72cf74a14f59789640f164bab0ab76992e194b0c962829b8bc52a5fb1212ce32

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72cf74a14f597896.ps1
Size 689KB
Sample261113-e5sgkazx4m
SHA256 72cf74a14f59789640f164bab0ab76992e194b0c962829b8bc52a5fb1212ce32
MD5 c50d6f6a41287a34f884e394de280c7d
SHA1 5399651408f73907dd57a78c20b2f61d0fdf3e38
SHA512 fa5662d933c1fed38bb9bd04bb6c2c26c87d4cd107ab38b33bc3b77e107364589664cbf4a811033a6dd2a57e798bc0d6c13b23703e73049470f426102994b3ec
SSDEEP 12288:CgQ5a5T0hMYJqg6jPq5smXqz8Qqv5vvomYoPOfEtIDY2mLzcuuH:CoqKyfvvocWfEtIDkLzw
TLSH
T1F3E46D34BA462EFF5BB820C248D5C11C563C22B5C9686CF56ACF4CA2391D77627B79B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4476	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 3076	4476	powershell.exe	88

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4476	powershell.exe
5108	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
868	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
5108	powershell.exe
5108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeIncreaseQuotaPrivilege	4476	powershell.exe
Token: SeSecurityPrivilege	4476	powershell.exe
Token: SeTakeOwnershipPrivilege	4476	powershell.exe
Token: SeLoadDriverPrivilege	4476	powershell.exe
Token: SeSystemProfilePrivilege	4476	powershell.exe
Token: SeSystemtimePrivilege	4476	powershell.exe
Token: SeProfSingleProcessPrivilege	4476	powershell.exe
Token: SeIncBasePriorityPrivilege	4476	powershell.exe
Token: SeCreatePagefilePrivilege	4476	powershell.exe
Token: SeBackupPrivilege	4476	powershell.exe
Token: SeRestorePrivilege	4476	powershell.exe
Token: SeShutdownPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeSystemEnvironmentPrivilege	4476	powershell.exe
Token: SeRemoteShutdownPrivilege	4476	powershell.exe
Token: SeUndockPrivilege	4476	powershell.exe
Token: SeManageVolumePrivilege	4476	powershell.exe
Token: 33	4476	powershell.exe
Token: 34	4476	powershell.exe
Token: 35	4476	powershell.exe
Token: 36	4476	powershell.exe
Token: SeDebugPrivilege	3260	whoami.exe
Token: SeIncreaseQuotaPrivilege	4476	powershell.exe
Token: SeSecurityPrivilege	4476	powershell.exe
Token: SeTakeOwnershipPrivilege	4476	powershell.exe
Token: SeLoadDriverPrivilege	4476	powershell.exe
Token: SeSystemProfilePrivilege	4476	powershell.exe
Token: SeSystemtimePrivilege	4476	powershell.exe
Token: SeProfSingleProcessPrivilege	4476	powershell.exe
Token: SeIncBasePriorityPrivilege	4476	powershell.exe
Token: SeCreatePagefilePrivilege	4476	powershell.exe
Token: SeBackupPrivilege	4476	powershell.exe
Token: SeRestorePrivilege	4476	powershell.exe
Token: SeShutdownPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeSystemEnvironmentPrivilege	4476	powershell.exe
Token: SeRemoteShutdownPrivilege	4476	powershell.exe
Token: SeUndockPrivilege	4476	powershell.exe
Token: SeManageVolumePrivilege	4476	powershell.exe
Token: 33	4476	powershell.exe
Token: 34	4476	powershell.exe
Token: 35	4476	powershell.exe
Token: 36	4476	powershell.exe
Token: SeIncreaseQuotaPrivilege	4476	powershell.exe
Token: SeSecurityPrivilege	4476	powershell.exe
Token: SeTakeOwnershipPrivilege	4476	powershell.exe
Token: SeLoadDriverPrivilege	4476	powershell.exe
Token: SeSystemProfilePrivilege	4476	powershell.exe
Token: SeSystemtimePrivilege	4476	powershell.exe
Token: SeProfSingleProcessPrivilege	4476	powershell.exe
Token: SeIncBasePriorityPrivilege	4476	powershell.exe
Token: SeCreatePagefilePrivilege	4476	powershell.exe
Token: SeBackupPrivilege	4476	powershell.exe
Token: SeRestorePrivilege	4476	powershell.exe
Token: SeShutdownPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeSystemEnvironmentPrivilege	4476	powershell.exe
Token: SeRemoteShutdownPrivilege	4476	powershell.exe
Token: SeUndockPrivilege	4476	powershell.exe
Token: SeManageVolumePrivilege	4476	powershell.exe
Token: 33	4476	powershell.exe
Token: 34	4476	powershell.exe
Token: 35	4476	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3260	4476	powershell.exe	85
PID 4476 wrote to memory of 3076	4476	powershell.exe	88
PID 4476 wrote to memory of 3076	4476	powershell.exe	88
PID 4476 wrote to memory of 3076	4476	powershell.exe	88
PID 4476 wrote to memory of 3076	4476	powershell.exe	88
PID 4476 wrote to memory of 3076	4476	powershell.exe	88
PID 2400 wrote to memory of 868	2400	conhost.exe	98
PID 868 wrote to memory of 5108	868	cmd.exe	99
PID 5108 wrote to memory of 1988	5108	powershell.exe	100
PID 1988 wrote to memory of 4516	1988	csc.exe	101

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\72cf74a14f597896.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3604

C:\Windows\system32\conhost.exe
conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x15ky1br\x15ky1br.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE66E.tmp" "c:\Users\Admin\AppData\Local\Temp\x15ky1br\CSCEB7BEE8EE4BD424BB34F76DEAC2AEA46.TMP"
        5⤵
        
        PID:4516

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 318KB
SHA256 03a259d0960a112c6082ce8930364af240f5aaf00f07d960b3ae87e361f8c11c
MD5 185d5df33423dd6d8fbd37ef5c462bde
SHA1 85e39064cf1e050d6c2d730d3401475bb48b2970
SHA512 47a8f4b7593322cd1ee6bb48ad61efcf294194c9d0c82c6f824547a9fd8cad8764dc646d76236db0c776238c13377bbc522ceb8721e03c955e2f68a182b700b5
SSDEEP 6144:ywatvUNT0NTYaH7dXO+fBp9qzmHQcDfykVknk0NBWa9iDQ9H:ywEvUkTPOw9qzmHQcDfyXLnH
TLSH
T15E647D247A422EFF5BB820C244C9850C653862B9C9692CF679CF5CE22F1D77523B79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 ae19d5fb9122eb3f5bfbde5364d6c7f1206ab89d6592315f69514d455d315bc9
MD5 bd5ac526558a1753a45425a0f0c28a62
SHA1 92dc535d870cb84e3bbc1143e24c9ca37001a2bb
SHA512 fbc1073d88dfcffeaeca43a5137eb09046123af76f54efb3876884bf3a3799c41100e4a99b841ee12b02c106b40f366ff45828e6ca0db4e6eb226d0098709ac1
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZ7qg0WPfsNySxBPFX:iqdYqGAjdx4qKkq3qktznEuZq6XIzo7q
TLSH
T1E281DD313275B0D4C9567F072A2819D463BF4386EA98AF4CB25C621ED92751BDB221F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 578cf213edddc22a95bd9cd6d90a6ae36286041a3bb488bc306373a86bdffa84
MD5 c9f30d19a245cdb1da39593fe00506cf
SHA1 1491ab0714c71335bd4688819086479ae024dffc
SHA512 a059da30b35d38fe2be22aea23cf09ded3bd2f6d07269c78680f4158d736c4db1c70d03e983891cc046227dfe4790b6e66259c17fbf9034d4a94d3fa13cceb22
TLSH
T1AF41B927B3DC85D0D889357ADCEC5C117A7693C3C09F8FDB6AC0D614E1AF698DA69050
MD5 SHA1 SHA512 TLSH

Submit Download

RESE66E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE66E.tmp
Size 1KB
SHA256 409fb2e614efac262f3259bc52eeb6f199f18b3b9f5db31766697f92103c1e27
MD5 32f4432d047c149ebf8e1d888cc8de89
SHA1 4964fceebfa21b198e4ba4c03bf6f4917bf76119
SHA512 bd88c9b6401fb1f708a2a7b5872b8341ea0935b838be79c7a1a2c3c7fcdbd401e2e7f7ce93e455d06e54466a57e8b30ef75416f68c959e4094ca849a05e95a82
TLSH
T1B621AB0583E8471FF0B31B3169F6176BA624FD64FFA293AB8580422C2C51544EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v4myaego.k1b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4myaego.k1b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x15ky1br.dll

Path C:\Users\Admin\AppData\Local\Temp\x15ky1br\x15ky1br.dll
Size 3KB
SHA256 0344380625172c15f72e634000ac95d6a3e7c6a4f6350d29fd428503c94e5e09
MD5 2d5589130c8c2b24f206ce9684660e01
SHA1 1e6435d0e9e4ddd406b159428909af9363ec9786
SHA512 fa79457904349a4f0020a33619c27c6d8cbb9246aba73304f391a92f633b13d7c1c128c476317ed1258802e630865973e81580b1987de39f40a2fee47ba00fdc
TLSH
T141715106E7E44AA6F0F7433869F343525378F8609F37576F19C46328BC667646A22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEB7BEE8EE4BD424BB34F76DEAC2AEA46.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\x15ky1br\CSCEB7BEE8EE4BD424BB34F76DEAC2AEA46.TMP
Size 652B
SHA256 69c45a936c7df29a5fa84d46661465ec863d0a041174b51a045bb3c95b5435a1
MD5 58d61d79d1b192c3e4c95f7039610cf8
SHA1 061614131d9a81daeef899c4d598a00aa921df3a
SHA512 da22f08b8734d0cfc415254fa0ba2de967fe92bd99fb86affd1c57648a74fa020b31cec252bb8f018ff2f13bacdea6c3fba091cbdeb6518ed2f46ed4594c77ce
TLSH
T174F05E4963F8420EF0F35B30BDF643A395A8BC64EE32A3ED545103592C645108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

x15ky1br.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\x15ky1br\x15ky1br.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

x15ky1br.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\x15ky1br\x15ky1br.cmdline
Size 369B
SHA256 6a66fdf62b76a6f3962dca886c03a8794d748563bd3e836747234ae9d96ab033
MD5 a6c11926f55f9da2b17f23c041d3c614
SHA1 deb48c30299a896d9ce1f6e5c0060664540f45d0
SHA512 926d7a9dc3e0ed49c9044ea07e45f975cf38221c12543993740a44335f2668ec928adfb2de7e31d0b6a2252fa5c2274092aa322d5ba141565571dc29d548b04e
TLSH
T167E0C03A5246C27D11ED92072369C4BCE672074329403F9C9A85480DE0170082FD175B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3076-16-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4476-12-0x000001C8E05D0000-0x000001C8E05FA000-memory.dmp

Download

memory/4476-13-0x000001C8E05D0000-0x000001C8E05F4000-memory.dmp

Download

memory/4476-18-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-19-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-21-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-15-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-14-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-17-0x000001C8E0C50000-0x000001C8E0E12000-memory.dmp

Download

memory/4476-0-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-11-0x000001C8E0620000-0x000001C8E0670000-memory.dmp

Download

memory/4476-10-0x000001C8C7020000-0x000001C8C7032000-memory.dmp

Download

memory/4476-9-0x000001C8C6E60000-0x000001C8C6E70000-memory.dmp

Download

memory/4476-8-0x000001C8C6FF0000-0x000001C8C7012000-memory.dmp

Download

memory/5108-58-0x000002C254FD0000-0x000002C254FD8000-memory.dmp

Download