7f3347e8ab745e8a9d4f49ea31fa574225783d3fd0fb89767236cd8e25ec6b5e

General

Target
Zamowienie zakupu_260600044_20260721.vbs
Size 1.2MB
Sample260723-p29xjsxtbv
SHA256 7f3347e8ab745e8a9d4f49ea31fa574225783d3fd0fb89767236cd8e25ec6b5e
MD5 591f0a61ae3446971e98c2d8b7e41d2f
SHA1 5adc02ebcc1c9265180d3e447f42eb6a5906f7fa
SHA512 82ba5479d1cac26c8a9a971e8e6f91b70bd9aa1dd23c892d8a1e7a8a7126b2bbd9b615c6f78a2cb9e935b76bc8919b839efbb1bf4a0369c773c40c15c7c1338d
SSDEEP 384:3WjxpXJcrzW8r4cWLWZt74nWlDqq7WnZt74rWFrcpcCnWlIxpXJcrzW5tWerCcD8:hij0kJGFBSuZiOlaOMkOk86LeX
TLSH
T1B7459422FAD414F46F517E1302771A44B89C17DBE638246BCA928874D9B78B0D2E7B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4088	powershell.exe	88

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4432	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2132	powershell.exe
4432	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zamowienie zakupu_260600044_20260721.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zamowienie zakupu_260600044_20260721.vbs	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4460	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2132	powershell.exe
2132	powershell.exe
4432	powershell.exe
4432	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2132	4460	WScript.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zamowienie zakupu_260600044_20260721.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Zamowienie zakupu_260600044_20260721.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zamowienie zakupu_260600044_20260721.vbs' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:dynamitical"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b744149b2a634c16841876fa0594a1d4ee96172cc9ff4b45edb4e2d222cd049f
MD5 be0c2503bcfaed700ef795d0bf63653e
SHA1 3c8bcbe21928b25b3584297f0f45a0a4965139a4
SHA512 e18f847b77ffc12131e6d63fafed663f1deddccf9400b2e429105d961e55a17865c78483a867b9fd122b6b6f61580774667dc46c927b3b4b6d728c7078570b9a
TLSH
T1FE115327F39C8921CC96153A409EAC1176B683DB41AEDE9F6FC4D214A17F984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1tky4ul4.ncy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tky4ul4.ncy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads