2 process(es) observed

PowerShell script blocks the sample executed, as PowerShell itself logged them (event 4104) - so an encoded or Invoke-Expression-decoded payload is captured in its final, deobfuscated form, the way it actually ran.

$global:?

# Collects a short inventory of the machine and writes it beside itself.
$report = Join-Path $env:TEMP "inventory.txt"
"host: $env:COMPUTERNAME" | Out-File $report
"user: $env:USERNAME" | Out-File $report -Append
Get-Process | Select-Object -First 15 Name, Id | Out-File $report -Append
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" |
    Select-Object ProductName, CurrentBuild | Out-File $report -Append
Get-ChildItem "$env:USERPROFILE\Desktop" | Out-File $report -Append
Get-Content $report | Select-Object -First 5

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis indicates that the sample executed successfully within the sandbox environment. During the execution, two processes were observed, with one of them being `powershell.exe`. The sample created and modified a file named `inventory.txt` in the `C:\Users\user\AppData\Local\Temp\` directory. However, there is no evidence of initial access, persistence mechanisms, defense evasion techniques, command and control (C2) communications, or any significant impact on the system. The lack of network activity, registry modifications, or other notable behaviors suggests that the sample's capabilities and intent remain unclear based on the observed data. Therefore, while the sample did execute and perform some file operations, the overall analysis does not provide sufficient evidence to classify it definitively as malicious. Verdict: The sample executed but lacks sufficient evidence to determine its malicious intent or capabilities. Further analysis may be required to assess its behavior in a different context or environment.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

rule auto_file_2371_yara
{
    meta:
        description = "Auto-generated from scan 2371"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" |" ascii fullword
        $s1 = "Get-ChildItem \"$env:USERPROFILE\\Desktop\" | Out-File $report -Append" ascii fullword
        $s2 = "$report = Join-Path $env:TEMP \"inventory.txt\"" ascii fullword
        $s3 = "Get-Process | Select-Object -First 15 Name, Id | Out-File $report -Append" ascii fullword
        $s4 = "Get-Content $report | Select-Object -First 5" ascii fullword
    condition:
        filesize < 65536 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).