Overview

overview

3

Static

static

1

Comprovati...fR.vbs

windows10-2004-x64

3

Comprovati...fR.vbs

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    109s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 12:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Comprovativo_Junho_22-06-2026-gLQcpfR.vbs
  • Size 6.8MB
  • Sample260622-pe5pbab16w
  • SHA256 f7eff33c3e2043ab75c1e2f6a37bb1adf9f32635347493fa5780f1f5020aea05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Comprovativo_Junho_22-06-2026-gLQcpfR.vbs"
    1⤵
    • Modifies registry class
    PID:4272
  • C:\Windows\System32\cmd.exe
    cmd.exe
    1⤵
      PID:6120
    • C:\Windows\system32\cmd.exe
      "cmd.exe" cmd /c copy /Y "C:\Users\Admin\AppData\Local\Temp\Comprovativo_Junho_22-06-2026-gLQcpfR.vbs" "C:\Users\Admin\AppData\Local\Temp\134.vbs" & move /Y "C:\Users\Admin\AppData\Local\Temp\134.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\134.vbs"
      1⤵
        PID:4340
      • C:\Windows\System32\wscript.exe
        wscript.exe
        1⤵
          PID:2848
        • C:\Windows\system32\wscript.exe
          "wscript.exe" "C:\Users\Admin\AppData\Local\Temp\1060.vbs"
          1⤵
            PID:6136
          • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
            "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
            1⤵
            • System Location Discovery: System Language Discovery
            PID:6124
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3672
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3672 CREDAT:17410 /prefetch:2
              2⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:5776
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:4872

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
                  • Size 4KB
                  • SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  known_providers_download_v1[1].xml
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THWX93TP\known_providers_download_v1[1].xml
                  • Size 88KB
                  • SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  1060.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\1060.vbs
                  • Size 63KB
                  • SHA256 0d49e78807402eb8f9a18e8ee3e6816f15aaefff23be9ae7da7262894a222e71
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download