67196366b80be16edfd1ce95a9781aaa6dd51a1c07bef7e00d2981f9b0c7e237

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67196366b80be16e.ps1
Size 555KB
Sample261113-xwkpgafw21
SHA256 67196366b80be16edfd1ce95a9781aaa6dd51a1c07bef7e00d2981f9b0c7e237
MD5 62f3b1259592346154acb3eee03784a1
SHA1 c3292d13121e57d25f1d2a377d6e5cf94cfa98c0
SHA512 4f19e1070cd529c1262dda2de2ef36ec1bfcfd08a2e2dc59299c0efa2f3ea12d99e5c49c954c9396ed6921bae51e84afedddc5b58604c4a09795d99275ffdb25
SSDEEP 6144:GYOQh1JvvLu5hGn0nHZjj1xJILnCYGJ/Xn9/yoHf2P4MhoqIw0nq+VHwHwxJv3b3:GRe+Y0HZjxlYQ/3znqIH33bOsv
TLSH
T15CC45D347A022EFF5BB820C248D6850D663836B9C9682DF569CF4C93390D77627B79B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4668	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 5212	4668	PowerShell.exe	94

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4668	PowerShell.exe
4868	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1740	cmd.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4668	PowerShell.exe
4668	PowerShell.exe
4668	PowerShell.exe
4668	PowerShell.exe
4868	powershell.exe
4868	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4668	PowerShell.exe
Token: SeSecurityPrivilege	4668	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4668	PowerShell.exe
Token: SeLoadDriverPrivilege	4668	PowerShell.exe
Token: SeSystemProfilePrivilege	4668	PowerShell.exe
Token: SeSystemtimePrivilege	4668	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4668	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4668	PowerShell.exe
Token: SeCreatePagefilePrivilege	4668	PowerShell.exe
Token: SeBackupPrivilege	4668	PowerShell.exe
Token: SeRestorePrivilege	4668	PowerShell.exe
Token: SeShutdownPrivilege	4668	PowerShell.exe
Token: SeDebugPrivilege	4668	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4668	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4668	PowerShell.exe
Token: SeUndockPrivilege	4668	PowerShell.exe
Token: SeManageVolumePrivilege	4668	PowerShell.exe
Token: 33	4668	PowerShell.exe
Token: 34	4668	PowerShell.exe
Token: 35	4668	PowerShell.exe
Token: 36	4668	PowerShell.exe
Token: SeDebugPrivilege	4300	whoami.exe
Token: SeIncreaseQuotaPrivilege	4668	PowerShell.exe
Token: SeSecurityPrivilege	4668	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4668	PowerShell.exe
Token: SeLoadDriverPrivilege	4668	PowerShell.exe
Token: SeSystemProfilePrivilege	4668	PowerShell.exe
Token: SeSystemtimePrivilege	4668	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4668	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4668	PowerShell.exe
Token: SeCreatePagefilePrivilege	4668	PowerShell.exe
Token: SeBackupPrivilege	4668	PowerShell.exe
Token: SeRestorePrivilege	4668	PowerShell.exe
Token: SeShutdownPrivilege	4668	PowerShell.exe
Token: SeDebugPrivilege	4668	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4668	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4668	PowerShell.exe
Token: SeUndockPrivilege	4668	PowerShell.exe
Token: SeManageVolumePrivilege	4668	PowerShell.exe
Token: 33	4668	PowerShell.exe
Token: 34	4668	PowerShell.exe
Token: 35	4668	PowerShell.exe
Token: 36	4668	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4668	PowerShell.exe
Token: SeSecurityPrivilege	4668	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4668	PowerShell.exe
Token: SeLoadDriverPrivilege	4668	PowerShell.exe
Token: SeSystemProfilePrivilege	4668	PowerShell.exe
Token: SeSystemtimePrivilege	4668	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4668	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4668	PowerShell.exe
Token: SeCreatePagefilePrivilege	4668	PowerShell.exe
Token: SeBackupPrivilege	4668	PowerShell.exe
Token: SeRestorePrivilege	4668	PowerShell.exe
Token: SeShutdownPrivilege	4668	PowerShell.exe
Token: SeDebugPrivilege	4668	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4668	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4668	PowerShell.exe
Token: SeUndockPrivilege	4668	PowerShell.exe
Token: SeManageVolumePrivilege	4668	PowerShell.exe
Token: 33	4668	PowerShell.exe
Token: 34	4668	PowerShell.exe
Token: 35	4668	PowerShell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4300	4668	PowerShell.exe	93
PID 4668 wrote to memory of 5212	4668	PowerShell.exe	94
PID 4668 wrote to memory of 5212	4668	PowerShell.exe	94
PID 4668 wrote to memory of 5212	4668	PowerShell.exe	94
PID 4668 wrote to memory of 5212	4668	PowerShell.exe	94
PID 4668 wrote to memory of 5212	4668	PowerShell.exe	94
PID 1484 wrote to memory of 1740	1484	conhost.exe	99
PID 1740 wrote to memory of 4868	1740	cmd.exe	100
PID 4868 wrote to memory of 2832	4868	powershell.exe	101
PID 2832 wrote to memory of 1456	2832	csc.exe	102

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\67196366b80be16e.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\system32\whoami.exe
  "C:\Windows\system32\whoami.exe" /user
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5532

C:\Windows\system32\conhost.exe
"conhost.exe" --headless cmd.exe /c powershell -ep bypass -file "C:\ProgramData\sharepoint-assist.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -file C:\ProgramData\sharepoint-assist.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lwbhvq1o\lwbhvq1o.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES875D.tmp" "c:\Users\Admin\AppData\Local\Temp\lwbhvq1o\CSCBFBA2CE0EFC7456EA335768FB3F69C5E.TMP"
        5⤵
        
        PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharepoint-assist.ps1

Path C:\ProgramData\sharepoint-assist.ps1
Size 361KB
SHA256 ac121cd3c2b203ede20e4c22c80ccae39a1292f9ed61ea19aa6a694a1cc3d4b1
MD5 f7d2b408d87e27b019f4b99b6e784a0a
SHA1 ec12bf6a03e57525cacef47f686cc1c81cf519c6
SHA512 abb1e2c0e650a53e0a1aff1e618dc619e0c592bb0f7bc0834d2960e8ed884b54f2fbe4dfd0fb14f275d063158b9aa3b22e116c840a65d10d5c5c0af37702a9bf
SSDEEP 6144:ogKDipbI6I1SDtxe1xzyheIxFkqmYknwtgC7ZqT2od0fjioXcMVpHzg19g4:oVUFt7MefxPVS1y4
TLSH
T19B746E3479422DFF5BA8208248D6C51C563C22B9C9682CE17ACF5CA23F0D77627B79B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7dd14ca16cd4567f6a8958eb94e7de25c5e805beffe995a9f5a20709c325b630
MD5 63cb5cb62251a83a3b2e1245802157e0
SHA1 81c1965189033a73281415b7dec057b0ef463168
SHA512 5908efb04c0232e71725ca53a7e015f38e34e67bc3a1c3f81eea7fe5ab265238e87d2c5f64135198656d03fff6f93f4a59dab59cfc2d49fef3865338e3d91d72
TLSH
T18C41A833B3DC82D0C88960BADCDD6C103AB693D7809FCEDB6B80E115E56F798DA68050
MD5 SHA1 SHA512 TLSH

Submit Download

RES875D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES875D.tmp
Size 1KB
SHA256 6e48cb444f4d46020d0f13ad4ea2e648cf90f48ea8d01ec34bca33c32787b237
MD5 212ee1e96969217419b8be3e550d0918
SHA1 f8a6d1b872f1d34c27bf1787d675459a1059712c
SHA512 d0756d5bca077441cd1c1e0a8e20db43669bcd76595e0b00f05394fc2f1ae72a601646e93a651fb24e47b559a6ea9e1863f7cc325ac46691766037c49e80d9b4
TLSH
T10D21660183E9471BF0B35731BDEA1B6BE668FD64EFA293AB448002292C51100DEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qp5e25e0.tlb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qp5e25e0.tlb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lwbhvq1o.dll

Path C:\Users\Admin\AppData\Local\Temp\lwbhvq1o\lwbhvq1o.dll
Size 3KB
SHA256 a2183d1aaad0a62aee793abc85bdce651f16d67e55ace8633b4428d90fe5475b
MD5 e2c668d04bcc3e162ca4efe6414cb069
SHA1 40bed43cfaaebc22d3cb29ff2587e7f2d4701320
SHA512 644182b479485e16dbfc3e626513b3929846c9ee16b2980d63f0bed8d1290e2490703416b7ede5ae33405ffdbb9e893bf8e91c8b82611d2186c156a1bea0ca31
TLSH
T1CD715206A7E44AA2E0B703387DE303525378F8609F37575B18C42328BC657242A62BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBFBA2CE0EFC7456EA335768FB3F69C5E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lwbhvq1o\CSCBFBA2CE0EFC7456EA335768FB3F69C5E.TMP
Size 652B
SHA256 77d779da03035a03f554756f8047afea4289ca78611b62b8aa54d9f0da56dbf9
MD5 57774161cf64de864f9e23ea61f75271
SHA1 acb4ee6297d1130904269ea4a62f6e5674e7ebaf
SHA512 74d96f111801a76c45e0189adf4bdd8bfa22951d0070bba82a7e24a3f3fba2e252a1933c646bcc1097aefd7dc05f2f1dc3a1d5c544b174de533bcf7ee5dc1a46
TLSH
T1BDF05E0963F8420EF0F34B30BDF653A3A1A8BC64EE3293ED148003192C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lwbhvq1o.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lwbhvq1o\lwbhvq1o.0.cs
Size 952B
SHA256 154adea72f278a7dd02e261c3f28f9ed1c9024ea17b03b241ad9d72b5551fe2f
MD5 f5710bff2979d1748cab22cf678a513b
SHA1 942e86b39df8823f96c89c612081c5f63e764478
SHA512 73e5a4cfac820db05056b39bc3ef0fa853a1473353baac254414d7dd347ed70d9f7cc91b6964feff03002a12de7eec0c0622dfce772d63d3d89acede138c26fa
TLSH
T13D118548BAB26B9441A3083E4BCE84197722E62729DE9815BB0C5310DF8B42199B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

lwbhvq1o.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lwbhvq1o\lwbhvq1o.cmdline
Size 369B
SHA256 c5a9a4a13c24a36884c96aa4cc34b0bc32a060b491afb9de942c5e345ccc662f
MD5 84805080f7f18bfa5686577ad013d933
SHA1 8798a94a3bde67894f80025808dc11307f0340a0
SHA512 beb6cf44dfaa28b43f8352c07f0058781da28ba8e76744bda661aa80623748de2c9f7810d9071b2e820eb34452963a1be192898c496e689b3a1e0aff596cbdfe
TLSH
T119E0262B9356C67F15EF110B32EACEACE376078739817F849150885FE227004ABE2799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4668-25-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-29-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-13-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-14-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-15-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-16-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-17-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-18-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-20-0x000001B9D6430000-0x000001B9D6480000-memory.dmp

Download

memory/4668-19-0x000001B9D6040000-0x000001B9D6052000-memory.dmp

Download

memory/4668-23-0x000001B9D6060000-0x000001B9D607E000-memory.dmp

Download

memory/4668-24-0x000001B9D6480000-0x000001B9D6532000-memory.dmp

Download

memory/4668-26-0x000001B9D6030000-0x000001B9D603A000-memory.dmp

Download

memory/4668-0-0x00007FFB8794F000-0x00007FFB87950000-memory.dmp

Download

memory/4668-11-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-28-0x000001B9D6540000-0x000001B9D6564000-memory.dmp

Download

memory/4668-27-0x000001B9D6540000-0x000001B9D656A000-memory.dmp

Download

memory/4668-12-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-30-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-4-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-33-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-34-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-35-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-36-0x000001B9D6E10000-0x000001B9D6FD2000-memory.dmp

Download

memory/4668-40-0x000001B9D6640000-0x000001B9D665E000-memory.dmp

Download

memory/4668-54-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-10-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-9-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-8-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-7-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-6-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-5-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4668-3-0x000001B9BDA20000-0x000001B9BDA42000-memory.dmp

Download

memory/4868-73-0x0000027A32E40000-0x0000027A32E48000-memory.dmp

Download

memory/5212-31-0x0000000140000000-0x0000000140004000-memory.dmp

Download