3131284e25346ec82850977927be4e90fb6bfbe65d601b0d23c36f744d59ca3b

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.ps1
Size 574KB
Sample261113-pcwcvsbs3x
SHA256 3131284e25346ec82850977927be4e90fb6bfbe65d601b0d23c36f744d59ca3b
MD5 f985c30c759e06cbfe5083ade7086234
SHA1 1e5383a5e923bd821938bcca8ebb76168bc09e57
SHA512 947018e907c3906bc2370e9f08c198b9df1527759b520973f3af115180ad6cc998271e18012c2ce9f8ccb4e9e4499a3d10170509870ed3425b6d9d626d29bea7
SSDEEP 12288:nxXFQKZDIS05X58kDYWFfCBufQBERaXosWMO2RmmFeuattDi3NbCjy:xeKZD059Ty
TLSH
T19CC47E747B022EFF5BB820C248DA811D563C26B5C9682CF569CB4CA7390D77927B79B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4948	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 3488	4948	PowerShell.exe	91

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4948	PowerShell.exe
3148	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3596	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4948	PowerShell.exe
4948	PowerShell.exe
4948	PowerShell.exe
3148	powershell.exe
3148	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4948	PowerShell.exe
Token: SeSecurityPrivilege	4948	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4948	PowerShell.exe
Token: SeLoadDriverPrivilege	4948	PowerShell.exe
Token: SeSystemProfilePrivilege	4948	PowerShell.exe
Token: SeSystemtimePrivilege	4948	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4948	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4948	PowerShell.exe
Token: SeCreatePagefilePrivilege	4948	PowerShell.exe
Token: SeBackupPrivilege	4948	PowerShell.exe
Token: SeRestorePrivilege	4948	PowerShell.exe
Token: SeShutdownPrivilege	4948	PowerShell.exe
Token: SeDebugPrivilege	4948	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4948	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4948	PowerShell.exe
Token: SeUndockPrivilege	4948	PowerShell.exe
Token: SeManageVolumePrivilege	4948	PowerShell.exe
Token: 33	4948	PowerShell.exe
Token: 34	4948	PowerShell.exe
Token: 35	4948	PowerShell.exe
Token: 36	4948	PowerShell.exe
Token: SeDebugPrivilege	2832	whoami.exe
Token: SeIncreaseQuotaPrivilege	4948	PowerShell.exe
Token: SeSecurityPrivilege	4948	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4948	PowerShell.exe
Token: SeLoadDriverPrivilege	4948	PowerShell.exe
Token: SeSystemProfilePrivilege	4948	PowerShell.exe
Token: SeSystemtimePrivilege	4948	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4948	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4948	PowerShell.exe
Token: SeCreatePagefilePrivilege	4948	PowerShell.exe
Token: SeBackupPrivilege	4948	PowerShell.exe
Token: SeRestorePrivilege	4948	PowerShell.exe
Token: SeShutdownPrivilege	4948	PowerShell.exe
Token: SeDebugPrivilege	4948	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4948	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4948	PowerShell.exe
Token: SeUndockPrivilege	4948	PowerShell.exe
Token: SeManageVolumePrivilege	4948	PowerShell.exe
Token: 33	4948	PowerShell.exe
Token: 34	4948	PowerShell.exe
Token: 35	4948	PowerShell.exe
Token: 36	4948	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4948	PowerShell.exe
Token: SeSecurityPrivilege	4948	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4948	PowerShell.exe
Token: SeLoadDriverPrivilege	4948	PowerShell.exe
Token: SeSystemProfilePrivilege	4948	PowerShell.exe
Token: SeSystemtimePrivilege	4948	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4948	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4948	PowerShell.exe
Token: SeCreatePagefilePrivilege	4948	PowerShell.exe
Token: SeBackupPrivilege	4948	PowerShell.exe
Token: SeRestorePrivilege	4948	PowerShell.exe
Token: SeShutdownPrivilege	4948	PowerShell.exe
Token: SeDebugPrivilege	4948	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4948	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4948	PowerShell.exe
Token: SeUndockPrivilege	4948	PowerShell.exe
Token: SeManageVolumePrivilege	4948	PowerShell.exe
Token: 33	4948	PowerShell.exe
Token: 34	4948	PowerShell.exe
Token: 35	4948	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2832	4948	PowerShell.exe	90
PID 4948 wrote to memory of 3488	4948	PowerShell.exe	91
PID 4948 wrote to memory of 3488	4948	PowerShell.exe	91
PID 4948 wrote to memory of 3488	4948	PowerShell.exe	91
PID 4948 wrote to memory of 3488	4948	PowerShell.exe	91
PID 4948 wrote to memory of 3488	4948	PowerShell.exe	91
PID 2876 wrote to memory of 3596	2876	conhost.exe	96
PID 3596 wrote to memory of 3148	3596	cmd.exe	97
PID 3148 wrote to memory of 4688	3148	powershell.exe	98
PID 4688 wrote to memory of 2900	4688	csc.exe	99

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\start.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2052

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ff1jz44k\ff1jz44k.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C5.tmp" "c:\Users\Admin\AppData\Local\Temp\ff1jz44k\CSC5A1412DD38484534AE868321E3F256C.TMP"
        5⤵
        
        PID:2900

C:\Windows\system32\taskhostw.exe
taskhostw.exe "conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 351KB
SHA256 dedae16ff03458bf317feef8a6ffc42641eac0650d257e2ef6eee19184eb0707
MD5 34ae5a8ada873f64e973058f3bc355eb
SHA1 50facdb854d0eb4945db1487db67e2a53407a534
SHA512 1cf052752829aa28c9f2b4bb225824867e434eb3f47bdca3a5178094899b330ef3f938b687f3f4173b564b6de080b0c593b1c39960070efbb89800f3d379600e
SSDEEP 6144:B3dcB39e1UhAuR71Zay7HwCtXP1j+XQQ0FektUgog6HbTGN:FC1Rsy7HwC7ektUgoguu
TLSH
T140746C247A422EFF5BA8208248C6C51C563C3279CA686DF579CF1CA23B1DB7517B79B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cc855b5f0114bbe7362a1621b91d7ccbf57fb955d4fc4f16b4aa59bb56d40a7e
MD5 4f69ea6148518f3b7a1eefee8e8bec41
SHA1 470976b96b384dc7a608f580b63f722a9a0a40d9
SHA512 59af9ab9611acb32e7cfcb9dec1f01861ce34ebd90d3b91e55b23b6aabe6a807f6c17266a85d3d6fce5484ddc058dadea973df09d1cdda1e3e10e840a5a114b6
TLSH
T18C417727B3DC82D0C88960BADCDD6C107AB693D7809F8EDB6A80E115E56F698DA68050
MD5 SHA1 SHA512 TLSH

Submit Download

RES3C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3C5.tmp
Size 1KB
SHA256 143b9a17d35921ddd47687d60c7b33f743e6b9ffeb6fbcef59eefb221fba2f55
MD5 cb85d7509ccd76a7a459d537e64d60a7
SHA1 e0d9877b74884a09b6a7eb5918cdd0b822858f9c
SHA512 0063a87eb3587b8279adccb87e4e369ae918e93fcdcb5447c005f6dc4af71c01ef133450bb2d0eb6a03f68b50a4414f5fa118a832825e733b6b2b47a9a092057
TLSH
T13621A805A3E9475BF0734731A9FA172FD278FC65DFB2976A848002282C41644EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2kdzu32n.035.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kdzu32n.035.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ff1jz44k.dll

Path C:\Users\Admin\AppData\Local\Temp\ff1jz44k\ff1jz44k.dll
Size 3KB
SHA256 54a2ed4b182c6d2868ff071c729998053fc58fde0993cc2e1a903d1094162647
MD5 b90d8d15834dd4bb8085dc9365c1e560
SHA1 19e7644148364e3c7b740acbc1e7b4dad5b885aa
SHA512 6a8730658a4ff71fb645cd1b8b2f8874ebf943b3f909ad18069caab909bc0defd8baf2b8743a761b3087f37bd5ff4aea188ca46282f48a1a31d0fc6d1a306842
TLSH
T1D3713006A7E84AA7E0B7433869E343155378F8649E37975B19C82328BC657646A32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5A1412DD38484534AE868321E3F256C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ff1jz44k\CSC5A1412DD38484534AE868321E3F256C.TMP
Size 652B
SHA256 38bbf556f6e18882b978266b5e325ce9dda57a2583238c36076835471a70ed23
MD5 17cd50f525bc41fae45d6a902092a585
SHA1 5f90348de3aa7ee90dc235dac4c234efc8a38e49
SHA512 11be9cc1765efd73bebbf49ea2226d23aef6df74236ad44ad7f76186c6194b20575fab86554657df617c5993eaf4804f1a988063881f3496c50585bfac6de6ee
TLSH
T11AF05E49B3F8121EF4F34B70BDF6436791A8BC64DE3293ED5480031928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ff1jz44k.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ff1jz44k\ff1jz44k.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

ff1jz44k.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ff1jz44k\ff1jz44k.cmdline
Size 369B
SHA256 70bc1f4bc62347cc0fdc99213af7a52886eaebcd9221659b7ca273d646e0738f
MD5 74631a04bcb420fa8d76565879138f5c
SHA1 147114cd4d922f2fb50c082aaa3bc2bae4990661
SHA512 7f503fffdd98e3563eea129a799f6e27c1d2d82ace2a15df7acb87fc6c1737da3ebeac81c25d2a844d9bfa24f3683b1352dddc163304ee10e79b7d7f7af992ea
TLSH
T1D7E0C02A924EC27F11DD600721A9D4ACE3B317432948BF8450C5440FD0770013BE1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3148-74-0x0000020C6F400000-0x0000020C6F408000-memory.dmp

Download

memory/3488-28-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/4948-13-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-31-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-15-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-16-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-17-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-19-0x00000161F1DF0000-0x00000161F1E40000-memory.dmp

Download

memory/4948-22-0x00000161F1DA0000-0x00000161F1DBE000-memory.dmp

Download

memory/4948-24-0x00000161F1A20000-0x00000161F1A2A000-memory.dmp

Download

memory/4948-26-0x00000161F1F00000-0x00000161F1F24000-memory.dmp

Download

memory/4948-25-0x00000161F1F00000-0x00000161F1F2A000-memory.dmp

Download

memory/4948-23-0x00000161F1E40000-0x00000161F1EF2000-memory.dmp

Download

memory/4948-0-0x00007FFAFD92F000-0x00007FFAFD930000-memory.dmp

Download

memory/4948-18-0x00000161F1D80000-0x00000161F1D92000-memory.dmp

Download

memory/4948-27-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-12-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-29-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-30-0x00000161F27B0000-0x00000161F2972000-memory.dmp

Download

memory/4948-14-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-33-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-37-0x00000161F2000000-0x00000161F201E000-memory.dmp

Download

memory/4948-38-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-39-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-40-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-41-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-42-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-56-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-11-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-9-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-10-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-8-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-7-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-6-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-5-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-4-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4948-3-0x00000161F1980000-0x00000161F19A2000-memory.dmp

Download