944bfe82b949fcb067d4aa0463af94a13cfd7c97dfdd8ae8d9ff5ebcebaa22f2

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
944bfe82b949fcb0.ps1
Size 4KB
Sample261113-b1w3eaev71
SHA256 944bfe82b949fcb067d4aa0463af94a13cfd7c97dfdd8ae8d9ff5ebcebaa22f2
MD5 f208c8afb9b34f05ea38c406659bb6f0
SHA1 37fce4d43c2a5a6989376aec0f464e2ea048d984
SHA512 37f4b2b59676a345ff22fd4ff368baa9cb2e6528eeb667db5e23066e1908bb08ada302dde5bb9f0b2c907d0284c5534affd77e74023b34d2d1833d381aae4fdd
SSDEEP 96:Pm2c+RZ2rDum2GGErLqalNJ7DK+B2JG+E7Reakj0FstAhF6B+pzmUgn:Pc+R0rDuDErxf7DK+84R9FFob2zmt
TLSH
T11B813590FE48E4D1896759F7FC6A3E56D23812B1DCCA26C80398B2D927B7B359718CC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	916	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	4992	Process not Found

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	ChromeSetup91.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ChromeSetup91.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4492	PowerShell.exe
916	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4492	PowerShell.exe
4492	PowerShell.exe
916	powershell.exe
916	powershell.exe
916	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	PowerShell.exe
Token: SeDebugPrivilege	916	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 916	4492	PowerShell.exe	90
PID 916 wrote to memory of 2948	916	powershell.exe	92
PID 2948 wrote to memory of 1988	2948	csc.exe	93
PID 916 wrote to memory of 5612	916	powershell.exe	96
PID 916 wrote to memory of 2280	916	powershell.exe	97

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	14	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\944bfe82b949fcb0.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\Downloads\1531642463exe.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cysdy5tk\cysdy5tk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D32.tmp" "c:\Users\Admin\AppData\Local\Temp\cysdy5tk\CSC652938382EC14CA980192361E8C85D9.TMP"
      4⤵
      PID:1988
- - C:\Users\Admin\Downloads\ChromeSetup91.exe
    "C:\Users\Admin\Downloads\ChromeSetup91.exe"
    3⤵
    - Maps connected drives based on registry
    PID:5612
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://nexguard.pro/ae8ouxb9gx/api?t=4819ebd7c129161d3cd8dd89d4efec1fec66c785&track=1&event=launch_ok
    3⤵
    PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7c5c670666eb6a7b95ce49b4c939a00f08a88ae52e8129add6dd4c900103b15b
MD5 6c0d98ba84e5f2c1f59382f3cfd3edba
SHA1 43d3cfc64791bdfc9c051d54fffc62076ecfec6f
SHA512 30d96c77dce034af893c0d6380b4406b931a1c42133672f4b1cf0a17a0d834ca9909e0472fbdbe08ae0ff6fbc67e11dfd1ab472c97648dc98e071720776204fd
TLSH
T155216637B3DC8610C88A403A10CEAC1436B687DB809ECEABBB84D544A42F299CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES6D32.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6D32.tmp
Size 1KB
SHA256 874e671255c6fd5a2c0073b94801722e05451dbf8dbca3f7ff4b635a664283f0
MD5 233df9637edf9a444667c85f005342d6
SHA1 93a7cf40f67121f4ec3db18157a4279fd1423a40
SHA512 0a82bcb14d2bbb88fed508f039106ea5c5cd5399c59905424d7fbe4bdcd1873c71a93293cdbd2289f20e6cd94a34b8ac1947a7b5f01623cdf9be8c4a397d214f
TLSH
T1FB21CC0543E8470FF0B34731ADF6171F9674FD64EFA6A75A8840422D2C51604EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vtlp3b0h.tki.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vtlp3b0h.tki.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cysdy5tk.dll

Path C:\Users\Admin\AppData\Local\Temp\cysdy5tk\cysdy5tk.dll
Size 4KB
SHA256 6afe61f9629094329e7ae68de94b473b43f9753f5c8bd52f54fdbb9fc2c727a3
MD5 98d5b2996e1318cb19d18f4e30231c33
SHA1 c9c7d3a4dc1cabca76b81dade97c36ef38aefeb5
SHA512 0785284b7e98a91bd7330bce5148bf6422a7316d8e6abe7b78a5a4ce4c0f9f036d47cb1a509543230e5693889b573986a50d00e38697f8260766158281d55c62
TLSH
T1B181234297E80557E4BB4B30ADF3538729F0EC404F73D72B1980912E6D652584E35BB2
MD5 SHA1 SHA512 TLSH

Submit Download

1531642463exe.ps1

Path C:\Users\Admin\Downloads\1531642463exe.ps1
Size 1KB
SHA256 f7f75f5a9240bc878a4f129c10374fa6b12b2c82907c8f500d44bbcff8f8ab49
MD5 9b07b38a94b29d9d3e3e7f26d7bc52aa
SHA1 36f490cb635821853a83d88fe82d14e276a05685
SHA512 57ea0706e97972296b84d8042e82ff0708f8638e39e59a034a94e99ba32af8f05ccaa815f12e76de2f82e7527a47a30fe5cffdf15e394697a2de34d691846b3b
TLSH
T15B314257F2B4257E42C587D691E093769833D74DC2984ABC30BC57839A215FF1A6C1C6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC652938382EC14CA980192361E8C85D9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cysdy5tk\CSC652938382EC14CA980192361E8C85D9.TMP
Size 652B
SHA256 e033bb30b8e368e48de6285bd279402857b6e5719e63e725df0938b6bb6ed051
MD5 b6e530247200950336e0885edc781f8c
SHA1 7021d1bb6f53585c96dea929d4346f6e23f9f3d5
SHA512 2a365d312d10f347ebdc4f74e780642d88045fb30e8176a0398ff8f93dc13967e82b7b50eb01e9b87d6be2f72bc3b48b2d1185c020eed98f209cc4c7180b81c2
TLSH
T139F03A4A63F8020AF0F34B30B9F6436395A8BC65DE3293ED1941131D2C64A20C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cysdy5tk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cysdy5tk\cysdy5tk.0.cs
Size 1KB
SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
MD5 83477799135bafaac2091086495e3785
SHA1 530abad3945b9560e700429ff24a2492da0d9e4c
SHA512 e12cb0be983dabe342cdf64d1320c34c9f394180a3a5d65e9ced71e483c81f36192854a23bdd4d40c9d509da6fe3ea1a12bfd4980652a00ff5f881d7bd952538
TLSH
T10F317C5E27A9E51060B63118EB02C0CBEE9289272E77852073ECAA154F72144D779F5F
MD5 SHA1 SHA512 TLSH

Submit Download

cysdy5tk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cysdy5tk\cysdy5tk.cmdline
Size 369B
SHA256 558d33eeaf2e2471ceabe8712f8ddecbe24588cb5c517cde7639780e6792bea5
MD5 386255b22f8d32234db0da0125ff6df0
SHA1 81522eaa07cada0a774ba0ee966308e2f93e8738
SHA512 8633054ef5a5dff6148fd1a02e2c800da141c2de038d104de2c9c1cdf996cc3a5c2878f83e8e10e804a127f40b469991ccf7632dc9d0463e8b54076ec27b91c4
TLSH
T183E0C02A6666C27F0BDD910B3DB9C9ACCB7207432A903F845440840DD05700637F1763
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-40-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-29-0x000001FDEFB40000-0x000001FDEFB54000-memory.dmp

Download

memory/916-51-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-48-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-26-0x000001FDEFB00000-0x000001FDEFB1E000-memory.dmp

Download

memory/916-16-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-17-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-18-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-46-0x000001FDEFAE0000-0x000001FDEFAE8000-memory.dmp

Download

memory/916-21-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-47-0x000001FDEFB60000-0x000001FDEFB87000-memory.dmp

Download

memory/916-27-0x000001FDEFBB0000-0x000001FDEFC62000-memory.dmp

Download

memory/916-28-0x000001FDEFAF0000-0x000001FDEFAFA000-memory.dmp

Download

memory/916-39-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-38-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/916-35-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-10-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-0-0x00007FFAEF64F000-0x00007FFAEF650000-memory.dmp

Download

memory/4492-7-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-9-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-6-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-5-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-4-0x0000027B6ED30000-0x0000027B6ED52000-memory.dmp

Download

memory/4492-3-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-8-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-15-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-13-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/4492-12-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download