67196366b80be16edfd1ce95a9781aaa6dd51a1c07bef7e00d2981f9b0c7e237

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67196366b80be16e.ps1
Size 555KB
Sample261113-xwkpgafw21
SHA256 67196366b80be16edfd1ce95a9781aaa6dd51a1c07bef7e00d2981f9b0c7e237
MD5 62f3b1259592346154acb3eee03784a1
SHA1 c3292d13121e57d25f1d2a377d6e5cf94cfa98c0
SHA512 4f19e1070cd529c1262dda2de2ef36ec1bfcfd08a2e2dc59299c0efa2f3ea12d99e5c49c954c9396ed6921bae51e84afedddc5b58604c4a09795d99275ffdb25
SSDEEP 6144:GYOQh1JvvLu5hGn0nHZjj1xJILnCYGJ/Xn9/yoHf2P4MhoqIw0nq+VHwHwxJv3b3:GRe+Y0HZjxlYQ/3znqIH33bOsv
TLSH
T15CC45D347A022EFF5BB820C248D6850D663836B9C9682DF569CF4C93390D77627B79B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	5036	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 3116	5036	powershell.exe	88

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5036	powershell.exe
3528	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2640	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
3528	powershell.exe
3528	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe
Token: 33	5036	powershell.exe
Token: 34	5036	powershell.exe
Token: 35	5036	powershell.exe
Token: 36	5036	powershell.exe
Token: SeDebugPrivilege	1488	whoami.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe
Token: 33	5036	powershell.exe
Token: 34	5036	powershell.exe
Token: 35	5036	powershell.exe
Token: 36	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe
Token: 33	5036	powershell.exe
Token: 34	5036	powershell.exe
Token: 35	5036	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1488	5036	powershell.exe	87
PID 5036 wrote to memory of 3116	5036	powershell.exe	88
PID 5036 wrote to memory of 3116	5036	powershell.exe	88
PID 5036 wrote to memory of 3116	5036	powershell.exe	88
PID 5036 wrote to memory of 3116	5036	powershell.exe	88
PID 5036 wrote to memory of 3116	5036	powershell.exe	88
PID 4948 wrote to memory of 2640	4948	conhost.exe	100
PID 2640 wrote to memory of 3528	2640	cmd.exe	101
PID 3528 wrote to memory of 4276	3528	powershell.exe	102
PID 4276 wrote to memory of 3800	4276	csc.exe	103

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\67196366b80be16e.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4904

C:\Windows\system32\conhost.exe
conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4zbbcrub\4zbbcrub.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC6E.tmp" "c:\Users\Admin\AppData\Local\Temp\4zbbcrub\CSC8854820FF19E46408C8977C813B6257C.TMP"
        5⤵
        
        PID:3800

C:\Windows\system32\taskhostw.exe
taskhostw.exe conhost.exe --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 333KB
SHA256 0c17452ec371f1b2f71f60b17c79c4408e68b6bf7ed1e0f6845fc138448685a2
MD5 611dfbe522f4ea6c2d55783278ea7cb9
SHA1 c536e35ecc8d2d6d462442f67ba30be71d3ae92c
SHA512 235f714dba23d3f8f9a4bd241c89e2444ccd807221f6293774a6063b57c887d89d4556f1795560c89efe9c645711a2b6e56cd1028702c0f00ae4221db9b788a4
SSDEEP 6144:JtNn+AAPKik2Aodlz7BDMCLqUQAK0k1CdN3kFS3pnwIkq:HNn+AAPKik2HdkUbECdN0FNq
TLSH
T1B0746D347A422EFB5BB810C248C6810C562C36B9D9686DE57ACF0CA23F1D7751BB79B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 ae19d5fb9122eb3f5bfbde5364d6c7f1206ab89d6592315f69514d455d315bc9
MD5 bd5ac526558a1753a45425a0f0c28a62
SHA1 92dc535d870cb84e3bbc1143e24c9ca37001a2bb
SHA512 fbc1073d88dfcffeaeca43a5137eb09046123af76f54efb3876884bf3a3799c41100e4a99b841ee12b02c106b40f366ff45828e6ca0db4e6eb226d0098709ac1
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZ7qg0WPfsNySxBPFX:iqdYqGAjdx4qKkq3qktznEuZq6XIzo7q
TLSH
T1E281DD313275B0D4C9567F072A2819D463BF4386EA98AF4CB25C621ED92751BDB221F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6eec9aac583ab0e67680eb17d436743f1b561b44dadf377ff37d53803e597071
MD5 8357b591cf250229652e83eb5c27a01d
SHA1 15b3922b34a2c1174b58bfe1143a8f00f99ec39c
SHA512 a7e930e4e5209858e689cad0e63a4fd1b67bb882250b041ce1bdcbe06de93c6c782ade6cfcf61afb11e43043a4120cfeaafe0fb5e9daae23277b17b3b8f2ff83
TLSH
T1DA41B927B39C85D0D8C9257ADCEC5C117A6693C3C09F8FDB6AC0D610E5BF698DA69050
MD5 SHA1 SHA512 TLSH

Submit Download

4zbbcrub.dll

Path C:\Users\Admin\AppData\Local\Temp\4zbbcrub\4zbbcrub.dll
Size 3KB
SHA256 52bab7e305fe7e1001c87177504b7ddda49170f21a3a4825b9716ae0c8f3383e
MD5 1a4b69483ccf69ac7eb9dba04afab7b4
SHA1 eb4cfbf73b46ce4f922d505e6316c348e8751d57
SHA512 61be4190b6ba320cf936ab9b469ee7c4ee811721694125a998c7aaf471fdf8f1b24577546d29ff3981c9b7e9de0a37a13ed32601950b7b7da0892434fca20093
TLSH
T155715517A7E44AA6E0B7033859F343525378F8649F37575F19C41328BC657642E22BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESCC6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCC6E.tmp
Size 1KB
SHA256 bd05304f1abbe8550fab6d08e85b5cfe0458d7526aef0bc119a37cfaaa0ee31a
MD5 a62c0f6381e067a250693e878b267acd
SHA1 1b513762a913a35e4dda369d746f34f338608ad5
SHA512 fa1534a651a9610d7c98a11c941956f5634aeae3901ec32472abb154bb0408723e4ec708114885f98d28fae1de42de62d1d77792fb83e5739361ffc126b1a881
TLSH
T1C721AF0543E8471BF0B3173169F6076BA629FD59FF61536B844002282C51640DFA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_no204bv3.cpj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_no204bv3.cpj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4zbbcrub.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4zbbcrub\4zbbcrub.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

4zbbcrub.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4zbbcrub\4zbbcrub.cmdline
Size 369B
SHA256 fb9289c9a4029e8f65b6d4c796919ce800c8122b89861c9c1851857fdc63cb84
MD5 22f91f9ac304b3832421f75094ffc936
SHA1 e5ae83f8bf2afee865778c265c884335185b4983
SHA512 05d58fe933650040f6ecfd6e9278abaa6dc49a391e902ebacf7ec93ede3affa5e7b6cb58ac293326c26e8c5cb914211f90626f448d2104aa955b1475bbee47b7
TLSH
T136E0C03B4346C27D01FE100B2169C9ACC37207473A407F84D960441DD0D7D046BD1749
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8854820FF19E46408C8977C813B6257C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4zbbcrub\CSC8854820FF19E46408C8977C813B6257C.TMP
Size 652B
SHA256 cb26271947af0292c5494cb7e8b1f49d89b4a1ffed000766b594d30db629c171
MD5 10baf7c0b4022fa650112e64dfdfbd7d
SHA1 536bbf019cddaf4f19c59b849287d2aedd8a4c9e
SHA512 cef1ad64cbf2e27bf92d6915dbf9e6681ae98ed375c3ff890efece7663047f7c2480ea18cc9a1f64939a90808a25f1eaefb57f3e850ca63bfaec614623844fde
TLSH
T123F0540A63F8020EF0F34B31BDF543A79569BC65EE3253ED5440031D1C745108A62F72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3116-16-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/3528-58-0x000001F49CB10000-0x000001F49CB18000-memory.dmp

Download

memory/5036-12-0x000001E93A260000-0x000001E93A2B0000-memory.dmp

Download

memory/5036-20-0x000001E939460000-0x000001E939470000-memory.dmp

Download

memory/5036-19-0x000001E939460000-0x000001E939470000-memory.dmp

Download

memory/5036-18-0x000001E939460000-0x000001E939470000-memory.dmp

Download

memory/5036-17-0x000001E93A890000-0x000001E93AA52000-memory.dmp

Download

memory/5036-15-0x000001E939460000-0x000001E939470000-memory.dmp

Download

memory/5036-13-0x000001E93A210000-0x000001E93A23A000-memory.dmp

Download

memory/5036-14-0x000001E93A210000-0x000001E93A234000-memory.dmp

Download

memory/5036-1-0x000001E939460000-0x000001E939470000-memory.dmp

Download

memory/5036-11-0x000001E93A1D0000-0x000001E93A1E2000-memory.dmp

Download

memory/5036-10-0x000001E939460000-0x000001E939470000-memory.dmp

Download

memory/5036-9-0x000001E939E20000-0x000001E939E42000-memory.dmp

Download

memory/5036-0-0x000001E939460000-0x000001E939470000-memory.dmp

Download