Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/04/2026, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
form_99806.pdf.decrypted.ps1
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
form_99806.pdf.decrypted.ps1
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target form_99806.pdf.decrypted.ps1
- Size 9KB
- Sample260413-vsxthsc15p
- SHA256 cb1a41580d2053e337dd0c04843b9ca1d2609610f943cdc4cedcdae3aad0d290
- MD5 02de2959ce625bebf36664b21ccf3c5b
- SHA1 c4225d8597131c4954bbabb148ec0b2ed577e1ee
- SHA512 009cc1979779b54693fcc3c2c2aa6e60c6c6ec1524fda2b436e8fc2d478dae206dd14774f75358b8d7f8442512d56a24a196a8c76246ef86ecaf56bf21eb0606
- SSDEEP 192:vDaISPMMfrpZdbNTMZu7UeGQbAEOa58vC5GPUo8Ty6bTzy6Nka094aEiesPs3cKQ:huwGUa58vnALbTrNkasgXQ
- TLSH T1C212C81366AE4C334157DA35E49278881E362A970007AD55BB6C7388EFC0B7DCBC539E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 6104 powershell.exe 6 6104 powershell.exe 20 6104 powershell.exe - Deletes itself 1 IoCs
pid Process 6104 powershell.exe -
pid Process 6104 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 6104 powershell.exe 6104 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 6104 powershell.exe Token: SeIncreaseQuotaPrivilege 6104 powershell.exe Token: SeSecurityPrivilege 6104 powershell.exe Token: SeTakeOwnershipPrivilege 6104 powershell.exe Token: SeLoadDriverPrivilege 6104 powershell.exe Token: SeSystemProfilePrivilege 6104 powershell.exe Token: SeSystemtimePrivilege 6104 powershell.exe Token: SeProfSingleProcessPrivilege 6104 powershell.exe Token: SeIncBasePriorityPrivilege 6104 powershell.exe Token: SeCreatePagefilePrivilege 6104 powershell.exe Token: SeBackupPrivilege 6104 powershell.exe Token: SeRestorePrivilege 6104 powershell.exe Token: SeShutdownPrivilege 6104 powershell.exe Token: SeDebugPrivilege 6104 powershell.exe Token: SeSystemEnvironmentPrivilege 6104 powershell.exe Token: SeRemoteShutdownPrivilege 6104 powershell.exe Token: SeUndockPrivilege 6104 powershell.exe Token: SeManageVolumePrivilege 6104 powershell.exe Token: 33 6104 powershell.exe Token: 34 6104 powershell.exe Token: 35 6104 powershell.exe Token: 36 6104 powershell.exe Token: SeIncreaseQuotaPrivilege 6104 powershell.exe Token: SeSecurityPrivilege 6104 powershell.exe Token: SeTakeOwnershipPrivilege 6104 powershell.exe Token: SeLoadDriverPrivilege 6104 powershell.exe Token: SeSystemProfilePrivilege 6104 powershell.exe Token: SeSystemtimePrivilege 6104 powershell.exe Token: SeProfSingleProcessPrivilege 6104 powershell.exe Token: SeIncBasePriorityPrivilege 6104 powershell.exe Token: SeCreatePagefilePrivilege 6104 powershell.exe Token: SeBackupPrivilege 6104 powershell.exe Token: SeRestorePrivilege 6104 powershell.exe Token: SeShutdownPrivilege 6104 powershell.exe Token: SeDebugPrivilege 6104 powershell.exe Token: SeSystemEnvironmentPrivilege 6104 powershell.exe Token: SeRemoteShutdownPrivilege 6104 powershell.exe Token: SeUndockPrivilege 6104 powershell.exe Token: SeManageVolumePrivilege 6104 powershell.exe Token: 33 6104 powershell.exe Token: 34 6104 powershell.exe Token: 35 6104 powershell.exe Token: 36 6104 powershell.exe Token: SeIncreaseQuotaPrivilege 6104 powershell.exe Token: SeSecurityPrivilege 6104 powershell.exe Token: SeTakeOwnershipPrivilege 6104 powershell.exe Token: SeLoadDriverPrivilege 6104 powershell.exe Token: SeSystemProfilePrivilege 6104 powershell.exe Token: SeSystemtimePrivilege 6104 powershell.exe Token: SeProfSingleProcessPrivilege 6104 powershell.exe Token: SeIncBasePriorityPrivilege 6104 powershell.exe Token: SeCreatePagefilePrivilege 6104 powershell.exe Token: SeBackupPrivilege 6104 powershell.exe Token: SeRestorePrivilege 6104 powershell.exe Token: SeShutdownPrivilege 6104 powershell.exe Token: SeDebugPrivilege 6104 powershell.exe Token: SeSystemEnvironmentPrivilege 6104 powershell.exe Token: SeRemoteShutdownPrivilege 6104 powershell.exe Token: SeUndockPrivilege 6104 powershell.exe Token: SeManageVolumePrivilege 6104 powershell.exe Token: 33 6104 powershell.exe Token: 34 6104 powershell.exe Token: 35 6104 powershell.exe Token: 36 6104 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\form_99806.pdf.decrypted.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ycbzfufs.xp4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH