3131284e25346ec82850977927be4e90fb6bfbe65d601b0d23c36f744d59ca3b

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 574KB
Sample261113-pcwcvsbs3x
SHA256 3131284e25346ec82850977927be4e90fb6bfbe65d601b0d23c36f744d59ca3b
MD5 f985c30c759e06cbfe5083ade7086234
SHA1 1e5383a5e923bd821938bcca8ebb76168bc09e57
SHA512 947018e907c3906bc2370e9f08c198b9df1527759b520973f3af115180ad6cc998271e18012c2ce9f8ccb4e9e4499a3d10170509870ed3425b6d9d626d29bea7
SSDEEP 12288:nxXFQKZDIS05X58kDYWFfCBufQBERaXosWMO2RmmFeuattDi3NbCjy:xeKZD059Ty
TLSH
T19CC47E747B022EFF5BB820C248DA811D563C26B5C9682CF569CB4CA7390D77927B79B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4480	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4480 set thread context of 4664	4480	powershell.exe	90

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1920	powershell.exe
4480	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1496	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
1920	powershell.exe
1920	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe
Token: 36	4480	powershell.exe
Token: SeDebugPrivilege	736	whoami.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe
Token: 36	4480	powershell.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 736	4480	powershell.exe	87
PID 4480 wrote to memory of 4664	4480	powershell.exe	90
PID 4480 wrote to memory of 4664	4480	powershell.exe	90
PID 4480 wrote to memory of 4664	4480	powershell.exe	90
PID 4480 wrote to memory of 4664	4480	powershell.exe	90
PID 4480 wrote to memory of 4664	4480	powershell.exe	90
PID 4384 wrote to memory of 1496	4384	conhost.exe	100
PID 1496 wrote to memory of 1920	1496	cmd.exe	101
PID 1920 wrote to memory of 1776	1920	powershell.exe	102
PID 1776 wrote to memory of 2476	1776	csc.exe	103

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1736

C:\Windows\system32\conhost.exe
conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lv3hmbmp\lv3hmbmp.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC0C.tmp" "c:\Users\Admin\AppData\Local\Temp\lv3hmbmp\CSCA7632D5943C74D50B63EDF313128AFD1.TMP"
        5⤵
        
        PID:2476

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 353KB
SHA256 6cbdb68157bb0ab47f9651fb72495dc2b414a0c8c935a8801911997d224f1987
MD5 a5da30c9e7c7a062e08478287b2ff3ca
SHA1 7cade5393ed22d2aeb27e2bca74e9b71101fffc5
SHA512 4a153ef809f91d178d895e3f94360f8748a5b7aa8cb9f4c0e935bff4306c7f47296c04b0087c9271bc0dcae9f451245f08cb9f1b074b0bf25828e1f740e5d746
SSDEEP 6144:8vwG93FS6DNxPQBchmdnI8d+sQ2wbSiG16rLK1hRHQtj1pbwiCo2yzKrXoaHjDhx:83FS6DNxPQBchmdnI8d+sQ2wbSiGIi3N
TLSH
T103745C2479422EFF57A8208248D6C51C562C3279CA682CE57ACF5CE23F4D77617B7AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 ae19d5fb9122eb3f5bfbde5364d6c7f1206ab89d6592315f69514d455d315bc9
MD5 bd5ac526558a1753a45425a0f0c28a62
SHA1 92dc535d870cb84e3bbc1143e24c9ca37001a2bb
SHA512 fbc1073d88dfcffeaeca43a5137eb09046123af76f54efb3876884bf3a3799c41100e4a99b841ee12b02c106b40f366ff45828e6ca0db4e6eb226d0098709ac1
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZ7qg0WPfsNySxBPFX:iqdYqGAjdx4qKkq3qktznEuZq6XIzo7q
TLSH
T1E281DD313275B0D4C9567F072A2819D463BF4386EA98AF4CB25C621ED92751BDB221F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95538a30ca9c52708f93d667acddf225a2bfc88fac0af4d4d8649d242a372bb5
MD5 e0f405f996f5bbddd0609f227f2aee88
SHA1 80ccc2ba2f92886b434720dea5b2d9a5914738b8
SHA512 a63255358096b8e98bdaed8c75223b287c202dac1ae29603df8bdf8099b56bdb0ed259f5cb58f56f82699225eef0bc7e30d1ea2cb7fc2f34fe1be4f26af89a55
TLSH
T16541B927B39C85E0D8C9257ADCEC5C117A7693C3809FCFDB6AC0D610E1AF698CA29050
MD5 SHA1 SHA512 TLSH

Submit Download

RESEC0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEC0C.tmp
Size 1KB
SHA256 8a1cb5b6e88d005374c6961fbf7f30377f96b5c9c8dcc5e18a5b090813f54eca
MD5 e7d7993f2227b595b25edfc33b4430d3
SHA1 ec6f47a5855162d7342e5c8f932fc7c18fb632f2
SHA512 69dd9e3440f13fa4ec4a2bbb42052e94f7b39ecacd7a73e257de48c346317a870038adb62e6e324eb0b2582e1605dcf9c66c62eff9ecceb0ce5771053f8cb094
TLSH
T18021AB0553FC4B1BF0B35B3168F6075BA238FE99EFB2536B898042282C11100DEB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xpjakncv.nk2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpjakncv.nk2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lv3hmbmp.dll

Path C:\Users\Admin\AppData\Local\Temp\lv3hmbmp\lv3hmbmp.dll
Size 3KB
SHA256 1aab9b1f79cce5d2919ef16a8d64032505d8c0896254e1922674a1a1720e2994
MD5 72d057574e002abe908a66606689b0b5
SHA1 e8f8354ec02325f6078101ae82bcc61ec8b6a690
SHA512 d2ac7b9ded4aefd0f8f9f63acd99ad7b4f7a14dac7ee5f1a9d7aeb3cea041fbf74d5a3d88198dfaf01b44527b56ddae95f1b445bf2c18cb61a716df09748ea15
TLSH
T144715307A7F84AA6E0B7073469F343525378FC649F37575E19C41328BC667246E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA7632D5943C74D50B63EDF313128AFD1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lv3hmbmp\CSCA7632D5943C74D50B63EDF313128AFD1.TMP
Size 652B
SHA256 5cca5785ed82486e888184e207c88a1d0154b30a0cec18f51e0de410aa439135
MD5 51ffbb4173c47381716897feea7254e4
SHA1 7835febfc5d56781302b3e8ca97a53dee277746c
SHA512 fdfe2d73a55a473a2c74955a5f713ef675b10577c1c3505fae17ae0843f8066e4b7d7e4bed2e485e222c30456b7f4863f4ff4b8f4ff11de56620da9ab610d837
TLSH
T183F05E0963FC020EF4F34B30BDF643A395A9BC65DE36A3ED148003196C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lv3hmbmp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lv3hmbmp\lv3hmbmp.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

lv3hmbmp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lv3hmbmp\lv3hmbmp.cmdline
Size 369B
SHA256 cbfb16c042fcabe5157715b27be4a0843b50a3358519bc6c55cd2f7c5924215e
MD5 4f08fb18051b0d7d82c02592c902e970
SHA1 8b4e5559e175ab1556e6a24c8fb6b29d4161cbaf
SHA512 2fd5f241091c9e89fd6ee0ccde6f987694eb98d0a6201b051001d465fc41d040f8b617558c8b4c3c28de445907552bb258b9f942e433179e11840c8f3ff70809
TLSH
T145E0683B6666C27E02DA19472169E9EDC2720AC36A403F84D940840DD0370002FE1781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1920-58-0x00000144BFF70000-0x00000144BFF78000-memory.dmp

Download

memory/4480-12-0x000001A145520000-0x000001A145570000-memory.dmp

Download

memory/4480-13-0x000001A145570000-0x000001A14559A000-memory.dmp

Download

memory/4480-19-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-18-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-21-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-0-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-15-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-17-0x000001A145B40000-0x000001A145D02000-memory.dmp

Download

memory/4480-14-0x000001A145570000-0x000001A145594000-memory.dmp

Download

memory/4480-1-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-11-0x000001A145150000-0x000001A145162000-memory.dmp

Download

memory/4480-10-0x000001A144E90000-0x000001A144EA0000-memory.dmp

Download

memory/4480-7-0x000001A144FA0000-0x000001A144FC2000-memory.dmp

Download

memory/4664-16-0x0000000140000000-0x0000000140004000-memory.dmp

Download