03b5abfd235a0f6a5ec9e7c2cf7793c72bf83065e430b5502a033d42bcd64247

Analysis

max time kernel
298s
max time network
290s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/11/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
planner.ps1
Size 16KB
Sample261114-c69fcshz6p
SHA256 03b5abfd235a0f6a5ec9e7c2cf7793c72bf83065e430b5502a033d42bcd64247
MD5 710a10b91a7ecf21a3db0724055f6f63
SHA1 06055f7bb9efb9a65d754de8e6da571a6aa3e211
SHA512 e66cd8a9b7228f9de8343ed8d7467864e9fe33d80ca917ba8fe39520cf837ca21ffcf6857263147ff7d77c0999db28353ee12455e06326918e13dee963c43f58
SSDEEP 384:qTGcjmVuBUh+FHAv5AOq4tpReScTIrRGrPlJ64/yjTp:qqcCgBJgJWSJVGr64/yjTp
TLSH
T18672B68313419ABAF5CE27B7EC47150474F88829F99E0154FBBEBCD7A6AAC404638F45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	524	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	524	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
524	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
524	powershell.exe
524	powershell.exe
524	powershell.exe
524	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 2612	524	powershell.exe	85
PID 524 wrote to memory of 2612	524	powershell.exe	85

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\planner.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  PID:2612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 19KB
SHA256 f20b11d078b2c2d72b479754fdfc2501044611f6ea7bf4a0d95384258b00c093
MD5 b2dd210f546cfd40a93c2f6abe31dc29
SHA1 3c81d98c3ff39e18d4c026ef964fde573feed198
SHA512 1b67fba3c04625a9174537b0ddd64abbc02caf7e3422e5810dd74dc7d77bdce1e4b1f40e3b5e85e67e46f80c9ca8185028adb00a6465d77caf526b647b0f2b7a
SSDEEP 384:L0juV7KxkXqKf/pUZNCgVLH2HfgslRP7pLuLceScdXODu1+ErU3pfHGyr7UNQXtO:LYuV7KxkXqKf/pUZNCgVLH2HfgsDP7pQ
TLSH
T1A592F9676C48AA7B4F94C6CCDD27BE8FDDF5021A65D9886483FA482503D4BCB12072E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 64563b65d9e27bd591836fae07a029d5306d2f52c45cd6a19aab6c2996161954
MD5 90ac9ccf1124084d184a247f16ac7a45
SHA1 ff250b07132907d33c29b197e7a1ed0bfb4b6c21
SHA512 819daa435afe86de23320c4b51f6748b60f76d2a95ad938d2a0410285377c2cbf8aa7e29ae14e7e802bc290e397b81bdb7aeda545395669a0ce0c752d6357c24
SSDEEP 768:ZoWdJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnLlJUrU2rha7Aif:ZoWdJu1jaCL72cH
TLSH
T167C2093B640CCB7E4F800E9D9D6A6F966D9802D76AA88D408BFE954C02C77ED51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\background.js
Size 20KB
SHA256 c563147ae45fc0851bff707d07e5a40634ec9128f696fb84e7cad10d223a7650
MD5 a64c945924687c8d2496574df68fb0c9
SHA1 661c7df948c36ab245f6385c2db78cae6d612d8b
SHA512 8a5f98e0ef619b76b233b5bc1ec16b49e27fd337bcc3c7ec91ebc12ad78613dc2edb3471a8508c6b8d5ee0160cc19762a56af88612a43b115839a5d711a26583
SSDEEP 384:i4wtGot+SFFsgW709B9QKHBBPCCiEg67MbN9s+5YLHfp:TwQmhW45SyN+cx
TLSH
T16892B44A17BE143981B133B9AF475052FB31D937198287AC7BAC91604F7982486B9FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\config.js
Size 258B
SHA256 b2ada5ac49025994e7cc1db476d7d89184e261cf1301c2c9f19a0ff5fcf52b51
MD5 83203a0b96929d862e916bdb9ca7eea5
SHA1 92136ed7a4002c4b3976637d896e44b27d36249c
SHA512 772c2acccffe003fce0104f2dcc28e1d7f3b3620d6f429b4d68b6de86cf4e5e365c03b2ddd17f544b6ea71f71e5839da3ec9ccdc491a7a0ff3fc6de44a4df9b2
TLSH
T1EED05E821AEBB9611214BFC098B62050F40A12487A56ACCCF56DA893849350B1EECB70
MD5 SHA1 SHA512 TLSH

Submit Download

icon128.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\icons\icon128.png
Size 23KB
SHA256 cd65c7a25509beb4e27278a7983235755b9c6f831552815f49348fbb74679bd7
MD5 bd4e8be0b1e695957b5e75afe2011c10
SHA1 9cec497d2055f9b34c601dcdf59f29bdec593ea5
SHA512 6be2d80367d7397f56dbff21678eab57b915ec7be6f0060bb320e8e366f2dd8bea8b173aefac6f179b360546434f07ee0acfc58ae758221f6c30f59cae244c08
SSDEEP 384:/7Se4iPbMpcdkWNZ78COZecdnus+ALuGvDy+F3/XbYBt972nNSm9K6irSATMO:/j4Wdk4dPMndnY43/MBz/3pL
TLSH
T19EB2E1AB64A3093BEE3B4AB1AA8657246CA97F5D9074C49CF811BB414F3CCD433A0442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon16.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\icons\icon16.png
Size 915B
SHA256 c66b82cfc1600b3df8421e3eed70fa04c4d8fbbc261b3de030a8c41ffc6627f2
MD5 6d75ce4f15bd5cfbd2a5260caa796d33
SHA1 4d9be3d10432c150bb95417f7c56a4a1e1d41a3b
SHA512 fae045c855532afb495c48e57e4e8f3e357a8a3ff4401e9f7b4c0fb58eb15b6318c17b8146a143328b4a02456a0e4760e2ed09e1989d96549bac0a4e406119c5
TLSH
T1FC11B7BE1775EDF8D6CB60E51D0B20C29D63774F06314A0F3C69C9A2C1780844AD0A83
MD5 SHA1 SHA512 TLSH

Submit Download

icon256.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\icons\icon256.png
Size 73KB
SHA256 a2701b6a0031ab0f416bb71a423755248a5adfc172b08b7067be45472e21300e
MD5 18bb8be232cbc666b1ad782975340468
SHA1 6a3ae6c48261adde58e4e64c221270a8bfd56253
SHA512 7ac82ef446f25386bec8e7669a651177e9b6873b7a4f1ace3e32cabef7d609efbe47f690e3950f9a0edbc16a1e759156bdaf75793fcfdcf2b08e2f0d0715fa41
SSDEEP 1536:WQ/8AhCfOOWfE4x0smmgEOl1g0DQiiRXjbE+jxTwG7SqJ7J+vXX6YosBm:J8AhWWPwlS0tiRTbECh5WX7osBm
TLSH
T1BF73122F39055707F7C43F04AE2689F236962BBFCCD17D5C143B65A5FA8908F8946A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon48.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\icons\icon48.png
Size 4KB
SHA256 2bc7533ade7feafb798554a3a083589266199e077887c275e120fbdebbef4caa
MD5 3b7e8006582987e8eb3a530a2d2d61bf
SHA1 40e90589046787f8856950ead04502cc50f90c23
SHA512 e70cbec87a5be00204d1e29608f9ebf0125475b717df1a75b3d97a8a332323b94e44ec0a4b3a908430f2d93e827723f54e4bcae7804cb5c0a3017cb892cd4b42
SSDEEP 96:PtSXQqhDBnBlz+XgE+Ud1K0tiElcubmgdyk1m+xyPnDN/5hH/:PnIf+X51KtEFSApkfDN/P
TLSH
T1BBA19DF23BAF3288DF88816BFE8274B139901014F1243A3542F9663BF5749E92A10C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\manifest.json
Size 748B
SHA256 8eaff859edfd778a9a4650e00df1be1634465a2093b6eb6c2c5bd8bcbafc36b8
MD5 dc331e3d9ed19d80a8ca4d0b1e5d0993
SHA1 5b8aaed7f5fd5747d746e46bf3a405563a3bbe01
SHA512 e165b6ae700f7f79beff9ed74e5f34475f9edd2545a6d3953507a0011b080b101a1b4efecf28b5c0c0ac26411e7517d1db8e1abd528d5b7695db613007193476
TLSH
T1BA012827D824887F0378977C69B10E03F1261B0B59505C9A74FA5158CFB466A419BF48
MD5 SHA1 SHA512 TLSH

Submit Download

popup.css

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\popup.css
Size 4KB
SHA256 0e827cc85e4859c057484ad5701fc94c2fd1d2ff7097e22ea726127a4a5498c9
MD5 4ccbf07a53ccd886f41e9823de21b9ba
SHA1 08b805632ad2f6393acea2f0535c45a7f52e0a1c
SHA512 c65f6d14f26035c8ca9b74e809f8e5e14949524c714cb812294d3801440ac666b9a3f9af13ab488f58bf2029a03636a5da5a141b40b692cd153a00d023263849
SSDEEP 96:ZFM5bOIIqkmoUQbYa87PAMP2vudJ3wjvP/KPHRyPI5PWGLPb/ztt:ZFM5bTInU4+XJgj+1f7
TLSH
T10CB14454E7155150B533DFB4F7C39B86BBB855528A0103B9BFE01018B28B7BE9660FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popup.html

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\popup.html
Size 1KB
SHA256 bc36387492dd161ae77f1d4e434ab360c42d0753e9a2026d3d3db9916f4f64e5
MD5 3156fe58a2b046f5f54db5ff817db982
SHA1 49d90e8b4023b3ae2b254816a4683db2fd4ee298
SHA512 b643f59f2ef8aea8df0f71f64e3329e0ae8c73147445c6e790479f3f0737b4b6fb39f44a94d989d456d4e994006d3cd52a63a8d706629638d2eae3b3ca9cc3eb
TLSH
T1D0319D21A4CA1937123385D9A693EB56FEE49183C7952D1038FC13A31FF3E49C61F556
MD5 SHA1 SHA512 TLSH

Submit Download

popup.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\767666F5A0E06C4B99CCA35E26DB929AD4D57CA94AF8645240445EC22BE9253E\popup.js
Size 5KB
SHA256 9245ac2669c0526047f1bcac0e1a509d18641e438ad7025ca99d4ade5d977353
MD5 4c62e79ac6dce8bb60a620f39299ba10
SHA1 115d331f56455c8c2690c3ad1e1331a1691e02cb
SHA512 75aacafb4b5c6eaa73aed98bdf87a1947a8679f19de66438dfb6603ce8ecf735d857db18bacf273211615cad545aa9f22f96c5caa9984a2a1fd7a1075c779cea
SSDEEP 96:Ze1hiqstWzaoYb/S4f5QJMVtk+CC4XEjR2bzzwEbQLrRgV/qItrhgs9O0bZLo6XB:Ze1hiquWeH9f59I+jgQaz0hLrRgVlrXr
TLSH
T142C174AE20760431C9716265F79B962AFE3586133D51490179BC85183F39E61C1FBFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pkungjjo.o4d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkungjjo.o4d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/524-9-0x0000029550B80000-0x0000029550BA2000-memory.dmp

Download

memory/524-12-0x0000029550C30000-0x0000029550C40000-memory.dmp

Download

memory/524-0-0x0000029550C30000-0x0000029550C40000-memory.dmp

Download

memory/524-10-0x0000029550C30000-0x0000029550C40000-memory.dmp

Download

memory/524-86-0x0000029550C30000-0x0000029550C40000-memory.dmp

Download

memory/524-11-0x000002956C0A0000-0x000002956C190000-memory.dmp

Download

memory/524-97-0x000002956C460000-0x000002956C622000-memory.dmp

Download

memory/524-98-0x000002956C2E0000-0x000002956C330000-memory.dmp

Download

memory/524-99-0x000002956CB60000-0x000002956D088000-memory.dmp

Download

memory/524-1-0x0000029550C30000-0x0000029550C40000-memory.dmp

Download