6d93b1edb1cc9d34899ce6e357653506f0b79bdaa3697e13d013359936079f18

Analysis

max time kernel
298s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
World Energy PO# ZY-2604-27-pdf.vbs
Size 2.9MB
Sample260504-sga49set71
SHA256 6d93b1edb1cc9d34899ce6e357653506f0b79bdaa3697e13d013359936079f18
MD5 1aefaee6349a1730895815807f0bc17f
SHA1 07fb08f54ba4e11fbbd35f6f67882b95cdf7bca2
SHA512 9039b6ad8f94f5327746bedc854b96e0c6153fdc23169abea3b1c38b11ab811a34d8a0198c87be00711a0895e661398b404e07881210e28153fe720e3e895c6e
SSDEEP 768:i2tHUU0AlpWCpWUBONGjsgUdU3ZUU+S6FU8U6H+3/9dZpFcx3J4UVaMUpHxQjEjQ:6l
TLSH
T1E8E5B7B76FB0B59A48310464A8A3F8A89D77D68F7CE92D67142613950C2F2EC4CF52D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	848	powershell.exe	82

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3724	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3724	powershell.exe
1328	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3724 set thread context of 4892	3724	powershell.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1328	powershell.exe
1328	powershell.exe
3724	powershell.exe
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1328	3128	WScript.exe	80
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85
PID 3724 wrote to memory of 4892	3724	powershell.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\World Energy PO# ZY-2604-27-pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\World Energy PO# ZY-2604-27-pdf.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\World Energy PO# ZY-2604-27-pdf.vbs' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  2⤵
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 026d1569cc7d92522224cb7202b04adbf0978279191ab5814949d1ff9d618a6e
MD5 5b84d29fd77754bcac2b74bd815e2d83
SHA1 f8f5ec2d7ed3dbfd3028d7182306e9817b4493e0
SHA512 e12efddd4b134b72853b9a3007e5d43f28f749e191d0a38fda5522eb6ebc2770d5e68e80cf7b9c3d51a54e3b0f1277760208a2c3addab8014f0174b0ed06194f
TLSH
T1B0117A33B79CC134C8D9157A1088AD11B1B5C3CB049EDE8F7B84C109E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xh1jqry3.swv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xh1jqry3.swv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1328-23-0x00000202D90F0000-0x00000202D9102000-memory.dmp

Download

memory/1328-9-0x00000202D72A0000-0x00000202D72B0000-memory.dmp

Download

memory/1328-8-0x00000202F1160000-0x00000202F1182000-memory.dmp

Download

memory/1328-22-0x00000202D8B80000-0x00000202D8B8C000-memory.dmp

Download

memory/1328-21-0x00000202D6FC0000-0x00000202D716C000-memory.dmp

Download

memory/1328-1-0x00000202D72A0000-0x00000202D72B0000-memory.dmp

Download

memory/1328-0-0x00000202D72A0000-0x00000202D72B0000-memory.dmp

Download

memory/3128-11-0x0000023DC9980000-0x0000023DC998C000-memory.dmp

Download

memory/3128-10-0x0000023DC98D0000-0x0000023DC997F000-memory.dmp

Download

memory/3724-34-0x000001DAF0940000-0x000001DAF094C000-memory.dmp

Download

memory/3724-24-0x000001DAF1470000-0x000001DAF157C000-memory.dmp

Download

memory/3724-33-0x000001DAEED70000-0x000001DAEEF1C000-memory.dmp

Download

memory/3724-35-0x000001DAF09E0000-0x000001DAF09F2000-memory.dmp

Download

memory/4892-27-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-29-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-30-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-28-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-26-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-25-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-36-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4892-37-0x00000239A87F0000-0x00000239A88C6000-memory.dmp

Download

memory/4892-50-0x00000239A87F0000-0x00000239A88C6000-memory.dmp

Download