72cf74a14f59789640f164bab0ab76992e194b0c962829b8bc52a5fb1212ce32

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72cf74a14f597896.ps1
Size 689KB
Sample261113-e5sgkazx4m
SHA256 72cf74a14f59789640f164bab0ab76992e194b0c962829b8bc52a5fb1212ce32
MD5 c50d6f6a41287a34f884e394de280c7d
SHA1 5399651408f73907dd57a78c20b2f61d0fdf3e38
SHA512 fa5662d933c1fed38bb9bd04bb6c2c26c87d4cd107ab38b33bc3b77e107364589664cbf4a811033a6dd2a57e798bc0d6c13b23703e73049470f426102994b3ec
SSDEEP 12288:CgQ5a5T0hMYJqg6jPq5smXqz8Qqv5vvomYoPOfEtIDY2mLzcuuH:CoqKyfvvocWfEtIDkLzw
TLSH
T1F3E46D34BA462EFF5BB820C248D5C11C563C22B5C9686CF56ACF4CA2391D77627B79B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4916	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 2044	4916	PowerShell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4916	PowerShell.exe
1824	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5500	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4916	PowerShell.exe
4916	PowerShell.exe
4916	PowerShell.exe
4916	PowerShell.exe
1824	powershell.exe
1824	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4916	PowerShell.exe
Token: SeSecurityPrivilege	4916	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4916	PowerShell.exe
Token: SeLoadDriverPrivilege	4916	PowerShell.exe
Token: SeSystemProfilePrivilege	4916	PowerShell.exe
Token: SeSystemtimePrivilege	4916	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4916	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4916	PowerShell.exe
Token: SeCreatePagefilePrivilege	4916	PowerShell.exe
Token: SeBackupPrivilege	4916	PowerShell.exe
Token: SeRestorePrivilege	4916	PowerShell.exe
Token: SeShutdownPrivilege	4916	PowerShell.exe
Token: SeDebugPrivilege	4916	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4916	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4916	PowerShell.exe
Token: SeUndockPrivilege	4916	PowerShell.exe
Token: SeManageVolumePrivilege	4916	PowerShell.exe
Token: 33	4916	PowerShell.exe
Token: 34	4916	PowerShell.exe
Token: 35	4916	PowerShell.exe
Token: 36	4916	PowerShell.exe
Token: SeDebugPrivilege	3720	whoami.exe
Token: SeIncreaseQuotaPrivilege	4916	PowerShell.exe
Token: SeSecurityPrivilege	4916	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4916	PowerShell.exe
Token: SeLoadDriverPrivilege	4916	PowerShell.exe
Token: SeSystemProfilePrivilege	4916	PowerShell.exe
Token: SeSystemtimePrivilege	4916	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4916	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4916	PowerShell.exe
Token: SeCreatePagefilePrivilege	4916	PowerShell.exe
Token: SeBackupPrivilege	4916	PowerShell.exe
Token: SeRestorePrivilege	4916	PowerShell.exe
Token: SeShutdownPrivilege	4916	PowerShell.exe
Token: SeDebugPrivilege	4916	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4916	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4916	PowerShell.exe
Token: SeUndockPrivilege	4916	PowerShell.exe
Token: SeManageVolumePrivilege	4916	PowerShell.exe
Token: 33	4916	PowerShell.exe
Token: 34	4916	PowerShell.exe
Token: 35	4916	PowerShell.exe
Token: 36	4916	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4916	PowerShell.exe
Token: SeSecurityPrivilege	4916	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4916	PowerShell.exe
Token: SeLoadDriverPrivilege	4916	PowerShell.exe
Token: SeSystemProfilePrivilege	4916	PowerShell.exe
Token: SeSystemtimePrivilege	4916	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4916	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4916	PowerShell.exe
Token: SeCreatePagefilePrivilege	4916	PowerShell.exe
Token: SeBackupPrivilege	4916	PowerShell.exe
Token: SeRestorePrivilege	4916	PowerShell.exe
Token: SeShutdownPrivilege	4916	PowerShell.exe
Token: SeDebugPrivilege	4916	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4916	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4916	PowerShell.exe
Token: SeUndockPrivilege	4916	PowerShell.exe
Token: SeManageVolumePrivilege	4916	PowerShell.exe
Token: 33	4916	PowerShell.exe
Token: 34	4916	PowerShell.exe
Token: 35	4916	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3720	4916	PowerShell.exe	91
PID 4916 wrote to memory of 2044	4916	PowerShell.exe	92
PID 4916 wrote to memory of 2044	4916	PowerShell.exe	92
PID 4916 wrote to memory of 2044	4916	PowerShell.exe	92
PID 4916 wrote to memory of 2044	4916	PowerShell.exe	92
PID 4916 wrote to memory of 2044	4916	PowerShell.exe	92
PID 5980 wrote to memory of 5500	5980	conhost.exe	97
PID 5500 wrote to memory of 1824	5500	cmd.exe	98
PID 1824 wrote to memory of 4136	1824	powershell.exe	99
PID 4136 wrote to memory of 4512	4136	csc.exe	100

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\72cf74a14f597896.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4556

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pqrbht5w\pqrbht5w.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC0E.tmp" "c:\Users\Admin\AppData\Local\Temp\pqrbht5w\CSCC176E611152A41B7B84E505E4E428271.TMP"
        5⤵
        
        PID:4512

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 331KB
SHA256 720364f52f0cb59b34596a3251cdf0c771f15c716109c2eca113b1ec7e49e900
MD5 d40ab7ca7a4bff3c4bb8e00205ba71a7
SHA1 a1dca2138a3b7ac1069167832c7cfac199d35f7f
SHA512 d21a92ea88706ecb0cd5e73530d15bc1897171b8331043f175e4e71bb49b3f0ecf7b8293f3b7b0fb8daa4f6c6823e988539739bffedae328e1ec8734eb469ad7
SSDEEP 6144:JQcKekDIWjA4LBY14YoD0P+f7oW25QMECh77qMACuuZNQMGFIcPI9c:JfkUD4i14Y60So7jE1uHFGFIjy
TLSH
T160746D307A422EFB5BA860C248D6851C563C3279D9682CE579CF0CE23B0D7761BB7A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e41897db8b2181330c9fa8a325365578ecfcf2840bcbbdfb1d459e423c5fdf5f
MD5 95b6e67f79095c736b7bdbf366e8bef2
SHA1 1b8bae46d96f680ca042b5b453d40eecc41ac3b4
SHA512 6e52f9d0794302b85e9972d2416526235d7ac39a23dcf19bdc2893ba623f212ebc7712fb143770734fce767b5ba5d991a7fe4451b1a84e55edc6a1f943499583
TLSH
T1D8417927B3DC82D0C8896076DCDD6C107AB693D7809FCEDB6A80D115E56F298DA64050
MD5 SHA1 SHA512 TLSH

Submit Download

RESDC0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDC0E.tmp
Size 1KB
SHA256 e0e1da9da3471018a98d4e0ee3527394f64fbf1b885018847f918a6750de01bd
MD5 d224a2728b69b778c01a80cd66fe7f30
SHA1 73f6fa67c06cecae31dc58fb03bedef9e710eb91
SHA512 4c50a61c81933aeeff5a850e037b78022989236f149ac120e04947477ad606141450413039666294b0d217bcdae9179918461a53da0771bd9c95f2b6d37506f5
TLSH
T13821AB4153E8871EF0774731A9FA176BA269FE65EFB2939A854402281C51604EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_q0x2t2jc.nzc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0x2t2jc.nzc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pqrbht5w.dll

Path C:\Users\Admin\AppData\Local\Temp\pqrbht5w\pqrbht5w.dll
Size 3KB
SHA256 f816b66914e9bcf4976cd25cfc93f48741df4db70a95cda433777dcf2ebcf409
MD5 bbbde5452bb68ec9bab23f3f0ad56453
SHA1 ba4d464f5bb0aeb2dd034b49a04b97722e2fbcfd
SHA512 6920bdc2cb55ee5b4976085b3e742c059c2418f5b43698fb6efbb00a03300df836ebac713dba55703a24e2ec91511854c610aa03d8191f5770454664afd7ffa8
TLSH
T115715306A7E44BA2F0B70734A9F343525378F8609E77975E18C82328BC657742A32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC176E611152A41B7B84E505E4E428271.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pqrbht5w\CSCC176E611152A41B7B84E505E4E428271.TMP
Size 652B
SHA256 2c159d8c2c1054a92c2aff35c5cb8c791413f717e7debcbd202da0c812bcfc02
MD5 d60fac67dcb35c91c0802208f4ecf2e8
SHA1 54fe4e0d740afe2ac478eb25c2fb86f4037d0ab0
SHA512 e57e1f8d8dac557c3eb9bfa66fde78883af202b1a21fa27c8004b3a3679983b10743c56d5caa54b0a08405ec8584e53d6f634da1000dd674b989251010754b6c
TLSH
T1AFF05E4963F8420EF0F34B30BDF653A391A9BD64DE7293ED5445032D28646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pqrbht5w.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pqrbht5w\pqrbht5w.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

pqrbht5w.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pqrbht5w\pqrbht5w.cmdline
Size 369B
SHA256 2eb5b7e7a4a249e9af6af14ec40e78da8ee889632d44fd3afcfd2fde67fb0ee3
MD5 cb7ed61168f921fcd379b39e06e71278
SHA1 6173803e6699f529b61aa8b44397dacb2434760d
SHA512 6f3a31dde50e43c72ef7c2437643a17020d8df1cf6376f109197239b4f3e01ee3d4fb69fbe4b0b14076bb3255e59d8014062cfc21fad1523b9fa084b96bf8660
TLSH
T1E8E0C02A8246CA7D11DD10072969D6BCCA72078369823F849070480ED01712A2FF1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1824-91-0x000001FA32F80000-0x000001FA32F88000-memory.dmp

Download

memory/2044-39-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4916-33-0x000002A0F21B0000-0x000002A0F2262000-memory.dmp

Download

memory/4916-16-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-18-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-19-0x000002A0F20F0000-0x000002A0F2102000-memory.dmp

Download

memory/4916-20-0x000002A0F2160000-0x000002A0F21B0000-memory.dmp

Download

memory/4916-21-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-22-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-23-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-24-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-30-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-32-0x000002A0F2110000-0x000002A0F212E000-memory.dmp

Download

memory/4916-0-0x00007FFBA290F000-0x00007FFBA2910000-memory.dmp

Download

memory/4916-34-0x000002A0F2130000-0x000002A0F213A000-memory.dmp

Download

memory/4916-35-0x000002A0F22A0000-0x000002A0F22CA000-memory.dmp

Download

memory/4916-36-0x000002A0F22A0000-0x000002A0F22C4000-memory.dmp

Download

memory/4916-37-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-38-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-17-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-41-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-42-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-43-0x000002A0F2B90000-0x000002A0F2D52000-memory.dmp

Download

memory/4916-44-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-45-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-46-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-54-0x000002A0F2370000-0x000002A0F238E000-memory.dmp

Download

memory/4916-68-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-69-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-15-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-14-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-13-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-12-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-11-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-10-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-9-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-2-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/4916-1-0x000002A0F1AA0000-0x000002A0F1AC2000-memory.dmp

Download