73e
SHA512 948ac4d5d9acf3951f8330f7ce1a90c937e89db7a8bcaa32f3fbde85b6e6d282080d27db1eb8147f2e56d10863738dbdc09c05c2f6ff0fa5660de1795e176fa3
TLSH
T129F0820963FC520EF0F34B30BEF6436791A8BC64DE3293ED1591031D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yvyyh1hd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yvyyh1hd\yvyyh1hd.0.cs
Size 1KB
SHA256 5adeef0e9262b17df93b89444e523d1321ecda1f92643d7f47a94d457c7c7950
MD5 0b0ef2b33d470abefd24ab7f1f13e1cc
SHA1 377fb0a2132a993fdf15c9a5e67630d0b7dc6b22
SHA512 44e83ec57edcb3924b7a653b631020f9e3bfb0fa0bf51ad15054eb19e964858d10db92493620fa7835fafe3fd7b9f8300c65834aeb89f1e69c0c5e83f83e4277
TLSH
T1EA31F32C7551AB261473A2699B43D057E727502312ADEB08B4CE0312AF33804E668EFF
MD5 SHA1 SHA512 TLSH

Submit Download

yvyyh1hd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yvyyh1hd\yvyyh1hd.cmdline
Size 369B
SHA256 89a6f3f1372e4fcb0745dc292dce07da8901feda2f89fe9cf19e9b9ea407462f
MD5 b0b4bdbee60d8e3716c5292778c3cc28
SHA1 921eee1272321d37c7b6fa954de3395a09979a12
SHA512 b26c8261791ac0b69c335084c9abfd59c8348733914eb6a8c12f5aca5a345ee125e26b0f68782529bfb27821ff793fcacf3f40b48a3241af9f17ae03a097df81
TLSH
T124E0C62B4246C27D09EF120B2A6AC8ECFA720B8329883F8C9040C42DE4372002FD2783
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4656-10-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-29-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-0-0x00007FF87934F000-0x00007FF879350000-memory.dmp

Download

memory/4656-11-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-12-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-8-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-7-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-6-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-5-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-24-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-27-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-28-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-3-0x000002102A8E0000-0x000002102A902000-memory.dmp

Download

memory/4656-9-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-26-0x000002102A8C0000-0x000002102A8C8000-memory.dmp

Download

memory/4656-32-0x0000021042FD0000-0x0000021042FEE000-memory.dmp

Download

memory/4656-33-0x00000210432B0000-0x0000021043362000-memory.dmp

Download

memory/4656-34-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-4-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-35-0x0000021042FF0000-0x0000021042FFA000-memory.dmp

Download

memory/4656-37-0x0000021043030000-0x0000021043054000-memory.dmp

Download

memory/4656-36-0x0000021043030000-0x000002104305A000-memory.dmp

Download

memory/4656-38-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-39-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-40-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-41-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-42-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4656-45-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download